Function at 0x40a2d5
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create a process with modified i/o handles and window
Create directory
Create pipe
Create process on windows
Encode data using base64
Execute shell command and capture output
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5ec
mov eax, dword [ebp + 0x6c]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
push 0x20
mov dword [ebp + 0x4c], ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x100], ebx
mov byte [ebp + 0x1b], bl
mov byte [ebp - 0x38], bl
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x120], ebx
pop edi
je 0x40a56a
lea eax, [ebp + 0x6c]
push eax
call fcn.0043dae7
pop ecx
mov ecx, dword [ebp + 0x6c]
cmp ecx, ebx
je 0x40a56a
cmp word [ecx], 0x2f
jne 0x40a56a
mov dx, word [ecx + 2]
or dx, di
cmp dx, 0x69
push 0x73
pop esi
jne 0x40a411
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x6e
jne 0x40a411
mov ax, word [ecx + 6]
or ax, di
cmp ax, si
jne 0x40a411
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x74
jne 0x40a411
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x61
jne 0x40a411
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x6c
jne 0x40a411
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x6c
jne 0x40a411
mov ax, word [ecx + 0x10]
or ax, di
cmp ax, si
jne 0x40a411
mov ax, word [ecx + 0x12]
or ax, di
cmp ax, 0x65
jne 0x40a411
mov ax, word [ecx + 0x14]
or ax, di
cmp ax, 0x72
jne 0x40a411
mov ax, word [ecx + 0x16]
or ax, di
cmp ax, 0x76
jne 0x40a411
mov ax, word [ecx + 0x18]
or ax, di
cmp ax, dx
jne 0x40a411
mov ax, word [ecx + 0x1a]
or ax, di
cmp ax, 0x63
jne 0x40a411
mov ax, word [ecx + 0x1c]
or ax, di
cmp ax, 0x65
jne 0x40a411
mov ax, word [ecx + 0x1e]
call fcn.0043daaf
test al, al
jne 0x40a53e
cmp dx, si
jne 0x40a475
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x65
jne 0x40a475
mov ax, word [ecx + 6]
or ax, di
cmp ax, 0x72
jne 0x40a475
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x76
jne 0x40a475
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x69
jne 0x40a475
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x63
jne 0x40a475
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x65
jne 0x40a475
mov ax, word [ecx + 0x10]
call fcn.0043daaf
test al, al
jne 0x40a53e
cmp dx, 0x72
jne 0x40a56a
mov dx, word [ecx + 4]
push 0x65
or dx, di
pop eax
cmp dx, ax
jne 0x40a56a
mov dx, word [ecx + 6]
or dx, di
cmp dx, 0x6d
jne 0x40a56a
mov dx, word [ecx + 8]
or dx, di
cmp dx, 0x6f
jne 0x40a56a
mov dx, word [ecx + 0xa]
or dx, di
cmp dx, 0x76
jne 0x40a56a
mov dx, word [ecx + 0xc]
or dx, di
cmp dx, ax
jne 0x40a56a
mov dx, word [ecx + 0xe]
or dx, di
cmp dx, si
jne 0x40a56a
mov dx, word [ecx + 0x10]
or dx, di
cmp dx, ax
jne 0x40a56a
mov dx, word [ecx + 0x12]
or dx, di
cmp dx, 0x72
jne 0x40a56a
mov dx, word [ecx + 0x14]
or dx, di
cmp dx, 0x76
jne 0x40a56a
mov dx, word [ecx + 0x16]
or dx, di
cmp dx, 0x69
jne 0x40a56a
mov dx, word [ecx + 0x18]
or dx, di
cmp dx, 0x63
jne 0x40a56a
mov dx, word [ecx + 0x1a]
or dx, di
cmp dx, ax
jne 0x40a56a
mov ax, word [ecx + 0x1c]
call fcn.0043daaf
test al, al
je 0x40a56a
mov edi, 0x4d7c88
push str.PECMD_EXEC
mov ecx, edi
call fcn.0044ce38
push dword [ebp + 0x6c]
mov ecx, edi
call fcn.00443fc7
mov eax, dword [ebp + 0x4c]
mov word [eax + 0x88], 2
jmp 0x40eddd
mov eax, dword [ebp + 0x70]
and eax, 1
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x70]
shr eax, 1
and eax, 1
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x70]
shr eax, 2
and al, 1
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0xf0], ebx
mov byte [ebp + 0x12], bl
mov byte [ebp + 0x13], bl
mov byte [ebp + 0x73], al
mov byte [ebp + 0x3a], bl
call fcn.00443f5b
cmp dword [ebp + 0x64], ebx
je 0x40a5c9
push dword [ebp + 0x64]
lea ecx, [ebp - 0x14c]
call fcn.0044ce38
mov eax, dword [ebp - 0x14c]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
pop ecx
lea ecx, [ebp - 0x150]
call fcn.00443f5b
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x40a5f0
push eax
lea ecx, [ebp - 0x150]
call fcn.0044ce38
mov eax, dword [ebp - 0x150]
mov dword [ebp + 0x6c], eax
cmp dword [ebp + 0x74], ebx
jne 0x40a5fe
lea ecx, [ebp - 0x134]
mov dword [ebp + 0x74], ecx
mov ecx, dword [ebp + 0x64]
cmp ecx, ebx
push 0x5e
pop esi
mov dword [ebp + 0x30], ecx
mov dword [ebp - 0x1a4], esi
jne 0x40a641
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x40a641
push 5
push eax
push str._shel
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40a641
lea eax, [ebp - 0x1a4]
mov dword [ebp + 0x6c], eax
xor eax, eax
inc eax
mov dword [ebp + 0x24], eax
mov dword [ebp - 0x48], eax
mov byte [ebp + 0x73], al
lea ecx, [ebp - 0x124]
mov dword [ebp + 0x3c], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov byte [ebp + 0x38], bl
mov byte [ebp - 0x3a], 1
mov byte [ebp - 0x61], bl
mov byte [ebp + 0xf], bl
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x35], bl
mov byte [ebp + 0x46], bl
mov byte [ebp - 0x4d], bl
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x63], bl
call fcn.00443f5b
mov al, byte [0x4d7be0]
neg al
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x180], ebx
mov byte [ebp - 0x55], bl
mov byte [ebp + 0x37], bl
mov byte [ebp - 0x39], bl
sbb eax, eax
and eax, 0x10000
mov byte [ebp - 0x3b], bl
mov byte [ebp - 0x37], 1
mov byte [ebp - 0x62], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call fcn.00443f5b
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x88], ebx
mov byte [ebp + 0x47], bl
call fcn.00443f5b
lea ecx, [ebp - 0xb4]
call fcn.00443f5b
lea ecx, [ebp - 0xac]
call fcn.00443f5b
or dword [ebp - 0x94], 0xffffffff
lea ecx, [ebp - 0x188]
mov byte [ebp - 1], bl
mov byte [ebp - 0x2d], bl
mov byte [ebp + 0x3b], bl
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0xf4], ebx
call fcn.00443f5b
xor eax, eax
push 0x10
pop ecx
mov dword [ebp - 0x260], 0x44
mov dword [ebp - 0x25c], ebx
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
push 0x12
mov dword [ebp - 0x17c], ebx
pop ecx
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x178]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x16c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x60], ebx
cmp eax, ebx
jne 0x40a783
mov byte [ebp + 0x3b], 1
jmp 0x40a7dd
cmp word [eax], 0x23
jne 0x40a799
cmp eax, dword [ebp + 0x64]
jne 0x40a792
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
jmp 0x40a7a6
test byte [0x4d7c0a], 3
je 0x40a7a6
mov byte [ebp + 0x3b], 3
cmp eax, ebx
je 0x40a7dd
cmp word [eax], si
jne 0x40a7c1
cmp eax, dword [ebp + 0x64]
jne 0x40a7b8
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x73], 1
cmp eax, ebx
je 0x40a7dd
cmp word [eax], 0x24
jne 0x40a7dd
cmp eax, dword [ebp + 0x64]
jne 0x40a7d4
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x46], 1
cmp eax, ebx
mov dword [ebp + 0x40], ebx
je 0x40a7ff
cmp word [eax], 0x7c
jne 0x40a7ff
cmp eax, dword [ebp + 0x64]
jne 0x40a7f3
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x40], 1
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x40a8e7
cmp word [eax], 0x2a
jne 0x40a8e7
add dword [ebp + 0x64], 2
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
mov dword [ebp + 0x3c], 0x10
je 0x40a8dd
push 2
xor esi, esi
pop edi
inc esi
cmp ax, 0x7c
jne 0x40a842
mov dword [ebp + 0x40], esi
jmp 0x40a8cb
cmp ax, 0x30
jb 0x40a89f
cmp ax, 0x39
ja 0x40a89f
or dword [ebp + 0x3c], esi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0044712a
cmp dword [ebp - 0x128], ebx
pop ecx
pop ecx
jg 0x40a881
jl 0x40a875
cmp dword [ebp - 0x12c], ebx
ja 0x40a881
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], ebx
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x24
jne 0x40a893
or byte [ebp + 0x3d], 1
jmp 0x40a8cb
cmp ax, 0x5e
jne 0x40a8ce
or byte [ebp + 0x3d], 2
jmp 0x40a8cb
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
jne 0x40a8b2
add dword [ebp + 0x64], edi
or dword [ebp + 0x3c], edi
jmp 0x40a8ce
cmp ax, 0x2d
jne 0x40a8c1
add dword [ebp + 0x64], edi
or dword [ebp + 0x3c], 4
jmp 0x40a8ce
cmp ax, 0x23
jne 0x40a8dd
mov byte [ebp + 0x1b], 1
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
jne 0x40a834
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
pop ecx
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
cmp word [ebp + 0x3c], bx
pop ecx
jne 0x40a992
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
cmp dword [ebp - 0xb0], ebx
mov eax, dword [ebp + 0x64]
pop ecx
mov dword [ebp + 0x48], eax
je 0x40a91d
cmp word [ebp + 0x3c], bx
jne 0x40aa70
push 2
pop esi
cmp word [eax], 0x2d
mov edi, eax
jne 0x40a934
add eax, 2
cmp word [eax], 0x2d
jne 0x40a934
mov dword [ebp + 0x48], eax
push 1
lea eax, [ebp + 0x48]
push eax
push 0x4bdf04
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x40aa70
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40a965
cmp ax, 0x2f
jne 0x40aa70
add dword [ebp + 0x48], esi
push 5
lea eax, [ebp + 0x48]
push eax
push str.catch
call fcn.00445fa6
add esp, 0xc
test al, al
je 0x40aa10
mov al, byte [ebp + 0x3c]
or dword [ebp + 0x3c], 0x10
cmp al, bl
jne 0x40ac3d
mov esi, dword [ebp + 0x64]
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
inc ecx
cmp ax, bx
mov dword [ebp + 0x24], ecx
mov edi, esi
je 0x40acda
push 2
pop edx
cmp ax, 0x3d
je 0x40a9be
add edi, edx
mov ax, word [edi]
cmp ax, bx
jne 0x40a9ae
cmp edi, esi
je 0x40acda
cmp word [edi], 0x3d
jne 0x40acda
sub edi, edx
cmp word [edi], 0x2b
jne 0x40a9df
mov al, byte [edi]
mov byte [ebp - 0x55], al
sub edi, edx
cmp edi, esi
mov ecx, edi
jbe 0x40a9f7
mov ax, word [ecx]
call fcn.0043daaf
test al, al
je 0x40a9f7
sub ecx, edx
cmp ecx, esi
ja 0x40a9e5
mov ax, word [ecx]
call fcn.0043daaf
test al, al
jne 0x40acd2
mov edx, ecx
inc ecx
inc ecx
jmp 0x40ac64
push 4
push dword [ebp + 0x48]
push str.cmd:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40abad
add dword [ebp + 0x48], 8
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x4c]
call fcn.0040825e
add esp, 0x14
mov dword [ebp - 0xb0], eax
jmp 0x40aa61
mov word [edi], 0x20
add edi, esi
cmp edi, dword [ebp + 0x48]
jb 0x40aa5a
cmp word [ebp + 0x3c], bx
je 0x40ac3d
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
mov eax, dword [ebp - 0xb0]
cmp eax, ebx
pop ecx
je 0x40aa8f
cmp word [eax], bx
jne 0x40aa8f
mov dword [ebp - 0xb0], ebx
cmp dword [ebp + 0x40], ebx
jne 0x40aa9c
cmp dword [ebp + 0x78], ebx
mov byte [ebp + 0x57], bl
je 0x40aaa0
mov byte [ebp + 0x57], 1
or dword [ebp - 0x118], 0xffffffff
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x11c], ebx
call fcn.00443f5b
lea ecx, [ebp - 0x144]
call fcn.00443f5b
cmp byte [ebp + 0x57], bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x110], ebx
mov byte [ebp + 0x39], bl
mov dword [ebp - 0x18], ebx
jne 0x40ab18
cmp dword [ebp + 0x30], ebx
jne 0x40ab18
mov ecx, dword [ebp + 0x4c]
push 1
push ebx
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0x64]
call fcn.00454bdd
mov eax, dword [ebp - 0x110]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x2d
mov dword [ebp - 0x7c], eax
jne 0x40ab30
add eax, 2
cmp word [eax], 0x2d
jne 0x40ab30
mov dword [ebp + 0x64], eax
xor esi, esi
inc esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bdf04
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x40bad5
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40ab63
cmp ax, 0x2f
jne 0x40bad5
push 2
pop edi
add dword [ebp + 0x64], edi
push 5
lea eax, [ebp + 0x64]
push eax
push str.catch
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ace1
mov dword [ebp + 0x3c], 0x10
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4bdef0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ad2b
mov dword [ebp - 0x1c], esi
jmp 0x40ab18
push 3
push dword [ebp + 0x48]
push 0x4bdeec
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40abd7
add dword [ebp + 0x48], 6
jmp 0x40abcc
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x40abc9
jmp 0x40ac1b
push 4
push dword [ebp + 0x48]
push str.exe:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40ac01
add dword [ebp + 0x48], 8
jmp 0x40abf6
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x40abf3
jmp 0x40ac1b
push 5
push dword [ebp + 0x48]
push str.logs:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40ac3d
add dword [ebp + 0x48], 0xa
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x22
jne 0x40ac3d
add dword [ebp + 0x48], esi
jmp 0x40ac32
add dword [ebp + 0x48], esi
cmp ax, 0x22
je 0x40ac3d
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, bx
jne 0x40ac29
lea eax, [ebp + 0x48]
push eax
call fcn.00408ddd
mov eax, dword [ebp + 0x48]
pop ecx
jmp 0x40a920
lea eax, [edx - 2]
mov dword [ebp - 0x7c], eax
mov ax, word [eax]
call fcn.0043daaf
test al, al
jne 0x40ac68
mov edx, dword [ebp - 0x7c]
cmp edx, esi
ja 0x40ac4f
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.0044407f
mov esi, dword [ebp + 0x4c]
push ebx
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
call fcn.00402eb0
cmp byte [esi + 0x92], bl
jne 0x40ac93
test byte [esi + 9], 0xf
je 0x40aca9
push ebx
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
call fcn.00402eb0
jmp 0x40aca9
cmp ax, 0x3d
je 0x40acb7
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40aca1
cmp ax, 0x3d
jne 0x40acd2
lea eax, [ebp - 0x13c]
add edi, 2
push eax
mov dword [ebp - 0x13c], edi
call fcn.0043dae7
pop ecx
jmp 0x40a8fb
xor ebx, ebx
inc ebx
jmp 0x40ed7d
mov ebx, ecx
jmp 0x40ed7d
push 6
push dword [ebp + 0x64]
push str.clone:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40ab8b
add dword [ebp + 0x64], 0xc
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x40ad1a
mov word [eax], bx
add dword [ebp + 0x64], edi
cmp word [esi], bx
je 0x40adfe
mov dword [ebp - 0x54], esi
jmp 0x40adfe
push 4
lea eax, [ebp + 0x64]
push eax
push str.shel
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ad55
or byte [ebp + 0x73], 2
and byte [ebp + 0x3b], 0xfe
mov dword [ebp - 0x48], esi
mov dword [ebp + 0x24], esi
jmp 0x40ab18
push 5
push dword [ebp + 0x64]
push str.shel:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40adc3
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
or byte [ebp + 0x73], 2
and byte [ebp + 0x3b], 0xfe
mov dword [ebp - 0x84], eax
push 5
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x40], ebx
call fcn.00419ccc
add esp, 0xc
cmp dword [ebp + 0x40], ebx
mov dword [ebp + 0x64], eax
jle 0x40ab18
push dword [ebp + 0x40]
lea ecx, [ebp - 0x120]
push dword [ebp - 0x84]
call fcn.0044407f
jmp 0x40ab18
push 9
push dword [ebp + 0x64]
push str.runrmenu:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40ae0c
add dword [ebp + 0x64], 0x12
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
pop ecx
lea ecx, [ebp - 0x124]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0044407f
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
jmp 0x40bacc
push 8
push dword [ebp + 0x64]
push str.poprmenu
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40aebc
add dword [ebp + 0x64], 0x10
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x40ae45
add dword [ebp + 0x64], edi
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
pop ecx
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x4d], 1
je 0x40ae7a
cmp ax, 0x30
jb 0x40ae77
cmp ax, 0x39
jbe 0x40ae7a
add dword [ebp - 0x10], edi
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004503bc
mov eax, dword [ebp - 0x10]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x40aea6
cmp ax, 0x30
jb 0x40aea3
cmp ax, 0x39
jbe 0x40aea6
add dword [ebp - 0x10], edi
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004503bc
pop ecx
jmp 0x40bacc
push 4
push dword [ebp + 0x64]
push str.pid:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40af30
add dword [ebp + 0x64], 8
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0x7c], edi
call fcn.00405615
mov ax, word [edi]
cmp ax, 0x28
pop ecx
je 0x40af19
cmp ax, 0x30
jne 0x40af03
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
je 0x40af19
mov eax, dword [ebp + 0x64]
cmp edi, eax
je 0x40adfe
lea ecx, [ebp - 0x11c]
jmp 0x40adf3
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004404ef
pop ecx
pop ecx
jmp 0x40adfe
push 5
push dword [ebp + 0x64]
push str.hpid:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40af6d
add dword [ebp + 0x64], 0xa
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40adfe
lea ecx, [ebp - 0x148]
jmp 0x40b951
push 5
push dword [ebp + 0x64]
push str.ppid:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40afe4
add dword [ebp + 0x64], 0xa
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.004472b5
cmp dword [ebp - 0x98], ebx
pop ecx
pop ecx
jg 0x40afd6
jl 0x40afb7
cmp dword [ebp - 0x9c], ebx
jae 0x40afd6
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
call fcn.00408392
pop ecx
pop ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x60], eax
jmp 0x40ab18
push 4
push dword [ebp + 0x64]
push str.exe:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b0f9
mov eax, dword [ebp + 0x64]
add eax, 8
mov dword [ebp + 0x64], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov edi, eax
mov dword [ebp + 0x14], ebx
jne 0x40b01a
mov dword [ebp - 0x18], esi
cmp cx, 0x22
jne 0x40b091
lea esi, [eax + 2]
mov edi, eax
mov ecx, esi
jmp 0x40b04f
cmp ax, 0x22
jne 0x40b04d
inc edx
test dl, 1
je 0x40b04d
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x40b05a
call fcn.0043daaf
test al, al
jne 0x40b05a
or dword [ebp - 0x18], 2
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x40b029
push 0x22
pop edx
cmp word [ecx], dx
jne 0x40b09e
or dword [ebp + 0x14], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
cmp word [ecx - 4], dx
mov edi, esi
mov byte [ebp + 0x39], 2
je 0x40b085
mov ax, word [edi]
cmp ax, dx
jne 0x40b09e
cmp word [edi + 2], dx
jne 0x40b08a
mov byte [ebp + 0x39], bl
jmp 0x40b09e
cmp ax, dx
jne 0x40b09e
jmp 0x40b085
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
pop ecx
mov ecx, dword [ebp + 0x64]
sub ecx, edi
sar ecx, 1
add dword [ebp + 0x14], ecx
cmp dword [ebp + 0x14], ebx
jle 0x40adfe
add edi, 0xfffffff6
push edi
lea ecx, [ebp - 0xc4]
call fcn.0044ce38
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x14]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x20], eax
jne 0x40adfe
cmp word [eax + 2], bx
jne 0x40adfe
lea eax, [ebp - 0xc4]
push eax
call fcn.004047d2
pop ecx
mov dword [ebp + 0x20], eax
jmp 0x40adfe
push 3
push dword [ebp + 0x64]
push 0x4bdeec
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b1ff
mov eax, dword [ebp + 0x64]
xor edi, edi
add eax, 6
jmp 0x40b120
inc edi
inc eax
inc eax
mov dword [ebp + 0x64], eax
cmp word [eax], 0x2a
je 0x40b11d
cmp edi, 2
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x44], ebx
jge 0x40b1b1
movzx eax, word [eax]
cmp ax, bx
je 0x40b17b
call fcn.0043daaf
test al, al
jne 0x40b17b
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00419ccc
add esp, 0xc
cmp dword [ebp - 0x44], ebx
mov dword [ebp + 0x64], eax
jle 0x40b17b
push dword [ebp - 0x44]
lea ecx, [ebp - 0x70]
push dword [ebp - 0x114]
call fcn.0044407f
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0x50], eax
cmp edi, esi
jne 0x40b1eb
cmp dword [ebp - 0x44], ebx
jle 0x40b1f3
mov eax, dword [ebp - 0x70]
push esi
lea ecx, [ebp - 0x70]
push ecx
push eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x70], ebx
call fcn.004962db
add esp, 0xc
lea ecx, [ebp - 0x140]
mov dword [ebp + 0x50], eax
call fcn.0043db4f
jmp 0x40adfe
push 0x105
lea ecx, [ebp - 0x70]
call fcn.00443fa0
push 0x104
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x40b1e0
mov word [eax], bx
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0x50], eax
jmp 0x40adfe
cmp edi, ebx
jle 0x40adfe
mov dword [ebp + 0x50], 0x4bde90
jmp 0x40adfe
push 5
push dword [ebp + 0x64]
push str.logs:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b278
mov eax, dword [ebp + 0x64]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x40], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x40b236
add eax, 2
mov dword [ebp + 0x40], eax
mov esi, dword [ebp + 0x40]
push 1
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x40]
push eax
mov dword [ebp + 4], ebx
call fcn.00419ccc
add esp, 0xc
cmp dword [ebp + 4], ebx
mov dword [ebp + 0x64], eax
jle 0x40adfe
cmp edi, ebx
je 0x40b26a
cmp dword [0x4d7cf8], ebx
je 0x40adfe
push dword [ebp + 4]
lea ecx, [ebp - 0x154]
jmp 0x40b956
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4bde8c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b297
mov byte [ebp - 0x63], 1
jmp 0x40ab18
push 5
lea eax, [ebp + 0x64]
push eax
push str.nowin
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b2b7
mov byte [ebp - 0x3c], 1
jmp 0x40ab18
push 4
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push str.hide
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b2dc
mov dword [ebp - 0x14], 0x10000000
jmp 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4bde74
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b300
inc dword [ebp - 0xf0]
mov dword [ebp + 0x24], esi
jmp 0x40ab18
push 5
lea eax, [ebp + 0x64]
push eax
push str.waiti
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b320
mov byte [ebp + 0x3a], 1
jmp 0x40ab18
push 3
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde68
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b342
or byte [ebp + 0x38], 1
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde64
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b361
mov byte [ebp - 0x38], 1
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde60
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push str.err
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b39a
or byte [ebp + 0x38], 3
jmp 0x40ab18
push 5
lea eax, [ebp + 0x64]
push eax
push str.limit
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b3ba
mov byte [ebp - 0x56], 1
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde4c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b3d9
mov byte [ebp - 0x35], 1
jmp 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push str.hook
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b3fb
mov dword [ebp - 0x48], 1
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde40
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b41d
mov dword [ebp - 0x14], 6
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4bde3c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b43b
mov dword [ebp - 0x14], esi
jmp 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push str.show
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b45d
mov dword [ebp - 0x14], 1
jmp 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push str.runs
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b47c
mov byte [ebp - 0x69], 1
jmp 0x40ab18
push 2
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4bde28
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b49e
mov byte [ebp - 0x3a], 1
jmp 0x40ab18
push 4
lea eax, [ebp + 0x64]
push eax
push str.no64
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b4bd
mov byte [ebp - 0x3a], bl
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4bde1c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b4dd
mov byte [ebp - 0x61], 1
jmp 0x40ab18
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4bde18
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b4fc
mov byte [ebp + 0xf], 1
jmp 0x40ab18
push 5
lea eax, [ebp + 0x64]
push eax
push str.incmd
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b51c
mov byte [ebp - 0x3b], 1
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push str.svr_
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b53b
mov dword [ebp - 0x20], ebx
jmp 0x40ab18
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrsys
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b55e
mov dword [ebp - 0x20], 0x20000
jmp 0x40ab18
push 7
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrsys_
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b587
mov al, byte [0x4d7be0]
neg al
sbb eax, eax
and eax, 0x20000
jmp 0x40b5c8
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrusr
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b5a7
or dword [ebp - 0x20], 1
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrusr_
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b5d0
xor eax, eax
cmp byte [0x4d7be0], bl
setne al
mov dword [ebp - 0x20], eax
jmp 0x40ab18
push esi
lea eax, [ebp + 0x64]
push eax
push str.hidecmd
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b5ef
mov byte [ebp - 0x37], 1
jmp 0x40ab18
push 8
lea eax, [ebp + 0x64]
push eax
push str.hidecmd_
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b60e
mov byte [ebp - 0x37], bl
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4bddd0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b631
mov dword [ebp + 0x2c], 1
jmp 0x40ab18
push 3
push dword [ebp + 0x64]
push 0x4bddcc
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b654
add dword [ebp + 0x64], 6
mov dword [ebp + 0x2c], 0x108
jmp 0x40b674
push edi
push dword [ebp + 0x64]
push 0x4bddc8
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b6cb
add dword [ebp + 0x64], 4
mov dword [ebp + 0x2c], 8
xor ecx, ecx
jmp 0x40b6bb
mov eax, ecx
call fcn.0043daaf
test al, al
jne 0x40bac3
or ecx, 0x20
cmp cx, 0x61
jne 0x40b696
or dword [ebp + 0x2c], 0x40
jmp 0x40b6b8
cmp cx, 0x65
jne 0x40b6a2
or byte [ebp + 0x2c], 0x80
jmp 0x40b6b8
cmp cx, 0x63
jne 0x40b6ae
or byte [ebp + 0x2d], 1
jmp 0x40b6b8
cmp cx, 0x64
jne 0x40b6b8
or byte [ebp + 0x2d], 2
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov cx, word [eax]
cmp cx, bx
jne 0x40b678
jmp 0x40bac3
push 3
push dword [ebp + 0x64]
push 0x4bddc4
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b71c
add dword [ebp + 0x64], 6
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x3a
mov byte [ebp + 0x46], 1
jne 0x40adfe
add dword [ebp + 0x64], edi
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40adfe
lea ecx, [ebp - 0xfc]
jmp 0x40b951
push 5
push dword [ebp + 0x64]
push str.code:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b7dd
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x40], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.UTF8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b76a
mov byte [ebp + 0x47], 1
mov dword [ebp - 0x88], 0xfde9
jmp 0x40bac3
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.ANSI
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b790
mov byte [ebp + 0x47], 1
mov dword [ebp - 0x88], ebx
jmp 0x40bac3
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push 0x4bdda8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b7ba
mov byte [ebp + 0x47], 2
mov dword [ebp - 0x88], 0x4b0
jmp 0x40bac3
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004404ef
test eax, eax
pop ecx
pop ecx
jle 0x40bac3
mov byte [ebp + 0x47], 1
jmp 0x40bac3
push esi
lea eax, [ebp + 0x64]
push eax
push str.timeout:
call fcn.00445fe4
add esp, 0xc
test al, al
je 0x40b88a
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x1c], eax
mov cx, word [eax]
cmp cx, 0x23
mov byte [ebp - 0x36], bl
jne 0x40b80f
mov byte [ebp - 0x36], 1
jmp 0x40b819
cmp cx, 0x2a
jne 0x40b81f
mov byte [ebp - 0x36], 2
add eax, 2
mov dword [ebp + 0x1c], eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp + 0x1c]
push eax
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
call fcn.0048b900
test eax, eax
pop ecx
pop ecx
jle 0x40bac3
mov eax, dword [ebp - 0x138]
cmp eax, ebx
jle 0x40bac3
or dword [ebp + 0x24], 0x10
mov dword [ebp - 0xc8], eax
mov al, byte [ebp - 0x36]
mov byte [ebp + 0x1b], al
mov eax, dword [ebp + 0x1c]
cmp word [eax], 0x3a
jne 0x40bac3
add dword [ebp + 0x1c], edi
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004404ef
pop ecx
pop ecx
jmp 0x40bac3
push 5
push dword [ebp + 0x64]
push str.user:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b8eb
add dword [ebp + 0x64], 0xa
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp edi, eax
pop ecx
je 0x40adfe
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xb4]
call fcn.0044407f
cmp word [edi], 0x23
jne 0x40b8e3
cmp word [edi + 2], 0x23
jne 0x40b8e3
mov byte [ebp - 0x2d], 1
jmp 0x40adfe
mov byte [ebp - 0x2d], bl
jmp 0x40adfe
push esi
push dword [ebp + 0x64]
push str.passwd:
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b916
mov eax, dword [ebp + 0x64]
cmp word [eax + 0xe], 0x23
jne 0x40b911
cmp word [eax + 0x10], 0x23
je 0x40b92b
mov byte [ebp - 1], bl
jmp 0x40b92f
push esi
push dword [ebp + 0x64]
push str.passwd
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40b95c
mov byte [ebp - 1], 1
add dword [ebp + 0x64], 0xe
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40adfe
lea ecx, [ebp - 0xac]
sub eax, esi
sar eax, 1
push eax
push esi
jmp 0x40adf9
push 8
lea eax, [ebp + 0x64]
push eax
push str.REALTIME
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b97f
mov dword [ebp - 0x24], pe_nt_image_headers32
jmp 0x40ab18
push 4
lea eax, [ebp + 0x64]
push eax
push str.HIGH
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b9a2
mov dword [ebp - 0x24], 0x80
jmp 0x40ab18
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.ABOVENORMAL
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b9c5
mov dword [ebp - 0x24], 0x8000
jmp 0x40ab18
push 6
lea eax, [ebp + 0x64]
push eax
push str.NORMAL
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40b9e8
mov dword [ebp - 0x24], 0x20
jmp 0x40ab18
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.BELOWNORMAL
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ba0b
mov dword [ebp - 0x24], 0x4000
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4bdd4c
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x40ba45
mov edi, dword [ebp + 0x64]
push 0x4bdd40
push 4
pop esi
call fcn.00402d6c
cmp al, bl
pop ecx
lea eax, [ebp + 0x64]
je 0x40ba51
add dword [ebp + 0x64], 8
push eax
call fcn.0043dae7
pop ecx
mov dword [ebp - 0x24], 0x40
jmp 0x40ab18
push 3
push eax
push 0x4bdd3c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ba6e
mov byte [ebp + 0x37], 1
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4bdd38
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40ba97
mov byte [ebp - 0x39], 1
mov byte [ebp + 0x47], bl
mov dword [ebp - 0x88], ebx
jmp 0x40ab18
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4bdd34
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40bab7
mov byte [ebp - 0x62], 1
jmp 0x40ab18
mov eax, dword [ebp - 0x7c]
cmp word [eax], 0x2d
mov dword [ebp + 0x64], eax
jne 0x40bad2
lea eax, [ebp + 0x64]
push eax
call fcn.00408ddd
pop ecx
jmp 0x40ab18
xor esi, esi
inc esi
cmp dword [ebp + 0x2c], ebx
je 0x40baff
cmp byte [ebp - 0x3c], bl
je 0x40bae3
or dword [ebp + 0x2c], 4
cmp dword [ebp + 0x2c], ebx
je 0x40baff
cmp byte [ebp + 0x3a], bl
je 0x40baf1
or dword [ebp + 0x2c], 0x20
cmp dword [ebp + 0x2c], ebx
je 0x40baff
cmp byte [ebp - 0x3b], bl
je 0x40baff
or byte [ebp + 0x2d], 4
cmp dword [ebp - 0x60], ebx
je 0x40bb31
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x1c4]
mov dword [eax], 0x48
call fcn.00404884
mov eax, dword [ebp - 0x1c0]
neg eax
sbb eax, eax
and eax, 0x80000
mov dword [ebp - 8], eax
cmp dword [ebp - 0x88], 0x4b0
jne 0x40bb41
mov byte [ebp + 0x47], 2
mov eax, dword [ebp - 0x13c]
cmp eax, ebx
je 0x40bb73
cmp byte [ebp + 0x57], bl
mov dword [ebp + 0x64], eax
jne 0x40bb73
cmp dword [ebp + 0x30], ebx
jne 0x40bb73
push esi
push ebx
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp + 0x4c]
push eax
call fcn.00454bdd
mov eax, dword [ebp - 0x110]
mov dword [ebp + 0x64], eax
mov edi, dword [ebp + 0x20]
cmp edi, ebx
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
je 0x40bb97
cmp word [edi], bx
je 0x40bb97
cmp word [ebp - 0x18], bx
je 0x40bb9a
mov byte [ebp + 0x37], bl
cmp edi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10c], 0x4bd274
je 0x40bc81
cmp word [edi], 0x2a
jne 0x40bbc9
inc edi
inc edi
inc dword [ebp - 0x28]
cmp word [edi], 0x2a
je 0x40bbbb
mov dword [ebp + 0x20], edi
cmp word [edi], 0x3f
jne 0x40bbf5
inc edi
inc edi
mov dword [ebp + 0x20], edi
mov dword [ebp - 0x10c], edi
jmp 0x40bbe7
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x20], edi
je 0x40bbf1
mov ax, word [edi]
cmp ax, bx
jne 0x40bbdc
jmp 0x40bbf5
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x40bc2d
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x40bc2d
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x40bc2d
cmp word [edi + 6], 0x3a
jne 0x40bc2d
mov dword [ebp - 0x34], esi
add edi, 8
jmp 0x40bc51
cmp ax, 0x65
jne 0x40bc54
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x40bc54
cmp word [edi + 4], 0x3a
jne 0x40bc54
mov dword [ebp - 0x34], pe_nt_image_headers32
add edi, 6
mov dword [ebp + 0x20], edi
cmp edi, ebx
je 0x40bc81
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x40bc81
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x40bc81
cmp word [edi + 4], 0x3a
jne 0x40bc81
add edi, 6
mov dword [ebp + 8], esi
mov dword [ebp + 0x20], edi
cmp byte [ebp + 0x37], bl
je 0x40bcc6
cmp edi, ebx
je 0x40bcc6
cmp word [ebp - 0x34], bx
jne 0x40bcc6
cmp word [ebp + 8], bx
jne 0x40bcc6
xor edx, edx
cmp byte [ebp + 0x39], bl
mov ecx, edi
setne dl
xor eax, eax
mov ax, word [edi]
jmp 0x40bcc1
cmp ax, 0x22
jne 0x40bcbc
inc edx
cmp edx, 2
jl 0x40bcbc
cmp word [ecx + 2], bx
je 0x40bcbc
mov byte [ebp + 0x37], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x40bca7
cmp word [ebp - 0x28], bx
jne 0x40bcd8
cmp word [ebp - 0x34], bx
jne 0x40bcd8
cmp word [ebp + 8], bx
je 0x40bcdb
mov byte [ebp + 0x39], bl
cmp edi, ebx
je 0x40bcef
push 0x2a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x40bcef
mov word [eax], bx
cmp byte [ebp + 0x37], bl
je 0x40bd1c
xor eax, eax
cmp word [ebp + 8], bx
sete al
xor ecx, ecx
cmp word [ebp - 0x34], bx
sete cl
test ecx, eax
je 0x40bd1c
lea eax, [ebp - 0x1d0]
push eax
push edi
call fcn.0041477a
pop ecx
pop ecx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 0x74]
mov dword [eax], esi
xor eax, eax
cmp dword [ebp - 0x54], ebx
lea edi, [ebp - 0x18c]
mov dword [ebp - 0x190], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1b8], ebx
lea edi, [ebp - 0x1b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x28], esi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], ebx
stosd dword es:[edi], eax
je 0x40bd7b
mov dword [ebp - 0x1c], esi
cmp byte [ebp + 0xf], bl
mov dword [ebp - 0x1a0], 0xc
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x15c], ebx
je 0x40bdc4
mov ecx, dword [0x4d6354]
lea eax, [ebp - 0x260]
or byte [eax + 0x2d], 1
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4d6358]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4d6350]
mov dword [ebp - 0x1c], esi
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x57], bl
je 0x40c2e1
mov ecx, dword [ebp + 0x64]
cmp word [ecx], 0x7c
mov dword [ebp + 0x14], ebx
jne 0x40bdf2
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x40bdd9
call fcn.0043daaf
test al, al
jne 0x40bdd9
mov dword [ebp + 0x40], ecx
mov eax, dword [ebp + 0x64]
xor edx, edx
mov dword [ebp + 0x58], edx
cmp word [eax], bx
je 0x40be9d
cmp word [eax], 0x7c
jne 0x40be22
cmp word [eax + 2], 0x7c
je 0x40be1a
mov edx, eax
mov dword [ebp + 0x58], edx
jmp 0x40be22
inc eax
inc eax
cmp word [eax], 0x7c
je 0x40be1a
inc eax
inc eax
cmp word [eax], bx
jne 0x40be06
cmp edx, ebx
je 0x40be9d
lea eax, [ebp + 0x58]
mov word [edx], bx
add dword [ebp + 0x58], 2
push eax
call fcn.0043dae7
mov edx, dword [ebp + 0x58]
xor eax, eax
mov ax, word [edx]
cmp ax, bx
pop ecx
mov edi, edx
je 0x40bdf5
cmp ax, 0x7c
jne 0x40be7c
lea esi, [edi + 2]
cmp word [esi], ax
jne 0x40be7c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push esi
push edi
call fcn.00413d9a
add esp, 0xc
cmp word [edi], 0x7c
jne 0x40be79
inc edi
inc edi
jmp 0x40be6f
mov edx, dword [ebp + 0x58]
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40be4d
cmp word [edx], bx
je 0x40bdf5
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
mov cl, 1
je 0x40be9f
mov al, cl
jmp 0x40beab
xor cl, cl
xor al, al
cmp cl, bl
jne 0x40beab
mov edx, dword [ebp + 0x40]
mov dword [ebp + 0x58], edx
cmp al, bl
mov dword [ebp + 0x30], edx
je 0x40bf90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xa8]
push eax
xor edi, edi
lea eax, [ebp - 0xa4]
inc edi
push eax
mov dword [ebp - 0xe4], 0xc
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40bf02
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push edi
call fcn.004159e8
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0xa4]
push eax
push esi
push dword [ebp - 0xa4]
push esi
call edi
cmp dword [ebp - 0xa8], ebx
mov word [ebp + 0xe], bx
je 0x40bf56
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp - 0xa8]
lea eax, [ebp + 0xe]
push ebx
push ebx
push eax
push ecx
push dword [ebp + 0x40]
call fcn.0040a2d5
cmp dword [ebp - 0xa8], ebx
je 0x40bf56
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0xa4]
push eax
push esi
push dword [ebp - 0xa4]
mov dword [ebp - 0xa8], ebx
push esi
call edi
mov ecx, dword [ebp - 0xa4]
cmp ecx, ebx
je 0x40bf90
lea eax, [ebp - 0x260]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x1c], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x58], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x40c27d
cmp cx, 0x3c
je 0x40bfbe
cmp cx, 0x3e
je 0x40bfbe
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40bfa5
mov cx, word [eax]
cmp cx, bx
je 0x40c27d
cmp cx, 0x3c
jne 0x40c0c2
mov word [eax], bx
add dword [ebp + 0x58], 2
lea eax, [ebp + 0x58]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x40c0c2
mov dword [ebp + 0x1c], eax
jmp 0x40c007
cmp cx, 0x3c
je 0x40c00f
cmp cx, 0x3e
je 0x40c00f
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40bff6
sub eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x90]
sar eax, 1
push eax
push dword [ebp + 0x1c]
call fcn.0044cd91
lea ecx, [ebp + 0x40]
call fcn.00443f5b
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x1c]
call fcn.00454bdd
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0x1c], eax
call fcn.004108af
lea eax, [ebp + 0x1c]
push eax
call fcn.0043dae7
cmp dword [ebp - 0x4c], ebx
pop ecx
pop ecx
je 0x40c061
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x1a0]
push eax
push 7
mov esi, 0xc0000000
push esi
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
call fcn.0040569f
cmp dword [ebp - 0x4c], ebx
jne 0x40c0ac
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a0]
push eax
push 7
push esi
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x4c]
call fcn.0040569f
cmp dword [ebp - 0x4c], ebx
jne 0x40c0ac
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp + 0x40]
call fcn.0043db4f
lea ecx, [ebp - 0x90]
call fcn.0043db4f
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x40bf99
mov word [eax], bx
mov eax, dword [ebp + 0x58]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x57], 1
jne 0x40c0e7
mov byte [ebp + 0x57], 2
mov word [eax - 2], bx
add dword [ebp + 0x58], 2
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x40c0fa
add dword [ebp + 0x58], 2
mov esi, edi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x26
jne 0x40c10b
add dword [ebp + 0x58], 2
mov byte [ebp + 0x57], 3
lea eax, [ebp + 0x58]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x40bf99
mov dword [ebp], eax
jmp 0x40c137
cmp cx, 0x3c
je 0x40c13f
cmp cx, 0x3e
je 0x40c13f
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40c126
sub eax, dword [ebp]
lea ecx, [ebp - 0x84]
sar eax, 1
push eax
push dword [ebp]
call fcn.0044cd91
lea ecx, [ebp - 0x40]
call fcn.00443f5b
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp]
call fcn.00454bdd
mov eax, dword [ebp - 0x40]
push eax
mov dword [ebp], eax
call fcn.004108af
lea eax, [ebp]
push eax
call fcn.0043dae7
test byte [ebp + 0x57], 1
pop ecx
pop ecx
je 0x40c19a
cmp dword [ebp - 0x10], ebx
je 0x40c197
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
test byte [ebp + 0x57], 2
je 0x40c1bd
cmp dword [ebp - 0xbc], ebx
je 0x40c1b4
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xbc], ebx
mov dword [ebp + 0x14], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x1a0]
push eax
push 7
push 0x40000000
push dword [ebp]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
call fcn.0040569f
mov edi, eax
cmp edi, ebx
jne 0x40c252
push ebx
push 0x2000000
push 4
lea eax, [ebp - 0x1a0]
push eax
push 7
push 0x40000000
push dword [ebp]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
call fcn.0040569f
mov edi, eax
cmp edi, ebx
jne 0x40c252
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a0]
push eax
push 7
push 0x40000000
push dword [ebp]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
call fcn.0040569f
mov edi, eax
cmp edi, ebx
jne 0x40c252
lea ecx, [ebp - 0x40]
call fcn.0043db4f
lea ecx, [ebp - 0x84]
call fcn.0043db4f
mov eax, dword [ebp + 0x58]
jmp 0x40bf96
cmp esi, ebx
je 0x40c261
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x57], 1
jne 0x40c26c
mov dword [ebp - 0x10], edi
jmp 0x40c237
cmp byte [ebp + 0x57], 3
mov dword [ebp + 0x14], edi
je 0x40c267
mov dword [ebp - 0xbc], edi
jmp 0x40c237
mov ecx, dword [ebp - 0x4c]
cmp ecx, ebx
mov edx, pe_nt_image_headers32
je 0x40c298
lea eax, [ebp - 0x260]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x40c2ae
lea eax, [ebp - 0x260]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x40c2c4
lea eax, [ebp - 0x260]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x15c]
push eax
push dword [ebp + 0x30]
call fcn.00454bdd
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x64], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x21
je 0x40c323
cmp ax, 0x2a
je 0x40c323
cmp ax, 0x40
jne 0x40c32c
push str.WinSta0WinLogon
lea ecx, [ebp - 0x104]
call fcn.0044ce38
mov ecx, dword [ebp - 0x104]
inc byte [ebp + 0x12]
lea eax, [ebp - 0x260]
mov dword [eax + 8], ecx
mov dword [ebp - 0x14], esi
add dword [ebp + 0x64], 2
jmp 0x40c2e9
cmp ax, 0x3d
jne 0x40c33e
or dword [ebp + 0x24], 1
inc dword [ebp - 0xf0]
jmp 0x40c326
cmp ax, 0x24
jne 0x40c34a
mov byte [ebp + 0x46], 1
jmp 0x40c326
cmp ax, 0x26
jne 0x40c359
mov dword [ebp - 0x14], 3
jmp 0x40c326
cmp ax, 0x5e
jne 0x40c364
mov dword [ebp - 0x14], edi
jmp 0x40c326
cmp ax, 0x5f
je 0x40c35f
cmp dword [ebp - 0x14], esi
je 0x40c393
cmp byte [ebp + 0x3b], bl
je 0x40c393
push str.WinSta0Default
lea ecx, [ebp - 0x104]
call fcn.0044ce38
mov ecx, dword [ebp - 0x104]
lea eax, [ebp - 0x260]
mov dword [eax + 8], ecx
lea edi, [ebp - 0x260]
cmp dword [edi + 8], ebx
je 0x40c3b1
test byte [ebp + 0x12], 1
je 0x40c3b1
call fcn.0040a1b6
cmp eax, 1
jge 0x40c3b1
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x40c3cc
or byte [edi + 0x2d], 1
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp - 0x1c], 1
mov dword [edi + 0x3c], eax
cmp dword [ebp + 0x2c], ebx
je 0x40c3da
cmp dword [ebp + 0x24], ebx
je 0x40c3da
or dword [ebp + 0x2c], 0x10
cmp byte [ebp + 0x46], bl
je 0x40c3fa
mov eax, dword [ebp - 0xfc]
cmp word [eax], bx
jne 0x40c3fa
push str.open
lea ecx, [ebp - 0xfc]
call fcn.0044cddc
cmp byte [ebp - 0x69], bl
je 0x40c44b
push 0x5c
push dword [ebp + 0x64]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x40c414
inc edi
inc edi
jmp 0x40c417
mov edi, dword [ebp + 0x64]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
xor eax, eax
cmp dword [ebp + 0x24], ebx
push 1
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.0043ed6b
add esp, 0x18
mov ebx, eax
jmp 0x40ecb0
lea eax, [ebp + 0x64]
push eax
call fcn.0043dae7
cmp dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x130], ebx
je 0x40c504
lea ecx, [ebp - 0x40]
mov byte [ebp + 0x46], bl
call fcn.00443f5b
mov ecx, dword [ebp + 0x4c]
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x54]
call fcn.00414abb
cmp eax, ebx
je 0x40c4f2
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x40c4f2
push eax
lea ecx, [ebp - 0x40]
call fcn.0044ce0a
push dword [ebp + 0x64]
lea ecx, [ebp - 0x130]
call fcn.0044ce38
push dword [ebp - 0x154]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x40]
call fcn.0040800c
mov edi, eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 0x130]
add esp, 0x14
lea ecx, [ebp - 0x40]
mov dword [ebp + 0x64], eax
call fcn.0043db4f
cmp edi, ebx
je 0x40c504
mov ebx, edi
jmp 0x40ec9a
lea ecx, [ebp - 0x40]
call fcn.0043db4f
mov ebx, 0x80070057
jmp 0x40ec9a
mov eax, dword [ebp - 0x124]
cmp word [eax], bx
je 0x40c566
push dword [ebp + 0x64]
call fcn.00412ae5
pop ecx
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x74]
mov dword [ebp + 0x64], eax
call fcn.0044cdaa
push dword [ebp + 0x64]
lea ecx, [ebp + 0x74]
call fcn.00443fc7
push 0x4bdc78
lea ecx, [ebp + 0x74]
call fcn.00443fc7
push dword [ebp - 0x124]
lea ecx, [ebp + 0x74]
call fcn.00443fc7
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x74]
call fcn.00469786
mov ebx, eax
lea ecx, [ebp + 0x74]
jmp 0x40ec95
cmp byte [ebp - 0x4d], bl
je 0x40c733
lea ecx, [ebp + 0x78]
call fcn.00443f5b
push dword [ebp + 0x64]
mov dword [ebp + 0x40], ebx
call fcn.00412ae5
pop ecx
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x64], eax
call fcn.00443f5b
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x64]
mov dword [ebp + 4], ebx
call fcn.004962db
mov eax, dword [ebp + 4]
add esp, 0xc
cmp eax, ebx
jne 0x40c5bb
lea ecx, [ebp + 0x70]
call fcn.0043db4f
lea ecx, [ebp + 0x78]
jmp 0x40c4f5
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x70]
lea ecx, [ebp - 0x44]
mov dword [ebp + 0x74], eax
call fcn.0044cd74
push dword [ebp + 4]
mov edi, dword [ebp - 0x44]
lea ecx, [ebp + 0x7c]
call fcn.0044cd74
push dword [ebp + 0x74]
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x7c]
push edi
call fcn.00406730
add esp, 0x14
cmp dword [ebp + 0x40], ebx
mov edi, pe_nt_image_headers32
jle 0x40c652
mov eax, dword [ebp + 0x4c]
cmp dword [eax + 0x28], ebx
jne 0x40c613
push ebx
push eax
call fcn.00412371
pop ecx
pop ecx
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax + 0x28]
xor esi, esi
cmp eax, ebx
je 0x40c622
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x180]
push dword [ebp - 0x184]
push 0x128
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_DestroyMenu]
lea eax, [edi - 0x100]
cmp eax, ebx
jl 0x40c713
cmp eax, dword [ebp + 0x40]
jge 0x40c713
cmp eax, ebx
mov ecx, dword [ebp + 0x78]
mov dword [ebp + 0x74], ecx
jle 0x40c6b7
mov esi, eax
lea eax, [ebp + 0x74]
call fcn.00405639
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.00402d55
add esp, 4
test al, al
je 0x40c69d
add dword [ebp + 0x74], 2
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.00402d55
add esp, 4
test al, al
je 0x40c6b4
add dword [ebp + 0x74], 2
dec esi
jne 0x40c67e
mov esi, dword [ebp + 0x74]
lea eax, [ebp + 0x74]
call fcn.00405639
mov eax, dword [ebp + 0x74]
mov word [eax], bx
cmp word [esi], bx
je 0x40c713
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x68]
call fcn.0044cdaa
push dword [ebp + 0x64]
lea ecx, [ebp + 0x68]
call fcn.00443fc7
push 0x4bdc78
lea ecx, [ebp + 0x68]
call fcn.00443fc7
push esi
lea ecx, [ebp + 0x68]
call fcn.00443fc7
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x68]
call fcn.00469786
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.0043db4f
lea ecx, [ebp + 0x7c]
call fcn.0043db4f
lea ecx, [ebp - 0x44]
call fcn.0043db4f
lea ecx, [ebp + 0x70]
call fcn.0043db4f
lea ecx, [ebp + 0x78]
jmp 0x40ec95
push dword [ebp + 0x64]
lea ecx, [ebp - 0x108]
call fcn.0044cd74
cmp byte [ebp - 0x3b], bl
je 0x40c801
push str.PECMDpecmd_cmd
lea ecx, [ebp - 0x108]
call fcn.0044ce38
push 1
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.00419ccc
add esp, 0xc
push eax
lea ecx, [ebp - 0x108]
mov dword [ebp + 0x64], eax
call fcn.00443fc7
lea eax, [ebp - 0xc4]
push eax
call fcn.004047d2
pop ecx
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0x108]
mov dword [ebp + 0x64], eax
je 0x40c7a1
cmp byte [ebp - 0x62], bl
je 0x40c7ab
lea eax, [ebp - 0x260]
or byte [eax + 0x2c], 0x80
cmp ecx, ebx
je 0x40c7bd
lea eax, [ebp - 0x260]
or dword [eax + 0x2c], 1
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x12]
and al, 3
cmp al, 3
je 0x40c7cb
cmp byte [ebp - 0x3c], bl
je 0x40c7d5
lea eax, [ebp - 0x260]
or byte [eax + 0x2f], 8
cmp dword [ebp - 0x118], ebx
jg 0x40dea8
lea eax, [ebp - 0x260]
cmp dword [eax + 8], ebx
je 0x40cabb
cmp byte [ebp + 0x12], bl
jle 0x40cabb
xor eax, eax
inc eax
jmp 0x40cabd
cmp byte [ebp - 0x37], bl
je 0x40c788
cmp dword [ebp - 0x14], esi
je 0x40c788
mov eax, dword [ebp - 0x108]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
mov dword [ebp], ebx
call fcn.00419ccc
mov esi, eax
mov eax, dword [ebp + 0x64]
mov dword [ebp], eax
push 3
lea eax, [ebp]
push eax
push 0x4bdc74
call fcn.00445f31
add esp, 0x18
test al, al
jne 0x40c90b
push 7
lea eax, [ebp]
push eax
push str.cmd.exe
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x40c90b
cmp dword [0x4d7cc0], ebx
jne 0x40c8b5
push ebx
push 0x24
lea eax, [ebp - 0x590]
push eax
push ebx
mov word [ebp - 0x590], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x590]
mov edi, 0x4d7cc0
push eax
mov ecx, edi
call fcn.0044ce38
push str.System32cmd.exe
mov ecx, edi
call fcn.00443fc7
push dword [0x4d7cc0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x4d7c70], ax
movsx eax, word [0x4d7c70]
push eax
push dword [ebp]
mov dword [ebp + 0x30], ebx
push dword [0x4d7cc0]
call fcn.0043da43
add esp, 0xc
test al, al
je 0x40c980
movsx eax, word [0x4d7c70]
mov ecx, dword [ebp]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x40c8fe
call fcn.0043daaf
test al, al
je 0x40c980
lea eax, [ebp]
push eax
mov dword [ebp], ecx
call fcn.00408ddd
pop ecx
push 2
lea eax, [ebp]
push eax
push 0x4bdc44
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40c980
mov eax, dword [ebp]
cmp word [eax], 0x22
jne 0x40c966
add eax, 2
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x22
pop ecx
je 0x40c95b
push 4
lea eax, [ebp + 0x78]
push eax
push str.call
call fcn.00445f31
add esp, 0xc
test al, al
je 0x40c963
mov eax, dword [ebp + 0x78]
mov dword [ebp], eax
jmp 0x40c966
mov eax, dword [ebp]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.00419ccc
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x30], 1
mov eax, esi
sub eax, dword [ebp + 0x64]
and eax, 0xfffffffe
cmp eax, 8
jle 0x40c788
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 4
lea eax, [esi - 8]
push str..cmd
push eax
call edi
test eax, eax
je 0x40c9bd
push 4
push str..bat
lea eax, [esi - 8]
push eax
call edi
test eax, eax
jne 0x40c788
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0x90], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x51c]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x64]
stosb byte es:[edi], al
lea ecx, [ebp + 0x40]
lea edi, [ebp - 0x51c]
mov byte [ebp + 0x7b], bl
mov dword [ebp + 0x40], ebx
call fcn.0040569f
push ebx
lea eax, [ebp - 0x98]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x40ca5e
mov al, byte [ebp - 0x51c]
mov dword [ebp - 0x14], 0x10000000
jmp 0x40ca46
cmp al, 0xd
je 0x40ca4d
cmp al, 0xa
je 0x40ca4d
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x40ca3b
jmp 0x40ca4d
inc edi
movsx ax, byte [edi]
push eax
call fcn.00402d55
add esp, 4
test al, al
jne 0x40ca4c
cmp dword [ebp + 0x30], ebx
jne 0x40ca8e
cmp byte [edi], 0x3a
jne 0x40ca73
cmp byte [edi + 1], 0x3a
jne 0x40ca73
inc edi
inc edi
jmp 0x40ca73
inc edi
cmp byte [edi], 0x40
je 0x40ca72
push 7
push edi
push 0x4bdc10
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x40ca8e
mov byte [ebp + 0x7b], 1
lea ecx, [ebp + 0x40]
call fcn.00402cb5
cmp byte [ebp + 0x7b], bl
mov ax, word [ebp - 0x90]
mov word [esi], ax
je 0x40c788
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x4c]
call fcn.00422e2f
mov ebx, eax
jmp 0x40ec8f
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x68], ebx
je 0x40cad5
mov dword [ebp - 0x68], 1
mov dword [ebp + 0xc], 4
cmp byte [ebp - 0x63], bl
je 0x40cade
or dword [ebp + 0xc], 0x10
push eax
lea ecx, [ebp - 0x90]
call fcn.00414424
cmp byte [0x4d7e84], bl
mov edi, dword [ebp + 0x68]
mov dword [ebp + 0x30], 0x4d80e8
jne 0x40cb17
cmp edi, ebx
je 0x40cb05
cmp byte [edi + 8], bl
jne 0x40cb17
cmp byte [ebp - 0x61], bl
mov byte [ebp + 0x7b], bl
je 0x40cb1b
cmp edi, ebx
je 0x40cb1b
mov eax, dword [edi + 0x24]
mov dword [ebp + 0x30], eax
mov byte [ebp + 0x7b], 1
push ebx
lea ecx, [ebp + 0x40]
call fcn.0044cd74
cmp byte [ebp + 0x7b], bl
mov dword [ebp + 0x28], ebx
mov esi, 0x4d8d24
je 0x40cdb2
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.00414956
cmp edi, ebx
je 0x40cb5b
push dword [ebp + 0x30]
lea ecx, [ebp - 0x2fc]
push edi
call fcn.004402c7
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xec], edi
call fcn.00443f79
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x68], eax
jmp 0x40cbf7
mov dword [ebp + 0x78], edi
jmp 0x40cb89
cmp ax, 0x3d
je 0x40cb93
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40cb83
mov esi, edi
sub esi, dword [ebp + 0x78]
sar esi, 1
cmp word [edi], bx
je 0x40cbf5
cmp word [edi + 2], bx
je 0x40cbf0
cmp esi, 0x104
jg 0x40cbf0
push esi
push dword [ebp + 0x78]
push dword [ebp + 0x68]
call fcn.004055fd
mov eax, dword [ebp + 0x68]
add esp, 0xc
push ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2fc]
mov word [eax + esi*2], bx
call fcn.00410728
test eax, eax
jne 0x40cbf0
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x78]
lea ecx, [ebp - 0x2fc]
call fcn.00414a17
jmp 0x40cbf0
inc edi
inc edi
cmp word [edi], bx
jne 0x40cbee
inc edi
inc edi
cmp word [edi], bx
jne 0x40cb7e
push dword [ebp - 0xec]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x2f8]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x78], ebx
jle 0x40ccb8
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x74], eax
inc eax
cmp eax, dword [ebp + 0x68]
mov dword [ebp - 0xc0], eax
mov dword [ebp + 0x14], eax
jge 0x40cca6
mov eax, dword [ebp + 0x78]
shl eax, 2
mov dword [ebp - 0xec], eax
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp + 0x30]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x40cc72
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x74], ecx
mov dword [ebp + 0x30], edi
jmp 0x40cc75
mov ecx, dword [ebp - 0x74]
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 0x68]
jl 0x40cc42
cmp ecx, dword [ebp + 0x78]
je 0x40cca6
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0xec]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x2fc]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp + 0x68]
mov dword [ebp + 0x78], eax
jl 0x40cc1e
cmp dword [ebp + 0x68], ebx
mov dword [ebp + 0x78], ebx
jle 0x40ccfa
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp + 0x78]
mov eax, dword [eax + ecx*4]
push dword [eax]
call edi
mov ecx, dword [ebp + 0x78]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x78]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x68]
jl 0x40ccc6
add esi, 4
push esi
lea ecx, [ebp + 0x40]
call fcn.00443fa0
mov edi, dword [ebp + 0x40]
xor esi, esi
cmp dword [ebp + 0x68], ebx
mov dword [ebp + 0x28], edi
jle 0x40cd7c
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 4], eax
push edi
call fcn.004055fd
mov eax, dword [ebp + 4]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 4], eax
push edi
call fcn.004055fd
mov eax, dword [ebp + 4]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x68]
jl 0x40cd13
mov word [edi], bx
lea ecx, [ebp - 0x78]
mov word [edi + 2], bx
call fcn.0043db4f
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.004353b6
lea ecx, [ebp - 0x2bc]
call fcn.0043db4f
push 0x4d8d24
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0x4d8d24
mov ecx, dword [ebp - 0x5c]
xor al, al
cmp word [ecx], 0x40
jne 0x40cdc1
inc al
jmp 0x40cdcb
cmp dword [ebp - 0xb0], ebx
je 0x40cdcb
mov al, 2
cmp word [ebp + 0x3c], bx
je 0x40cecf
or dword [ebp + 0x24], 1
or dword [ebp + 0x3c], 8
neg al
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.00440118
push eax
lea eax, [ebp - 0x280]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push 1
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x60], eax
je 0x40ce6c
cmp eax, 0xffffffff
je 0x40ce6c
push 0xffffffffffffffff
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp + 0x78]
call fcn.0044cdaa
push ebx
push ebx
push 3
lea ecx, [ebp - 0x1a0]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0xd8]
call fcn.0040569f
lea ecx, [ebp + 0x78]
call fcn.0043db4f
jmp 0x40ce74
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0xd8]
push ebx
push ebx
lea eax, [ebp + 0x68]
push eax
push edi
mov dword [ebp + 0x68], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x190], eax
xor eax, eax
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x260]
or byte [eax + 0x2d], 1
test byte [ebp + 0x38], 2
jne 0x40cec3
cmp byte [ebp + 0x38], bl
jne 0x40cec6
mov dword [eax + 0x3c], edi
test byte [ebp + 0x38], 1
je 0x40cecf
mov dword [eax + 0x40], edi
push esi
mov dword [ebp - 0x98], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x28]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp - 0x24]
mov dword [ebp + 0x1c], ebx
or dword [ebp + 0xc], eax
cmp byte [ebp - 0x35], bl
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0x14], ebx
je 0x40cf03
or dword [ebp + 0xc], 0x1000004
cmp byte [ebp - 0x3a], bl
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xc0], ebx
je 0x40cf27
lea eax, [ebp - 0xec]
push eax
call fcn.00403eaa
pop ecx
mov dword [ebp - 0xc0], eax
cmp byte [ebp + 0x46], bl
mov edi, dword [ebp + 0x20]
je 0x40cf37
cmp edi, ebx
je 0x40dc8e
cmp byte [ebp - 0x56], bl
je 0x40cff9
cmp word [ebp - 0x34], bx
jne 0x40cff9
cmp word [ebp + 8], bx
jne 0x40cff9
push dword [ebp + 0x64]
lea eax, [ebp + 0x1c]
push edi
push dword [ebp + 0x50]
push eax
call fcn.004046fe
mov esi, eax
push esi
call fcn.004047f6
add esp, 0x14
test eax, eax
jne 0x40d215
cmp dword [ebp - 0x20], ebx
push ebx
je 0x40cfbd
movzx eax, word [ebp - 0x20]
push 0x4bd3f8
push ebx
or eax, 2
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 8]
or eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x28]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.00405766
add esp, 0x38
mov dword [ebp - 0xc], eax
jmp 0x40dd9f
call fcn.00404663
pop ecx
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 8]
or eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x28]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
push dword [ebp - 0x158]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x40cfb5
mov eax, dword [ebp - 0xb4]
cmp word [eax], bx
je 0x40d1d3
cmp word [ebp - 0x34], bx
jne 0x40d1d3
cmp word [ebp + 8], bx
jne 0x40d1d3
xor edi, edi
inc edi
cmp byte [ebp - 0x2d], bl
mov dword [ebp - 0xc], ebx
je 0x40d07c
push eax
lea ecx, [ebp + 0x68]
call fcn.00402d16
lea ecx, [ebp + 0x78]
call fcn.00443de7
push dword [ebp - 0xb4]
call fcn.0043da5b
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
call fcn.0044945a
add esp, 0xc
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x78]
sbb edi, edi
lea ecx, [ebp - 0xb4]
neg edi
call fcn.00444016
lea ecx, [ebp + 0x78]
call fcn.0043da9c
lea ecx, [ebp + 0x68]
call fcn.0043da9c
cmp byte [ebp - 1], bl
je 0x40d0e2
push dword [ebp - 0xac]
lea ecx, [ebp + 0x68]
call fcn.00402d16
lea ecx, [ebp + 0x78]
call fcn.00443de7
push dword [ebp - 0xac]
call fcn.0043da5b
cmp edi, ebx
pop ecx
je 0x40d0be
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
call fcn.0044945a
test eax, eax
pop ecx
pop ecx
je 0x40d0be
xor edi, edi
inc edi
jmp 0x40d0c0
xor edi, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x78]
lea ecx, [ebp - 0xac]
call fcn.00444016
lea ecx, [ebp + 0x78]
call fcn.0043da9c
lea ecx, [ebp + 0x68]
call fcn.0043da9c
cmp edi, ebx
je 0x40d1b6
mov edi, dword [ebp - 0xb4]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x40d108
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x40d116
mov word [eax], bx
mov esi, dword [ebp - 0xb4]
lea edi, [eax + 2]
jmp 0x40d11b
mov esi, 0x4bd3f8
push dword [ebp + 0x64]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x20]
push dword [ebp + 0x50]
push eax
call fcn.004046fe
push eax
mov dword [ebp + 0x50], eax
call fcn.004047f6
add esp, 0x14
test eax, eax
jne 0x40d215
cmp dword [ebp - 0x20], ebx
je 0x40d181
push dword [ebp - 0xac]
movzx eax, word [ebp - 0x20]
push esi
push edi
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 8]
push dword [ebp + 0x28]
or eax, 1
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x20]
call fcn.00405766
add esp, 0x38
jmp 0x40d1b3
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 8]
push dword [ebp + 0x28]
or eax, 1
push dword [ebp + 0xc]
push dword [ebp + 0x64]
push dword [ebp + 0x20]
push eax
push dword [ebp - 0xac]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xac]
call fcn.0043da5b
push dword [ebp - 0xb4]
call fcn.0043da5b
pop ecx
pop ecx
jmp 0x40dd9f
cmp byte [ebp + 0x37], bl
je 0x40d2a9
cmp edi, ebx
je 0x40d1ea
cmp word [edi], 0x26
je 0x40d2a9
cmp word [ebp - 0x28], bx
jne 0x40d2a9
cmp word [ebp - 0x34], bx
jne 0x40d2a9
cmp word [ebp + 8], bx
jne 0x40d2a9
push dword [ebp + 0x50]
call fcn.004047f6
test eax, eax
pop ecx
je 0x40d21e
mov dword [ebp + 0x28], 3
jmp 0x40d22f
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
mov dword [ebp + 0x28], eax
lea ecx, [ebp - 0x84]
call fcn.00402cb5
cmp dword [ebp - 0xc0], ebx
je 0x40d24e
push dword [ebp - 0xec]
call fcn.00403ebb
pop ecx
lea esi, [ebp - 0xa8]
mov eax, dword [esi]
cmp eax, ebx
je 0x40d261
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x11c], ebx
mov dword [esi], ebx
je 0x40d285
push dword [ebp - 0x11c]
lea eax, [ebp - 0x17c]
push dword [eax + 8]
push dword [ebp + 0x4c]
call fcn.00446583
add esp, 0xc
mov edx, dword [ebp - 0x148]
cmp edx, ebx
je 0x40dde6
push 0x26
pop esi
cmp word [edx], si
mov ecx, edx
jne 0x40ddb9
lea eax, [edx + 2]
jmp 0x40ddb4
lea ecx, [ebp - 0xd4]
mov dword [ebp + 0x68], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x78], edi
mov dword [ebp - 0x54], edi
call fcn.00443de7
cmp word [ebp + 8], bx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x58]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 4], eax
je 0x40d396
push 0x22
pop esi
cmp word [edi], si
jne 0x40d2ff
add edi, 2
mov dword [ebp + 0x78], edi
push 0x3a
lea eax, [ebp + 0x78]
mov dword [ebp - 0x8c], edi
call fcn.004a7e7b
mov eax, dword [ebp + 0x78]
cmp eax, edi
pop ecx
je 0x40d321
cmp word [eax - 2], si
jne 0x40d321
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x40d32c
mov word [eax], bx
inc eax
inc eax
cmp word [eax], si
mov edi, eax
jne 0x40d345
lea edi, [eax + 2]
inc eax
inc eax
cmp word [eax], si
jne 0x40d340
mov word [eax], bx
cmp word [eax], bx
jne 0x40d336
cmp word [ebp - 0x34], bx
je 0x40d363
push 0x3a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x68], eax
je 0x40d363
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x68], eax
push ebx
push ebx
push 0x10000
push edi
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x8c]
call fcn.0043b689
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xcc]
add esp, 0x18
add ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x40d5c6
cmp edi, ebx
je 0x40d468
cmp word [edi], 0x26
jne 0x40d44f
mov ecx, dword [ebp + 0x4c]
push ebx
push 0xffffffffffffffff
push ebx
push edi
call fcn.00410728
mov edi, eax
cmp edi, ebx
jne 0x40d416
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp - 0xd4]
call fcn.0043db4f
lea ecx, [ebp - 0x24]
call fcn.0043db4f
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 0x2c]
call fcn.0043db4f
lea ecx, [ebp + 0x1c]
call fcn.0043db4f
push 0x4d8d24
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x40]
call fcn.0043db4f
lea ecx, [ebp - 0x90]
call fcn.0041445a
mov ebx, 0x80070057
jmp 0x40ec8f
mov eax, dword [edi + 0x10]
mov dword [ebp - 0xd0], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0xd4]
call fcn.00443e29
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xd0]
inc eax
push eax
push dword [edi + 4]
push dword [ebp - 0xd4]
call fcn.00413de4
add esp, 0xc
jmp 0x40d5c6
mov al, byte [ebp + 0x39]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0044b64d
pop ecx
pop ecx
mov dword [ebp + 0x20], eax
cmp dword [ebp + 0x20], ebx
mov dword [ebp - 0x194], ebx
jne 0x40d507
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x40d487
cmp word [eax], 0x2a
jne 0x40d487
inc dword [ebp - 0x28]
cmp byte [ebp + 0x37], bl
je 0x40d48f
mov dword [ebp - 0x28], ebx
cmp word [ebp - 0x34], bx
je 0x40da75
push 0x3a
push ebx
push dword [ebp - 0x54]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x68], esi
je 0x40d4fe
push 2
pop eax
mov word [esi], bx
add esi, eax
mov dword [ebp + 0x68], esi
je 0x40d4fe
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x54]
cmp word [eax], 0x22
mov dword [ebp - 0x78], ebx
mov dword [ebp + 4], ebx
jne 0x40d4ee
inc eax
inc eax
mov dword [ebp - 0x54], eax
mov dword [ebp + 0x78], eax
push 0x22
lea eax, [ebp + 0x78]
call fcn.004a7e7b
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x40d4ee
mov word [eax], bx
push dword [ebp - 0x54]
lea ecx, [ebp + 0x58]
call fcn.0044cddc
jmp 0x40d5f8
cmp dword [ebp + 0x20], ebx
je 0x40da75
cmp word [ebp - 0x34], bx
mov edi, dword [ebp + 0x20]
je 0x40d529
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x68], eax
je 0x40d529
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x68], eax
add dword [ebp + 0x20], 2
push str.EXEDATA
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0045355f
mov ecx, dword [0x4d7fa0]
mov si, word [edi]
mov word [edi], bx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
mov dword [ebp + 0x30], 0x20
mov ax, word [edx]
add esp, 0xc
cmp ax, 0x2e
mov dword [ebp + 0x78], ebx
jne 0x40d573
cmp word [edx + 2], bx
je 0x40d587
cmp ax, bx
je 0x40d587
push 2
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, eax
mov dword [ebp + 0x78], ecx
cmp ecx, ebx
mov word [edi], si
je 0x40d5b8
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x8c]
mov dword [ebp + 0x30], 0x20
push dword [ebp - 0x194]
push ecx
call fcn.00414db6
add esp, 0x14
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0x78], ebx
je 0x40d5c6
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xd0], ebx
je 0x40dd84
cmp dword [ebp - 0x18], ebx
je 0x40dd84
cmp word [ebp - 0x28], bx
mov dword [ebp - 0x8c], 1
ja 0x40d5f5
cmp word [ebp - 0x34], bx
je 0x40d91e
mov esi, dword [ebp + 0x68]
cmp dword [ebp + 4], ebx
mov eax, dword [ebp - 0x10c]
jne 0x40d608
mov eax, 0x4bd274
push eax
push str.exedat
push dword [ebp - 0x78]
lea eax, [ebp - 0xb8]
push dword [ebp + 4]
push eax
call fcn.00405a60
add esp, 0x14
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044ce0a
mov edi, dword [ebp - 0x74]
lea eax, [ebp + 0x58]
mov dword [ebp + 4], eax
lea eax, [ebp - 0x74]
cmp edi, ebx
mov dword [ebp - 0x78], eax
setne al
cmp al, bl
mov dword [ebp - 0x134], ebx
je 0x40d678
push ebx
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0xd0]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.0044193a
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d688
cmp dword [ebp - 0x8c], 1
jle 0x40dd84
mov esi, dword [ebp + 0x68]
cmp esi, ebx
push dword [ebp - 0xb8]
mov byte [ebp + 0x7b], bl
je 0x40d7e7
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x58], ebx
call fcn.0044ce38
push str..ex
lea ecx, [ebp + 0x58]
call fcn.00443fc7
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044ce0a
cmp word [esi], 0x5c
je 0x40d6d1
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp - 0x34], 1
jne 0x40d72a
push 0x4bdbb8
lea ecx, [ebp + 8]
call fcn.00401000
push dword [ebp + 0x30]
lea ecx, [ebp + 8]
call fcn.00443fc7
push 0x4bdbb0
lea ecx, [ebp + 8]
call fcn.00443fc7
push dword [ebp + 0x58]
lea ecx, [ebp + 8]
call fcn.00443fc7
push dword [ebp + 8]
mov ecx, dword [ebp + 0x4c]
call fcn.0043000e
lea ecx, [ebp + 8]
call fcn.0043db4f
jmp 0x40d7c8
cmp word [ebp - 0x34], 0x100
jne 0x40d7c8
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x388], 0x44
mov dword [ebp - 0x384], ebx
lea edi, [ebp - 0x380]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xe8], ebx
lea edi, [ebp - 0xe4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x388]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x35c], 0x80
push ebx
push dword [ebp - 8]
push ebx
push ebx
push ebx
push 0x4bdba8
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xe8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xe8], ebx
je 0x40d7b4
push dword [ebp - 0xe8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xe4], ebx
je 0x40d7c8
push dword [ebp - 0xe4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x58]
call fcn.00443fc7
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x1c]
call fcn.0044ce0a
lea ecx, [ebp + 0x30]
call fcn.0043db4f
jmp 0x40d7ef
lea ecx, [ebp - 0x2c]
call fcn.0044ce38
mov edx, dword [ebp + 0x64]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x40d800
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x40d88d
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x40d81e
mov edi, dword [ebp + 0x58]
lea esi, [eax + 4]
jmp 0x40d862
cmp cx, 0x5c
jne 0x40d88d
cmp di, 0x22
je 0x40d85f
mov eax, dword [ebp - 0x2c]
mov edi, 0x104
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp + 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.00443fa0
mov eax, dword [ebp - 0x2c]
push edi
mov word [eax], bx
push dword [ebp - 0x2c]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x30]
call fcn.0043db4f
mov edx, dword [ebp + 0x64]
mov edi, dword [ebp - 0x2c]
cmp word [edx], 0x22
jne 0x40d875
push 0x4bcc88
lea ecx, [ebp + 0x14]
call fcn.0044ce38
push edi
lea ecx, [ebp + 0x14]
call fcn.00443fc7
push esi
lea ecx, [ebp + 0x14]
call fcn.00443fc7
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x68], ebx
je 0x40d973
cmp word [ebp - 0x28], bx
ja 0x40d8ce
lea eax, [ebp - 0xd4]
push eax
push dword [ebp + 0x1c]
mov dword [ebp + 0x68], ebx
call fcn.0041477a
cmp dword [ebp - 0xd0], ebx
pop ecx
pop ecx
je 0x40d970
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x18], eax
mov byte [ebp + 0x7b], 1
or eax, 0xffffffff
jmp 0x40d8fd
cmp byte [ebp + 0x46], bl
je 0x40d973
cmp dword [ebp + 0x50], ebx
jne 0x40d8e2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 0x50], eax
cmp word [ebp - 0x28], 2
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x7b], 2
jb 0x40dc73
lea eax, [ebp - 0x17c]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0xb8]
call fcn.004038de
cmp byte [ebp + 0x7b], 1
mov eax, dword [ebp - 0xb8]
pop ecx
pop ecx
mov word [eax], bx
jne 0x40da6c
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x22
mov edi, eax
jne 0x40d92c
add eax, 2
xor esi, esi
cmp word [eax], 0x3f
jne 0x40d94e
cmp word [eax + 2], 0x5c
jne 0x40d94e
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x40d94e
dec edi
dec edi
mov si, word [edi]
mov word [edi], 0x22
push dword [ebp + 0x50]
call fcn.004047f6
test eax, eax
pop ecx
jne 0x40da95
cmp si, bx
je 0x40d5f5
mov word [edi], si
jmp 0x40d5f5
mov edx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov esi, dword [ebp + 0x58]
je 0x40d984
cmp word [eax], bx
jne 0x40d984
xor esi, esi
cmp dword [ebp + 0x50], ebx
jne 0x40d98f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 0x50], eax
push edx
push dword [ebp + 0x58]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x50]
push eax
call fcn.004046fe
mov edi, eax
push edi
mov dword [ebp + 0x50], edi
call fcn.004047f6
add esp, 0x14
test eax, eax
jne 0x40da95
cmp dword [ebp + 0x2c], ebx
je 0x40d9e9
push dword [ebp + 0x2c]
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 8]
or eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x28]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.0040303a
add esp, 0x2c
jmp 0x40da50
cmp dword [ebp - 0x20], ebx
je 0x40da26
movzx eax, word [ebp - 0x20]
push ebx
push 0x4bd3f8
push ebx
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 8]
or eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x28]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.00405766
add esp, 0x38
jmp 0x40da50
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 8]
or eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x28]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.004a97e5
add esp, 0x28
cmp byte [ebp - 0x28], 2
mov dword [ebp - 0xc], eax
jl 0x40dd84
cmp word [ebp - 0x34], bx
jne 0x40dd84
jmp 0x40d8f4
cmp byte [ebp + 0x7b], 2
jmp 0x40dc6d
push dword [ebp + 0x64]
lea eax, [ebp + 0x1c]
push edi
push dword [ebp + 0x50]
push eax
call fcn.004046fe
push eax
mov dword [ebp + 0x50], eax
call fcn.004047f6
add esp, 0x14
test eax, eax
je 0x40dabc
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x28], 3
call fcn.0043db4f
lea ecx, [ebp - 0xd4]
call fcn.0043db4f
lea ecx, [ebp - 0x24]
call fcn.0043db4f
jmp 0x40d22f
cmp word [ebp + 0x3c], bx
jne 0x40db3f
push 0x5c
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x40dad8
inc esi
inc esi
jmp 0x40dadb
mov esi, dword [ebp + 0x64]
push 8
push esi
push str.winpeshl
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40db0d
xor eax, eax
mov ax, word [esi + 0x10]
cmp ax, bx
je 0x40db09
cmp ax, 0x2e
je 0x40db09
call fcn.0043daaf
test al, al
je 0x40db0d
mov byte [ebp + 0x13], 1
push 8
push esi
push str.wpeinit
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x40db3f
xor eax, eax
mov ax, word [esi + 0xe]
cmp ax, bx
je 0x40db3b
cmp ax, 0x2e
je 0x40db3b
call fcn.0043daaf
test al, al
je 0x40db3f
mov byte [ebp + 0x13], 1
test byte [ebp + 0x73], 1
jne 0x40db4a
cmp dword [ebp - 0x48], ebx
je 0x40db72
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
push 1
push str.Shell.x
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.0043ed6b
add esp, 0x18
cmp dword [ebp + 0x2c], ebx
je 0x40dba8
push dword [ebp + 0x2c]
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 8]
push dword [ebp + 0x28]
or eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.0040303a
add esp, 0x2c
jmp 0x40dc13
cmp dword [ebp - 0x20], ebx
je 0x40dbe7
movzx eax, word [ebp - 0x20]
push ebx
push 0x4bd3f8
push ebx
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 8]
push dword [ebp + 0x28]
or eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.00405766
add esp, 0x38
jmp 0x40dc13
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 8]
push dword [ebp + 0x28]
or eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.004a97e5
add esp, 0x28
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x40dc1d
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x40dc48
call fcn.00419fd4
test eax, eax
je 0x40dc2f
or dword [ebp + 0x24], 1
cmp dword [ebp + 0x24], ebx
jne 0x40dc48
push str.waitpeinit.pecmd
call fcn.004a980e
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp + 0x24], eax
cmp dword [ebp - 0xc], ebx
jne 0x40dd84
cmp byte [ebp + 0x46], bl
jne 0x40dd84
cmp edi, ebx
jne 0x40dd84
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x40dd84
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp - 0xd4]
call fcn.0043db4f
lea ecx, [ebp - 0x24]
call fcn.0043db4f
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x294]
mov dword [ebp - 0x29c], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x298], 0x4540
jne 0x40dcb9
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x40dcd4
cmp word [eax], bx
je 0x40dcd4
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x28c], eax
push 1
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x68], ebx
call fcn.00419ccc
mov esi, eax
mov eax, dword [ebp + 0x78]
add esp, 0xc
cmp word [esi], bx
jne 0x40dd10
cmp eax, dword [ebp + 0x64]
je 0x40dd2b
push dword [ebp + 0x68]
lea ecx, [ebp - 0x144]
push eax
call fcn.0044407f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x28c], eax
cmp word [esi], bx
je 0x40dd36
mov dword [ebp - 0x288], esi
push ebx
push 0x4d7bd8
push str.Kernel32.DLL
push str.GetProcessID
call fcn.0043ef59
mov edi, dword [0x4d7bd8]
add esp, 0x10
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp edi, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x264]
lea esi, [ebp - 0x17c]
mov dword [esi], eax
mov dword [ebp - 0x264], ebx
je 0x40dd9f
push eax
call edi
mov dword [esi + 8], eax
jmp 0x40dd9f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp - 0xd4]
call fcn.0043db4f
lea ecx, [ebp - 0x24]
call fcn.0043db4f
cmp dword [ebp - 0xc], ebx
je 0x40d221
xor eax, eax
jmp 0x40d227
mov ecx, eax
lea eax, [ecx + 2]
cmp word [eax], si
je 0x40ddaf
cmp word [ecx], si
mov eax, ecx
jne 0x40ddc7
lea eax, [ecx + 2]
jmp 0x40ddc7
inc eax
inc eax
cmp word [eax], 0x3a
je 0x40ddc5
cmp word [eax], bx
je 0x40dde6
push edx
lea eax, [ebp - 0x17c]
push dword [eax]
push dword [ebp + 0x4c]
call fcn.0042bca9
add esp, 0xc
cmp byte [ebp - 0x35], bl
je 0x40de0c
lea esi, [ebp - 0x17c]
cmp dword [esi], ebx
je 0x40de0c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0xf8], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x17c]
push dword [edi + 8]
push dword [ebp + 0x4c]
call fcn.00446583
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x4c]
call fcn.00446583
add esp, 0x18
cmp dword [ebp - 0x68], ebx
je 0x40de4b
push dword [edi]
push 4
push str.SeDebugPrivilege
call fcn.00412f4a
add esp, 0xc
test byte [ebp + 0xc], 4
je 0x40de5f
mov edi, dword [edi + 4]
cmp edi, ebx
je 0x40de5f
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 0x2c]
call fcn.0043db4f
lea ecx, [ebp + 0x1c]
call fcn.0043db4f
lea ecx, [ebp - 0x98]
call fcn.00402ca4
lea ecx, [ebp + 0x40]
call fcn.0043db4f
lea ecx, [ebp - 0x90]
call fcn.0041445a
lea eax, [ebp - 0xd8]
mov eax, dword [eax]
cmp eax, ebx
je 0x40dea8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xd8]
lea edi, [ebp - 0xa4]
mov dword [eax], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x40dec5
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x4c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ded3
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x10]
mov eax, dword [edi]
cmp eax, ebx
je 0x40dee1
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xbc]
mov eax, dword [edi]
cmp eax, ebx
je 0x40def2
push eax
call esi
cmp byte [ebp + 0x73], bl
mov dword [edi], ebx
jne 0x40defe
cmp byte [ebp + 0x3a], bl
je 0x40df51
lea edi, [ebp - 0x17c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40df16
push 0x1388
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp byte [ebp + 0x73], bl
je 0x40df51
test byte [ebp + 0x73], 1
je 0x40df38
mov eax, dword [edi]
push dword [edi + 8]
neg eax
sbb eax, eax
and eax, 2
or eax, 1
push eax
call fcn.0042a949
pop ecx
pop ecx
cmp dword [ebp - 0x120], ebx
je 0x40df51
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x120]
call fcn.00433455
cmp dword [ebp - 0xc], ebx
jne 0x40df7d
cmp dword [ebp - 0x118], ebx
jg 0x40df7d
mov eax, dword [ebp - 0x5c]
cmp word [eax], bx
je 0x40ea93
mov ecx, dword [ebp + 0x4c]
push 0x4bca0c
push eax
call fcn.00443666
jmp 0x40ea93
lea edi, [ebp - 0x17c]
mov eax, dword [edi]
cmp eax, ebx
jne 0x40df8c
mov dword [ebp + 0x24], ebx
mov ecx, dword [ebp - 0x80]
inc dword [ebp - 0x80]
mov dword [ebp + ecx*4 - 0x190], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40dfa3
push eax
call esi
cmp dword [ebp - 0x48], ebx
mov dword [edi + 4], ebx
je 0x40dfff
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push 0x3e8
call fcn.004159e8
mov esi, dword [edi]
cmp esi, ebx
jne 0x40dfe7
cmp dword [ebp - 0x118], ebx
jle 0x40dff9
push dword [ebp - 0x118]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x24], ebx
je 0x40ea8d
push esi
call fcn.00404001
cmp dword [edi], ebx
pop ecx
jne 0x40dff9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], ebx
je 0x40ea93
mov al, byte [0x4d62ec]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x7b], al
mov dword [ebp + 8], esi
xor edi, edi
call fcn.00402d04
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
mov byte [ebp + 0x73], bl
jne 0x40e136
mov byte [ebp + 0x73], 1
mov dword [ebp - 8], ecx
cmp byte [ebp - 0x55], bl
je 0x40e0b4
mov ecx, dword [ebp + 0x4c]
push ebx
lea eax, [ebp + 0x30]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x30], ebx
call fcn.0044bafc
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x30]
lea ecx, [ebp + 0x50]
call fcn.00443ee3
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x50]
mov dword [ebp + 8], esi
call fcn.00443e29
lea ecx, [ebp + 0x30]
call fcn.0043db4f
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x94], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x74], eax
jg 0x40e0e3
mov dword [ebp - 0x94], 0x3e8
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x3c]
and ax, 0x101
sub ax, 0x101
neg ax
sbb eax, eax
inc eax
test byte [ebp + 0x3c], 8
mov dword [ebp - 0x90], eax
je 0x40e66a
mov eax, dword [ebp - 0x5c]
mov ax, word [eax]
cmp ax, 0x40
je 0x40e14b
cmp byte [ebp - 0x39], bl
je 0x40e14b
cmp ax, 0x26
je 0x40e130
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x40e14b
mov byte [ebp + 0x6b], 1
jmp 0x40e14e
cmp dword [ebp - 0xb0], ebx
je 0x40e059
mov byte [ebp + 0x73], 2
jmp 0x40e059
mov byte [ebp + 0x6b], bl
push ebx
mov dword [ebp - 0x8c], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x60]
mov esi, dword [eax]
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x73], bl
mov dword [ebp + 4], edi
mov dword [ebp - 0x68], 1
je 0x40e184
mov eax, dword [ebp + 8]
sub eax, edi
jmp 0x40e189
mov eax, 0x100000
lea ecx, [ebp - 0x1b8]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x44], ebx
mov byte [ebp + 0x3a], bl
call fcn.00443f5b
mov dword [ebp + 0x28], 1
mov al, byte [0x4d62ec]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x40e1df
cmp dword [ebp - 0xf0], 2
jl 0x40e5ec
cmp dword [ebp - 0xc8], ebx
jle 0x40e212
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xc8]
jae 0x40e5ec
mov ecx, dword [ebp - 0xc8]
sub ecx, eax
cmp dword [ebp - 0x94], ecx
jbe 0x40e212
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp - 0x94]
lea eax, [ebp - 0x190]
push ebx
push eax
push dword [ebp - 0x80]
call fcn.00412926
cmp eax, ebx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xc0], ebx
jne 0x40e2df
lea eax, [ebp - 0x60]
mov esi, dword [eax]
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1b8]
push eax
push esi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 0x48], ebx
jle 0x40e27d
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x48], eax
jle 0x40e26f
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x68], ebx
je 0x40e27d
add edi, dword [ebp - 0x48]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 8]
jl 0x40e29e
add dword [ebp + 8], 0x100000
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp + 0x50]
call fcn.00443e29
cmp byte [ebp + 0x73], bl
je 0x40e2aa
mov eax, dword [ebp + 8]
sub eax, edi
jmp 0x40e2af
mov eax, 0x100000
cmp dword [ebp - 0x90], ebx
mov dword [ebp - 0x18], eax
je 0x40e2c6
mov dword [ebp - 0xc0], 1
jmp 0x40e2df
lea ecx, [ebp - 0x1b8]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xf4]
cmp ecx, ebx
mov dword [ebp - 0x140], eax
je 0x40e327
mov edx, dword [ebp - 0x98]
mov ecx, edx
sub ecx, eax
add ecx, dword [ebp - 0x74]
cmp ecx, ebx
mov dword [ebp - 0xf4], ecx
jle 0x40e311
mov dword [ebp + 0x28], ebx
jmp 0x40e327
mov dword [ebp + 0x28], 1
add dword [ebp - 0x74], edx
add ecx, edx
cmp ecx, ebx
jle 0x40e318
mov dword [ebp - 0xf4], ecx
cmp byte [ebp + 0x73], bl
je 0x40e355
sub eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x94]
jge 0x40e4ea
cmp edi, dword [ebp - 0x44]
je 0x40e5e3
cmp eax, 0x14
jl 0x40e5e3
jmp 0x40e4ea
cmp ecx, ebx
je 0x40e35f
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0x80]
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x40e38f
dec eax
cmp eax, dword [ebp - 0x134]
jne 0x40e38f
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x3a], cl
je 0x40e5ec
cmp edi, dword [ebp - 0x44]
je 0x40e5ec
mov dword [ebp + 0x28], ecx
jmp 0x40e4ea
test byte [ebp + 0x3c], 1
je 0x40e47c
cmp edi, dword [ebp + 4]
jle 0x40e47c
mov ecx, dword [ebp + 4]
mov eax, dword [ebp + 0x50]
mov edx, dword [ebp - 0x12c]
lea esi, [ecx + eax]
mov eax, edi
sub eax, ecx
cmp dword [ebp - 0x90], ebx
je 0x40e402
lea ecx, [eax - 1]
cmp ecx, ebx
mov dword [ebp + 0x78], ecx
jl 0x40e452
cmp byte [ecx + esi], 0xa
jne 0x40e3d6
dec edx
cmp edx, ebx
jle 0x40e3de
dec ecx
mov dword [ebp + 0x78], ecx
jns 0x40e3cb
jmp 0x40e452
inc dword [ebp + 0x78]
sub eax, dword [ebp + 0x78]
inc eax
push eax
mov eax, dword [ebp + 0x78]
add eax, esi
push eax
push esi
call fcn.00413d9a
sub edi, dword [ebp + 0x78]
add esp, 0xc
mov eax, edi
sub eax, dword [ebp + 4]
mov byte [eax + esi], bl
jmp 0x40e452
xor ecx, ecx
test byte [ebp + 0x3d], 2
je 0x40e43a
cmp eax, ebx
jle 0x40e452
cmp byte [ecx + esi], 0xa
jne 0x40e419
dec edx
cmp edx, ebx
jle 0x40e420
inc ecx
cmp ecx, eax
jl 0x40e40e
jmp 0x40e452
dec ecx
cmp ecx, ebx
jle 0x40e42c
cmp byte [ecx + esi], 0xd
jne 0x40e42c
dec ecx
mov eax, dword [ebp + 4]
mov byte [ecx + esi], bl
lea edi, [eax + ecx]
mov dword [ebp - 0x68], ebx
jmp 0x40e452
cmp eax, ebx
jle 0x40e452
cmp byte [ecx + esi], 0xa
jne 0x40e44d
dec edx
cmp edx, ebx
jle 0x40e5ec
inc ecx
cmp ecx, eax
jl 0x40e43e
cmp dword [ebp - 0xc0], ebx
je 0x40e47c
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
lea eax, [ebp - 0x60]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 5
pop esi
dec esi
js 0x40e1c6
cmp byte [0x4d62ec], bl
jle 0x40e1c6
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40e1c6
cmp dword [ebp - 0x340], 0x12
je 0x40e4d1
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40e47f
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x7b], bl
mov byte [ebp + 0x3a], 1
je 0x40e1c6
cmp edi, dword [ebp - 0x44]
je 0x40e1c6
cmp byte [ebp + 0x6b], bl
mov eax, dword [ebp - 0x140]
mov esi, dword [ebp + 0x50]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xe0], edi
jne 0x40e544
cmp dword [ebp - 0x88], 0x4b0
je 0x40e537
push dword [ebp - 0x88]
lea ecx, [ebp - 0x78]
push edi
push esi
call fcn.00444016
mov esi, dword [ebp - 0x78]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xe0], eax
jmp 0x40e544
mov word [esi + edi + 2], bx
mov eax, dword [ebp + 0x50]
mov word [eax + edi + 2], bx
cmp byte [ebp - 0x38], bl
je 0x40e55a
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.004083ef
pop ecx
pop ecx
mov esi, eax
cmp byte [ebp + 0x73], 1
jne 0x40e577
mov ecx, dword [ebp + 0x4c]
push esi
push esi
push 0x4bca0c
push dword [ebp - 8]
push dword [ebp - 8]
call fcn.0044097f
jmp 0x40e5a3
cmp byte [ebp + 0x6b], bl
je 0x40e597
push ebx
push ebx
push dword [ebp - 0xe0]
push dword [ebp + 0x50]
push dword [ebp - 0x5c]
push dword [ebp + 0x4c]
call fcn.0045067b
add esp, 0x18
jmp 0x40e5a3
mov ecx, dword [ebp + 0x4c]
push esi
push dword [ebp - 8]
call fcn.00443666
cmp dword [ebp - 0xb0], ebx
je 0x40e5dd
cmp dword [ebp + 0x28], ebx
je 0x40e5dd
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x114]
call fcn.00401000
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x114]
call fcn.00433455
lea ecx, [ebp - 0x114]
call fcn.0043db4f
mov ecx, dword [ebp - 0xf4]
cmp byte [ebp + 0x3a], bl
je 0x40e355
lea ecx, [ebp - 0x78]
call fcn.0043db4f
cmp dword [ebp + 0x24], 0xffffff9c
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
mov dword [ebp - 0x14], ebx
je 0x40e7c0
cmp byte [ebp + 0x7b], bl
jle 0x40e7c0
cmp byte [ebp + 0x1b], 1
je 0x40e7c0
cmp byte [ebp + 0x1b], 2
jne 0x40e792
lea eax, [ebp - 0x17c]
push dword [eax + 8]
lea eax, [ebp - 0x2c4]
push dword [ebp - 0x100]
push str._force__exitcode_d__tree__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0x10
lea eax, [ebp - 0x2c4]
push eax
call fcn.00429743
jmp 0x40e7c0
cmp dword [ebp + 0x24], 0xffffff9c
je 0x40e5f4
mov al, byte [0x4d62ec]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x40e689
cmp dword [ebp - 0xf0], 2
jl 0x40e5f4
cmp dword [ebp - 0xc8], ebx
mov dword [ebp + 0x70], 0x3e8
jle 0x40e6c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xc8]
jae 0x40e5f4
mov ecx, dword [ebp - 0xc8]
sub ecx, eax
cmp ecx, 0x3e8
jae 0x40e6c0
mov dword [ebp + 0x70], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp + 0x70]
lea eax, [ebp - 0x190]
push ebx
push eax
push dword [ebp - 0x80]
call fcn.00412926
mov ecx, dword [ebp - 0x80]
dec ecx
cmp ecx, eax
je 0x40e5f4
cmp dword [ebp - 0x80], 1
jle 0x40e785
cmp eax, ebx
jne 0x40e785
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x40e715
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x50]
call fcn.00443e29
mov eax, dword [ebp + 0x50]
push ebx
lea ecx, [ebp + 0x68]
push ecx
add eax, edi
push 1
push eax
lea eax, [ebp - 0x60]
push dword [eax]
mov dword [ebp + 0x68], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e785
cmp dword [ebp + 0x68], ebx
jbe 0x40e785
add edi, dword [ebp + 0x68]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
jmp 0x40e785
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40e670
cmp dword [ebp - 0x278], 0x12
je 0x40e670
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4d62ec], bl
jg 0x40e744
jmp 0x40e670
cmp dword [ebp - 0xf8], ebx
je 0x40e7ac
push dword [ebp - 0x100]
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push dword [ebp - 0x100]
lea eax, [ebp - 0x17c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x17c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp word [ebp + 0x3c], bx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
je 0x40ea26
mov eax, dword [ebp - 0x5c]
mov ax, word [eax]
xor esi, esi
cmp ax, 0x40
je 0x40e80c
cmp byte [ebp - 0x39], bl
je 0x40e80c
cmp ax, 0x26
je 0x40e806
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x40e80c
mov byte [ebp + 0x77], 1
jmp 0x40e80f
mov byte [ebp + 0x77], bl
lea ecx, [ebp - 0xa0]
call fcn.00402d41
cmp byte [ebp + 0x77], bl
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x70], eax
mov dword [ebp - 0xe0], edi
jne 0x40e9b2
cmp byte [ebp + 0x47], 2
jne 0x40e847
mov dword [ebp - 0xe0], edi
mov word [eax + edi], bx
mov esi, dword [ebp + 0x50]
jmp 0x40e8db
cmp byte [ebp + 0x47], 1
lea ecx, [ebp - 0xa0]
jne 0x40e87a
push dword [ebp - 0x88]
push edi
push eax
call fcn.00444016
mov eax, dword [ebp - 0xa0]
push eax
mov dword [ebp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xe0], eax
jmp 0x40e8df
lea eax, [edi + 0x18]
push eax
call fcn.00443fa0
lea eax, [edi + 1]
push eax
push dword [ebp + 0x50]
mov dword [ebp - 0x98], edi
push dword [ebp - 0xa0]
mov dword [ebp - 0x9c], edi
call fcn.00413de4
mov eax, dword [ebp - 0xa0]
push 0x10
add edi, eax
push ebx
push edi
call fcn.004aa020
lea eax, [ebp - 0xa0]
push 0x2004
push eax
call fcn.00499e81
mov eax, dword [ebp - 0xa0]
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0x9c]
add esp, 0x20
mov dword [ebp - 0xe0], eax
cmp esi, ebx
jne 0x40e8e5
mov esi, dword [ebp - 0xa0]
test byte [ebp + 0x3c], 4
je 0x40e91d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 - 2]
jmp 0x40e90c
mov cx, word [eax]
cmp cx, 0xd
je 0x40e907
cmp cx, 0xa
jne 0x40e910
mov word [eax], bx
dec eax
dec eax
cmp eax, esi
jae 0x40e8f8
sub eax, esi
mov dword [ebp - 0xe0], eax
jmp 0x40e9b2
test byte [ebp + 0x3c], 1
je 0x40e972
mov edx, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x128]
jmp 0x40e965
cmp ax, 0xd
jne 0x40e94f
lea ecx, [esi + 2]
cmp word [ecx], 0xa
jne 0x40e94f
cmp edi, ebx
jl 0x40e955
jg 0x40e94b
cmp edx, 1
jbe 0x40e955
mov esi, ecx
jmp 0x40e955
cmp ax, 0xa
jne 0x40e963
add edx, 0xffffffff
adc edi, 0xffffffff
js 0x40e96d
jg 0x40e963
cmp edx, ebx
jbe 0x40e96d
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x40e931
mov word [esi], bx
jmp 0x40e9a9
test byte [ebp + 0x3c], 2
je 0x40e9b2
jmp 0x40e9a1
cmp ax, 0xd
je 0x40e98a
cmp ax, 0xa
je 0x40e98a
inc esi
inc esi
jmp 0x40e9a1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00413d9a
add esp, 0xc
mov ax, word [esi]
cmp ax, bx
jne 0x40e97a
sub esi, dword [ebp + 0x70]
mov dword [ebp - 0xe0], esi
cmp byte [ebp - 0x38], bl
je 0x40e9ca
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 0x70]
call fcn.004083ef
pop ecx
pop ecx
jmp 0x40e9cd
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp - 0x5c]
cmp word [ecx], 0x40
jne 0x40e9ed
mov ecx, dword [ebp + 0x4c]
push eax
push eax
push 0x4bca0c
push dword [ebp - 0x20]
push dword [ebp - 0x20]
call fcn.0044097f
jmp 0x40ea18
cmp byte [ebp + 0x77], bl
je 0x40ea09
push ebx
push ebx
push dword [ebp - 0xe0]
push eax
push ecx
push dword [ebp + 0x4c]
call fcn.0045067b
add esp, 0x18
jmp 0x40ea18
push dword [ebp - 0xa0]
push ecx
mov ecx, dword [ebp + 0x4c]
call fcn.00443666
lea ecx, [ebp - 0xa0]
call fcn.0043db4f
mov eax, dword [ebp - 0x14]
push eax
mov dword [ebp + 0x28], eax
lea eax, [ebp - 0x384]
push 0x4bdab8
push eax
mov word [ebp - 0x384], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0xc
lea eax, [ebp - 0x384]
push eax
push str.ERRORLEVEL
call fcn.00443666
cmp dword [ebp - 0xf8], ebx
je 0x40ea7a
cmp byte [ebp + 0x1b], 1
je 0x40ea7a
push dword [ebp - 0x100]
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp - 0xe4]
call fcn.0043db4f
lea ecx, [ebp + 0x50]
call fcn.0043db4f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x40eaa4
lea eax, [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ecx], eax
cmp byte [ebp + 0x13], bl
lea eax, [ebp - 0x17c]
mov dword [eax], ebx
je 0x40ebe8
cmp dword [eax + 8], ebx
je 0x40ebe8
cmp byte [0x4d7cec], bl
jne 0x40ebe8
cmp dword [ebp + 0x24], ebx
mov byte [0x4d7cec], 1
jne 0x40eb73
push 0x1000
lea ecx, [ebp + 0x70]
call fcn.00402d2f
mov eax, dword [ebp + 0x70]
push ebx
mov dword [ebp + 0x78], ebx
mov word [eax], bx
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x70]
push eax
push str.SystemStartOptions
push str.SYSTEMCurrentControlSetControl
push 0x80000002
call fcn.0044856b
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043dae7
add esp, 0x1c
jmp 0x40eb55
push 8
push eax
push str.PECMDHB
call fcn.0043da43
add esp, 0xc
test al, al
jne 0x40eb5f
push 6
push dword [ebp + 0x74]
push str.WIMHB
call fcn.0043da43
add esp, 0xc
test al, al
jne 0x40eb5f
lea eax, [ebp + 0x74]
push eax
call fcn.00408ddd
pop ecx
mov eax, dword [ebp + 0x74]
cmp word [eax], bx
jne 0x40eb21
jmp 0x40eb66
mov dword [ebp + 0x24], 1
lea ecx, [ebp + 0x70]
call fcn.0043db4f
cmp dword [ebp + 0x24], ebx
je 0x40eb94
call fcn.00419fd4
test eax, eax
je 0x40eb8b
push str.exec
push dword [ebp + 0x4c]
call fcn.0041a075
pop ecx
pop ecx
push ebx
call fcn.00416619
pop ecx
jmp 0x40ebe8
lea eax, [ebp - 0x17c]
push dword [eax + 8]
lea eax, [ebp - 0x328]
push str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x328]
push eax
push str.DELAY_bwinpeshl____s__r_n
push dword [ebp + 0x4c]
call fcn.00410a74
mov ecx, dword [ebp + 0x4c]
add esp, 0x18
push 0x4d7c04
push ebx
push ebx
push ebx
lea eax, [ebp + 0x76]
push eax
push dword [ebp + 0x4c]
lea eax, [ebp - 0x328]
push eax
mov word [ebp + 0x76], bx
call fcn.0040a2d5
mov ecx, dword [ebp - 0xb8]
cmp ecx, ebx
je 0x40ec08
cmp word [ecx], bx
je 0x40ec08
lea eax, [ebp - 0x17c]
push dword [eax + 8]
push ecx
call fcn.004038de
pop ecx
pop ecx
lea edi, [ebp - 0x4c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ec14
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x10]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ec22
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xbc]
cmp dword [edi], ebx
je 0x40ec31
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xd8]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ec42
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x60]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ec50
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x7c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ec5e
push eax
call esi
cmp dword [ebp - 0x1a8], ebx
mov dword [edi], ebx
je 0x40ec70
push dword [ebp - 0x1a8]
call esi
lea edi, [ebp - 0x17c]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40ec80
push eax
call esi
mov ecx, dword [ebp + 0x4c]
push ebx
mov dword [edi + 4], ebx
call fcn.0046b6f3
mov ebx, dword [ebp + 0x28]
lea ecx, [ebp - 0x108]
call fcn.0043db4f
lea ecx, [ebp - 0x130]
call fcn.0043db4f
lea ecx, [ebp - 0x84]
call fcn.00402cb5
lea ecx, [ebp - 0x15c]
call fcn.0043db4f
lea ecx, [ebp - 0xa8]
call fcn.00402cb5
lea ecx, [ebp - 0xa4]
call fcn.00402cb5
lea ecx, [ebp - 0xbc]
call fcn.00402cb5
lea ecx, [ebp - 0x10]
call fcn.00402cb5
lea ecx, [ebp - 0x4c]
call fcn.00402cb5
lea ecx, [ebp - 0x7c]
call fcn.00402cb5
lea ecx, [ebp - 0xd8]
call fcn.00402cb5
lea ecx, [ebp - 0x60]
call fcn.00402cb5
lea ecx, [ebp - 0xb8]
call fcn.0043db4f
lea ecx, [ebp - 0x1d0]
call fcn.0043db4f
lea ecx, [ebp - 0x110]
call fcn.0043db4f
lea ecx, [ebp - 0x70]
call fcn.0043db4f
lea ecx, [ebp - 0x144]
call fcn.0043db4f
lea ecx, [ebp - 0xfc]
call fcn.0043db4f
lea ecx, [ebp - 0x11c]
call fcn.0043db4f
lea ecx, [ebp - 0x148]
call fcn.0043db4f
lea ecx, [ebp - 0xc4]
call fcn.0043db4f
lea ecx, [ebp - 0xf8]
call fcn.00402cb5
lea ecx, [ebp - 0x158]
call fcn.00402cb5
lea ecx, [ebp - 0x1c4]
call fcn.00404947
lea ecx, [ebp - 0x188]
call fcn.0043db4f
lea ecx, [ebp - 0xac]
call fcn.0043db4f
lea ecx, [ebp - 0xb4]
call fcn.0043db4f
lea ecx, [ebp - 0x5c]
call fcn.0043db4f
lea ecx, [ebp - 0x154]
call fcn.0043db4f
lea ecx, [ebp - 0x124]
call fcn.0043db4f
lea ecx, [ebp - 0x150]
call fcn.0043db4f
lea ecx, [ebp - 0x14c]
call fcn.0043db4f
lea ecx, [ebp - 0x120]
call fcn.0043db4f
lea ecx, [ebp - 0x104]
call fcn.0043db4f
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x5c
leave
ret 0x1c