Function at 0x407190
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Execute command
Get common file path
Parse pe header
Set console window title
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411919
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x419008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004089f0
mov ecx, eax
call fcn.0040a630
mov ecx, eax
call fcn.00404a30
call fcn.00408ac0
mov ecx, eax
call fcn.0040a620
mov ecx, eax
call fcn.00404a30
call fcn.00408b80
mov ecx, eax
call fcn.0040a610
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x40
push 0x96
push 0x1f4
push 1
call esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0x4b
push eax
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cdq
sub eax, edx
sar eax, 1
sub eax, 0xfa
push eax
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00404d90
call esi
mov ecx, eax
call fcn.00404e70
call fcn.00408c50
mov ecx, eax
call fcn.0040a600
mov edx, eax
lea ecx, [ebp - 0x314]
call fcn.00403d90
mov dword [ebp - 4], 0
call fcn.00408d30
mov ecx, eax
call fcn.0040a5f0
mov edx, eax
lea ecx, [ebp - 0x32c]
call fcn.00403d90
mov byte [ebp - 4], 1
call fcn.00408e00
mov ecx, eax
call fcn.0040a5e0
mov edx, eax
lea ecx, [ebp - 0x38c]
call fcn.00403d90
push 0x414438
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 2
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 3
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 4
call fcn.0040b9d0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1d4]
push eax
lea edx, [ebp - 0x314]
lea ecx, [ebp - 0x3c8]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3b0]
call fcn.00404300
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 7
push ecx
mov edx, eax
lea ecx, [ebp - 0x23c]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x224]
call fcn.004043f0
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 9
push ecx
mov edx, eax
lea ecx, [ebp - 0x35c]
call fcn.004012e0
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0040b900
lea ecx, [ebp - 0x23c]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
call fcn.0040b900
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x1d4]
call fcn.0040b900
lea ecx, [ebp - 0x18c]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x11
call fcn.0040b900
push 0x414438
lea ecx, [ebp - 0x18c]
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x12
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x13
call fcn.0040b9d0
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0x14
push eax
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x26c]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3e4]
call fcn.00404300
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1d4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x284]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x3fc]
call fcn.004043f0
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x344]
call fcn.004012e0
add esp, 0xc
lea ecx, [ebp - 0x3fc]
call fcn.0040b900
lea ecx, [ebp - 0x284]
call fcn.0040b900
lea ecx, [ebp - 0x3e4]
call fcn.0040b900
lea ecx, [ebp - 0x26c]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
call fcn.0040b900
lea ecx, [ebp - 0x1d4]
call fcn.0040b900
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x20
call fcn.0040b900
push 0x414438
lea ecx, [ebp - 0x18c]
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x21
call fcn.0040b9d0
push 0x414438
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x22
call fcn.0040b9d0
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0x23
push eax
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x23c]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x224]
call fcn.00404300
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x25
push ecx
mov edx, eax
lea ecx, [ebp - 0x3b0]
call fcn.004012e0
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x3c8]
call fcn.004043f0
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x27
push ecx
mov edx, eax
lea ecx, [ebp - 0x26c]
call fcn.004012e0
add esp, 0xc
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
call fcn.0040b900
lea ecx, [ebp - 0x224]
call fcn.0040b900
lea ecx, [ebp - 0x23c]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
call fcn.0040b900
lea ecx, [ebp - 0x1d4]
call fcn.0040b900
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x2f
call fcn.0040b900
lea eax, [ebp - 0x344]
push eax
lea edx, [ebp - 0x35c]
lea ecx, [ebp - 0x3e4]
call fcn.0040dcd0
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x30
push ecx
mov edx, eax
lea ecx, [ebp - 0x284]
call fcn.0040dbc0
add esp, 8
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x32
call fcn.0040b900
sub esp, 0x18
lea eax, [ebp - 0x284]
mov esi, esp
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040ba30
mov ecx, esi
call fcn.0040f820
add esp, 0x18
lea ecx, [ebp - 0x20c]
call fcn.0040f820
add esp, 0x18
lea eax, [ebp - 0x390]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040b890
mov esi, eax
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x394]
push eax
call fcn.0040b870
mov edx, eax
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x3cc]
push eax
call fcn.0040b890
push dword [esi]
lea ecx, [ebp - 0x398]
push dword [edx]
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
push dword [eax]
call fcn.0040e020
call fcn.00401230
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1d4]
call fcn.0040b9d0
mov byte [ebp - 4], 0x34
call fcn.00408f90
mov ecx, eax
call fcn.0040a5c0
push eax
lea ecx, [ebp - 0x3b0]
call fcn.0040b9d0
mov esi, eax
mov byte [ebp - 4], 0x35
call fcn.00408ed0
mov ecx, eax
call fcn.0040a5d0
push eax
lea ecx, [ebp - 0x3c8]
call fcn.0040b9d0
push eax
lea edx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x3fc]
call fcn.0040dc70
push 0x41443c
mov edx, eax
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x3e4]
call fcn.0040daf0
push esi
mov edx, eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x2b4]
call fcn.0040dba0
add esp, 0xc
lea ecx, [ebp - 0x3e4]
call fcn.0040b900
lea ecx, [ebp - 0x3fc]
call fcn.0040b900
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0x3d
call fcn.0040b900
call fcn.00409050
mov ecx, eax
call fcn.0040a5b0
push eax
lea ecx, [ebp - 0x374]
call fcn.0040b9d0
mov byte [ebp - 4], 0x3e
call fcn.00409110
mov ecx, eax
call fcn.0040a5a0
push eax
lea ecx, [ebp - 0x3fc]
call fcn.0040b9d0
mov esi, eax
lea eax, [ebp - 0x374]
mov byte [ebp - 4], 0x3f
push eax
lea edx, [ebp - 0x1d4]
lea ecx, [ebp - 0x3e4]
call fcn.0040dcd0
push esi
mov edx, eax
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x254]
call fcn.0040dba0
add esp, 8
lea ecx, [ebp - 0x3e4]
call fcn.0040b900
lea ecx, [ebp - 0x3fc]
mov byte [ebp - 4], 0x43
call fcn.0040b900
sub esp, 0x18
lea eax, [ebp - 0x1d4]
mov ecx, esp
push eax
call fcn.0040ba30
call fcn.00404e90
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x18
call fcn.00404df0
call fcn.004091d0
mov ecx, eax
call fcn.0040a590
push eax
call ebx
sub esp, 0x14
lea ecx, [ebp - 0x2b4]
mov edx, esp
mov dword [ebp - 0x398], esp
call fcn.0040b860
push eax
mov ecx, edx
call fcn.0040b9d0
sub esp, 0x18
mov byte [ebp - 4], 0x44
mov esi, esp
call fcn.00409290
mov ecx, eax
call fcn.0040a580
push eax
mov ecx, esi
call fcn.0040b9d0
mov byte [ebp - 4], 0x43
call fcn.00405ac0
add esp, 0x30
test al, al
je 0x4088a9
push 0x414440
lea ecx, [ebp - 0x2b4]
call fcn.0040b860
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
call fcn.00401230
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x45
lea edx, [edi + 0x5a]
lea ecx, [edi + 0x32]
call fcn.004049f0
test eax, eax
jle 0x40789e
call fcn.00404920
movzx eax, al
lea ecx, [ebp - 0x224]
push eax
call fcn.0040b8b0
mov edx, 0x5a
inc edi
lea ecx, [edx - 0x28]
call fcn.004049f0
cmp edi, eax
jl 0x407878
lea ecx, [ebp - 0x174]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x46
lea edx, [edi + 0x32]
lea ecx, [edi + 0xa]
call fcn.004049f0
test eax, eax
jle 0x4078e6
nop
call fcn.00404950
movzx eax, al
lea ecx, [ebp - 0x174]
push eax
call fcn.0040b8b0
mov edx, 0x32
inc edi
lea ecx, [edx - 0x28]
call fcn.004049f0
cmp edi, eax
jl 0x4078c0
lea ecx, [ebp - 0x1ec]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x47
lea edx, [edi + 0x64]
lea ecx, [edi + 0x3c]
call fcn.004049f0
test eax, eax
jle 0x40792c
call fcn.00404970
movzx eax, al
lea ecx, [ebp - 0x1ec]
push eax
call fcn.0040b8b0
mov edx, 0x64
inc edi
lea ecx, [edx - 0x28]
call fcn.004049f0
cmp edi, eax
jl 0x407906
lea ecx, [ebp - 0x1bc]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x48
lea edx, [edi + 0x50]
lea ecx, [edi + 0x28]
call fcn.004049f0
test eax, eax
jle 0x407976
nop dword [eax]
call fcn.00404990
movzx eax, al
lea ecx, [ebp - 0x1bc]
push eax
call fcn.0040b8b0
mov edx, 0x50
inc edi
lea ecx, [edx - 0x28]
call fcn.004049f0
cmp edi, eax
jl 0x407950
lea ecx, [ebp - 0x15c]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x49
lea edx, [edi + 0x64]
lea ecx, [edi + 0x28]
call fcn.004049f0
test eax, eax
jle 0x4079bc
call fcn.004049b0
movzx eax, al
lea ecx, [ebp - 0x15c]
push eax
call fcn.0040b8b0
mov edx, 0x64
inc edi
lea ecx, [edx - 0x3c]
call fcn.004049f0
cmp edi, eax
jl 0x407996
lea ecx, [ebp - 0x144]
call fcn.0040ba10
xor edi, edi
mov byte [ebp - 4], 0x4a
lea edx, [edi + 0x46]
lea ecx, [edi + 0x3c]
call fcn.004049f0
test eax, eax
jle 0x407a06
nop dword [eax]
call fcn.004049d0
movzx eax, al
lea ecx, [ebp - 0x144]
push eax
call fcn.0040b8b0
mov edx, 0x46
inc edi
lea ecx, [edx - 0xa]
call fcn.004049f0
cmp edi, eax
jl 0x4079e0
lea ecx, [ebp - 0x1a4]
call fcn.0040ba10
mov byte [ebp - 4], 0x4b
call fcn.00401230
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], edx
call fcn.00401220
push 0x100
mov edi, eax
call fcn.0040fdaa
mov ecx, dword [edi + 0x14]
add esp, 4
add ecx, 0x76c
mov ebx, eax
push ecx
mov ecx, dword [edi + 0x10]
inc ecx
push ecx
push dword [edi + 0xc]
call fcn.00409440
mov ecx, eax
call fcn.0040a560
push eax
push ebx
call fcn.00401070
add esp, 0x14
lea ecx, [ebp - 0x12c]
push 0x414438
call fcn.0040b9d0
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0x4c
push eax
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.0040b9d0
lea ecx, [ebp - 0x3b0]
call fcn.0040f820
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x3c8]
call fcn.004012e0
add esp, 4
lea ecx, [ebp - 0x1a4]
push eax
call fcn.0040b950
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x4b
call fcn.0040b900
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push esi
call ebx
add esp, 0xc
lea ecx, [ebp - 0x1a4]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407b01
push esi
sub eax, edx
lea ecx, [ebp - 0x1a4]
push 1
push eax
call fcn.0040b860
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407b40
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 4
mov ecx, esp
call fcn.004016c0
lea ecx, [ebp - 0x414]
call fcn.0040f820
add esp, 0x18
mov ecx, eax
mov byte [ebp - 4], 0x4e
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407b88
sub eax, edx
lea ecx, [ebp - 0x12c]
push 0x414438
mov dword [ebp - 0x390], eax
call fcn.0040b9d0
push esi
push 1
mov byte [ebp - 4], 0x4f
lea eax, [ebp - 0x12c]
push dword [ebp - 0x390]
push eax
sub esp, 0x18
mov ecx, esp
call fcn.004016c0
lea ecx, [ebp - 0x3b0]
call fcn.0040f820
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x3c8]
call fcn.004012e0
add esp, 4
mov ecx, eax
call fcn.0040b860
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
call fcn.0040b900
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x4b
call fcn.0040b900
push 2
push 0
push esi
call ebx
add esp, 0xc
lea ecx, [ebp - 0x1ec]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407c40
push esi
sub eax, edx
lea ecx, [ebp - 0x1ec]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407c73
push esi
sub eax, edx
lea ecx, [ebp - 0x1bc]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ca6
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ce0
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1a4]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d13
push esi
sub eax, edx
lea ecx, [ebp - 0x1a4]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d46
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d80
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407db3
push esi
sub eax, edx
lea ecx, [ebp - 0x1bc]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1ec]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407de6
push esi
sub eax, edx
lea ecx, [ebp - 0x1ec]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e20
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1a4]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e53
push esi
sub eax, edx
lea ecx, [ebp - 0x1a4]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e86
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1ec]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ec0
push esi
sub eax, edx
lea ecx, [ebp - 0x1ec]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ef3
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1ec]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f26
push esi
sub eax, edx
lea ecx, [ebp - 0x1ec]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f60
push esi
sub eax, edx
lea ecx, [ebp - 0x1bc]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f93
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407fc6
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1a4]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408000
push esi
sub eax, edx
lea ecx, [ebp - 0x1a4]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408033
push esi
sub eax, edx
lea ecx, [ebp - 0x1bc]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408066
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4080a0
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4080d3
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 4
mov ecx, esp
call fcn.004016c0
lea ecx, [ebp - 0x3b0]
call fcn.0040f820
add esp, 0x18
mov ecx, eax
mov byte [ebp - 4], 0x51
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408120
sub eax, edx
lea ecx, [ebp - 0x12c]
push 0x414438
mov dword [ebp - 0x390], eax
call fcn.0040b9d0
push esi
push 1
mov byte [ebp - 4], 0x52
lea eax, [ebp - 0x12c]
push dword [ebp - 0x390]
push eax
sub esp, 0x18
mov ecx, esp
call fcn.004016c0
lea ecx, [ebp - 0x3c8]
call fcn.0040f820
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x414]
call fcn.004012e0
add esp, 4
mov ecx, eax
call fcn.0040b860
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x414]
call fcn.0040b900
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x12c]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0x4b
call fcn.0040b900
push 2
push 0
push esi
call ebx
add esp, 0xc
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4081d4
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408207
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408240
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x15c]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408273
push esi
sub eax, edx
lea ecx, [ebp - 0x15c]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4082a6
push esi
sub eax, edx
lea ecx, [ebp - 0x1bc]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x144]
call fcn.0040b860
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4082e0
push esi
sub eax, edx
lea ecx, [ebp - 0x144]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x174]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408313
push esi
sub eax, edx
lea ecx, [ebp - 0x174]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x1a4]
call fcn.0040b860
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408346
push esi
sub eax, edx
lea ecx, [ebp - 0x1a4]
push 1
push eax
call fcn.0040b860
push eax
call edi
push 2
push 0
push esi
call ebx
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x20
push 0x40df60
call fcn.00409510
mov ecx, eax
call fcn.0040a550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x40df60
call fcn.004095f0
mov ecx, eax
call fcn.0040a540
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
lea edx, [ebp - 0x20c]
mov ecx, eax
call fcn.0040e070
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.004096c0
mov ecx, eax
call fcn.0040a530
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040b9d0
mov byte [ebp - 4], 0x54
call fcn.00409860
mov ecx, eax
call fcn.0040a510
push eax
lea ecx, [ebp - 0x3b0]
call fcn.0040b9d0
mov esi, eax
mov byte [ebp - 4], 0x55
call fcn.00409780
mov ecx, eax
call fcn.0040a520
push eax
lea ecx, [ebp - 0x3c8]
call fcn.0040b9d0
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x56
push ecx
mov edx, eax
lea ecx, [ebp - 0x414]
call fcn.0040dbc0
push esi
mov edx, eax
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2fc]
call fcn.0040dba0
add esp, 8
lea ecx, [ebp - 0x414]
call fcn.0040b900
lea ecx, [ebp - 0x3c8]
call fcn.0040b900
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0x5b
call fcn.0040b900
push 0x4197cc
sub esp, 8
lea ecx, [ebp - 0x2fc]
call fcn.0040b860
lea ecx, [ebp - 0x29c]
mov edx, eax
call fcn.0040b860
mov ecx, eax
call fcn.004050c0
add esp, 0xc
call fcn.00409920
mov ecx, eax
call fcn.0040a500
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
cmp dword [0x4197bc], 0
jne 0x40861e
call fcn.00409b70
mov ecx, eax
call fcn.0040a4d0
push eax
lea ecx, [ebp - 0x474]
call fcn.0040b9d0
mov edi, eax
mov byte [ebp - 4], 0x5c
call fcn.00409ab0
mov ecx, eax
call fcn.0040a4e0
push eax
lea ecx, [ebp - 0x45c]
call fcn.0040b9d0
mov esi, eax
mov byte [ebp - 4], 0x5d
call fcn.004099e0
mov ecx, eax
call fcn.0040a4f0
push eax
lea ecx, [ebp - 0x444]
call fcn.0040b9d0
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x42c]
call fcn.0040dbc0
push esi
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x48c]
call fcn.0040dba0
push edi
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x12c]
call fcn.0040dba0
add esp, 0xc
lea ecx, [ebp - 0x48c]
call fcn.0040b900
lea ecx, [ebp - 0x42c]
call fcn.0040b900
lea ecx, [ebp - 0x444]
call fcn.0040b900
lea ecx, [ebp - 0x45c]
call fcn.0040b900
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 0x66
call fcn.0040b900
lea ecx, [ebp - 0x254]
call fcn.0040b860
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call edi
lea ecx, [ebp - 0x254]
call fcn.0040b860
push eax
call edi
lea ecx, [ebp - 0x254]
call fcn.0040b860
push eax
call edi
lea ecx, [ebp - 0x12c]
call fcn.0040b860
push eax
sub esp, 0x18
lea eax, [ebp - 0x254]
mov ecx, esp
push eax
call fcn.0040ba30
call fcn.00404550
add esp, 0x1c
lea ecx, [ebp - 0x254]
push 1
push 0
push 0
call fcn.0040b860
push eax
call fcn.00409c70
mov ecx, eax
call fcn.0040a4c0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x12c]
mov dword [0x4197bc], 1
call fcn.0040b900
lea ecx, [ebp - 0x18c]
call fcn.0040ba10
mov byte [ebp - 4], 0x67
mov edx, ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.0040e090
call fcn.00409e10
mov ecx, eax
call fcn.0040a4a0
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040b9d0
mov esi, eax
mov byte [ebp - 4], 0x68
call fcn.00409d30
mov ecx, eax
call fcn.0040a4b0
push eax
lea ecx, [ebp - 0x444]
call fcn.0040b9d0
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x69
push ecx
mov edx, eax
lea ecx, [ebp - 0x45c]
call fcn.0040dbc0
push esi
mov edx, eax
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x474]
call fcn.0040dba0
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x6b
push ecx
mov edx, eax
lea ecx, [ebp - 0x2e4]
call fcn.0040dbc0
add esp, 0xc
lea ecx, [ebp - 0x474]
call fcn.0040b900
lea ecx, [ebp - 0x45c]
call fcn.0040b900
lea ecx, [ebp - 0x444]
call fcn.0040b900
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x70
call fcn.0040b900
push 0x4197e0
sub esp, 8
lea ecx, [ebp - 0x2e4]
call fcn.0040b860
lea ecx, [ebp - 0x29c]
mov edx, eax
call fcn.0040b860
mov ecx, eax
call fcn.004050c0
add esp, 0xc
call fcn.00409ed0
mov ecx, eax
call fcn.0040a490
push eax
lea ecx, [ebp - 0x48c]
call fcn.0040b9d0
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x71
push ecx
mov edx, eax
lea ecx, [ebp - 0x23c]
call fcn.0040dbc0
add esp, 4
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x73
call fcn.0040b900
sub esp, 0x18
lea eax, [ebp - 0x23c]
mov ecx, esp
push eax
call fcn.0040ba30
lea ecx, [ebp - 0x2cc]
call fcn.0040f820
add esp, 0x18
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 0x74
call fcn.0040b860
mov ecx, 0x4197e0
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4087a4
test dl, dl
je 0x4087a0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4087a4
add ecx, 2
add eax, 2
test dl, dl
jne 0x408784
xor eax, eax
jmp 0x4087a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4088c0
call fcn.0040a1e0
mov ecx, eax
call fcn.0040a450
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push eax
call ebx
add esp, 4
call fcn.00404df0
push 0x40df60
call fcn.0040a2a0
mov ecx, eax
call fcn.0040a440
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.0040a370
mov ecx, eax
call fcn.0040a430
push eax
call ebx
add esp, 4
call fcn.00404df0
lea ecx, [ebp - 0x2cc]
call fcn.0040b900
lea ecx, [ebp - 0x23c]
call fcn.0040b900
lea ecx, [ebp - 0x2e4]
call fcn.0040b900
lea ecx, [ebp - 0x18c]
call fcn.0040b900
lea ecx, [ebp - 0x2fc]
call fcn.0040b900
lea ecx, [ebp - 0x29c]
call fcn.0040b900
lea ecx, [ebp - 0x1a4]
call fcn.0040b900
lea ecx, [ebp - 0x144]
call fcn.0040b900
lea ecx, [ebp - 0x15c]
call fcn.0040b900
lea ecx, [ebp - 0x1bc]
call fcn.0040b900
lea ecx, [ebp - 0x1ec]
call fcn.0040b900
lea ecx, [ebp - 0x174]
call fcn.0040b900
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x43
call fcn.0040b900
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x4077d1
call fcn.00409380
mov ecx, eax
call fcn.0040a570
push eax
call ebx
add esp, 4
jmp 0x4077d1
call fcn.00409f90
mov ecx, eax
call fcn.0040a480
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
call fcn.00404df0
push 0x40df60
call fcn.0040a050
mov ecx, eax
call fcn.0040a470
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.PBApp
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x408931
nop word [eax + eax]
push 0x64
call esi
push 0
push str.PBApp
call edi
test eax, eax
je 0x408920
lea ecx, [ebp - 0x394]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x394]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x390]
push eax
sub esp, 0x14
mov edx, edi
call fcn.004059e0
add esp, 0x18
lea ecx, [ebp - 0x2b4]
call fcn.0040b860
mov ecx, dword [ebp - 0x394]
mov edx, eax
call fcn.00402570
test al, al
je 0x4089e3
mov edx, dword [ebp - 0x390]
test edx, edx
je 0x4089a8
push ecx
push 0x4197c0
mov ecx, edi
call fcn.00405980
add esp, 8
mov dword [ebp - 0x390], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40df60
call fcn.0040a120
mov ecx, eax
call fcn.0040a460
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
call fcn.0040dd20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x3e8
call esi
push 0x3e8
call esi
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3