Function at 0x4fd558
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path
Move file
Persist via lnk shortcut
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x4fd560
push ecx
push ebx
push esi
push edi
mov eax, 0x4fcdb0
call fcn.00406dd8
mov ebx, dword [0x540c9c]
xor eax, eax
push ebp
push 0x4fe993
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408e1c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004ab8e8
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004049d0
jne 0x4fd5c9
mov eax, dword [0x5408f8]
mov byte [eax], 0
jmp 0x4fd5d1
mov eax, dword [0x5408f8]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e58
mov edx, dword [ebp - 0x20]
mov eax, dword [0x540af4]
call fcn.0040460c
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408e58
mov edx, dword [ebp - 0x28]
mov eax, dword [0x540b68]
call fcn.0040460c
mov eax, dword [0x5408f8]
cmp byte [eax], 0
jne 0x4fd641
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004ab8e8
mov edx, dword [ebp - 0x30]
mov eax, dword [0x54092c]
call fcn.0040460c
jmp 0x4fd66a
lea edx, [ebp - 0x38]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x34]
mov eax, dword [0x54092c]
call fcn.0040460c
push 0x4fe9ac
mov eax, dword [0x540f14]
push dword [eax]
push 0x4fe9b8
mov eax, dword [0x540bf0]
mov edx, 3
call fcn.0040494c
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe9c8
call fcn.004049d0
jne 0x4fd73d
fld xword [0x4fe9cc]
mov eax, dword [0x5409dc]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4fd73d
call fcn.0046aee0
test al, al
jne 0x4fd73d
call fcn.0040b0dc
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409420
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x540b68]
call fcn.0040460c
lea edx, [ebp - 0x40]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.0046dcbc
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
mov eax, dword [0x540af4]
push dword [eax]
push 0x4fe9e0
mov eax, dword [0x540b68]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00404a84
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046af5c
jmp 0x4fe93f
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.00408e1c
mov edx, dword [ebp - 0x48]
mov eax, 0x549ba8
call fcn.0040460c
mov eax, dword [0x549ba8]
call fcn.00463080
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409420
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004ab8e8
mov edx, dword [ebp - 0x50]
mov eax, 0x549ba4
pop ecx
call fcn.004048d8
mov dl, 1
mov eax, dword [0x462e88]
call fcn.0040377c
mov dword [0x5403f0], eax
mov edx, dword [0x549ba4]
mov eax, dword [0x5403f0]
call fcn.00462f2c
test eax, eax
jne 0x4fd94c
mov eax, 0x4fe9e4
xor edx, edx
call fcn.00471190
mov ebx, eax
test ebx, ebx
je 0x4fe8e0
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe9f8
call fcn.004049d0
jne 0x4fd7ef
push 0
push 0
push 0x702
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea04
call fcn.004049d0
jne 0x4fd816
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea14
call fcn.004049d0
jne 0x4fd83d
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea24
call fcn.004049d0
jne 0x4fd864
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea30
call fcn.004049d0
jne 0x4fd92b
mov edx, dword [0x540b68]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x540b68]
cmp dword [eax], 0
jne 0x4fd8a4
mov eax, dword [0x540b68]
mov edx, 0x4fe9e0
call fcn.0040460c
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x540b68]
mov eax, dword [eax]
call fcn.0040488c
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x549ba0
mov ecx, 1
mov edx, dword [0x4fcd64]
call fcn.00405f1c
add esp, 4
mov eax, dword [0x540b68]
call fcn.00404adc
mov edx, eax
mov eax, dword [0x549ba0]
call fcn.00409d74
mov edi, dword [0x549ba0]
test esi, esi
jle 0x4fd917
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4fd8fd
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
mov eax, dword [0x5407e8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540910]
movzx eax, byte [eax]
push eax
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe8e0
lea edx, [ebp - 0x58]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x54]
mov eax, dword [0x540e54]
call fcn.0040460c
mov eax, dword [0x540e14]
mov dword [eax], 0x6562
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00471edc
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x540df4]
call fcn.0040460c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00471edc
mov edx, dword [ebp - 0x60]
mov eax, dword [0x540ae8]
call fcn.0040460c
mov eax, dword [0x549ba8]
call fcn.0040488c
push eax
mov eax, 0x549ba8
call fcn.00404adc
pop edx
call fcn.00471430
mov edx, dword [0x540e14]
add dword [edx], eax
call fcn.00402b00
lea edx, [ebp - 0x64]
mov eax, 0x3e
call fcn.004ab8e8
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebx]
mov eax, dword [0x5404e8]
call fcn.004048d8
lea edx, [ebp - 0x68]
mov eax, 0x3c
call fcn.004ab8e8
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebx]
mov eax, dword [0x540efc]
call fcn.004048d8
lea edx, [ebp - 0x6c]
mov eax, 0x3d
call fcn.004ab8e8
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebx]
mov eax, dword [0x540bac]
call fcn.004048d8
lea edx, [ebp - 0x70]
mov eax, 0x34
call fcn.004ab8e8
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebx]
mov eax, dword [0x540a14]
call fcn.004048d8
lea edx, [ebp - 0x74]
mov eax, 0x36
call fcn.004ab8e8
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebx]
mov eax, dword [0x5406f8]
call fcn.004048d8
lea edx, [ebp - 0x78]
mov eax, 0x3b
call fcn.004ab8e8
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebx]
mov eax, dword [0x540e84]
call fcn.004048d8
lea edx, [ebp - 0x7c]
mov eax, 4
call fcn.004ab8e8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebx]
mov eax, dword [0x540820]
call fcn.004048d8
lea edx, [ebp - 0x80]
mov eax, 0x7b
call fcn.004ab8e8
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebx]
mov eax, dword [0x540e60]
call fcn.004048d8
lea edx, [ebp - 0x84]
mov eax, 3
call fcn.004ab8e8
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebx]
mov eax, dword [0x540ce4]
call fcn.004048d8
lea edx, [ebp - 0x88]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00408e1c
mov edx, dword [ebp - 0x88]
mov eax, 0x549b78
call fcn.0040460c
push 0x104
mov eax, dword [0x540904]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4fdba5
lea edx, [ebp - 0x8c]
mov eax, dword [0x540904]
call fcn.00409f74
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x54061c]
call fcn.0040460c
mov eax, dword [0x54061c]
mov eax, dword [eax]
call fcn.0040488c
cmp eax, 3
jle 0x4fdb58
mov eax, dword [0x54061c]
mov edx, 0x4fea3c
call fcn.00404894
mov eax, dword [0x54061c]
lea edx, [ebp - 0x90]
mov eax, 0x70
call fcn.004ab8e8
mov ecx, dword [ebp - 0x90]
mov edx, dword [0x54061c]
mov edx, dword [edx]
mov eax, dword [0x5406e0]
call fcn.004048d8
mov eax, dword [0x54061c]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4fdbad
mov eax, dword [0x54061c]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x5408f4]
mov byte [edx], al
jmp 0x4fdbad
mov eax, dword [0x5408f4]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x540904]
push eax
lea edx, [ebp - 0x94]
mov eax, 0x2e
call fcn.004ab8e8
mov eax, dword [ebp - 0x94]
call fcn.00404a84
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x540904]
call fcn.00409f58
mov edx, eax
mov eax, 0x549b84
call fcn.004047a8
mov eax, 0x549b84
call fcn.0046a994
mov eax, dword [0x549b78]
cmp byte [eax], 0x5c
jne 0x4fdc0d
mov eax, dword [0x540ce0]
mov byte [eax], 2
jmp 0x4fdc28
mov edx, dword [0x549b78]
mov eax, dword [0x549b84]
call fcn.00404bc8
dec eax
jne 0x4fdc28
mov eax, dword [0x540ce0]
mov byte [eax], 1
lea eax, [ebp - 0x98]
call fcn.004713b8
mov edx, dword [ebp - 0x98]
mov eax, dword [0x540520]
call fcn.0040460c
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe9c8
call fcn.004049d0
jne 0x4fdc89
lea edx, [ebp - 0x9c]
mov eax, 0x31
call fcn.004ab8e8
mov eax, dword [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.0046d0fc
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea48
call fcn.004049d0
jne 0x4fdca4
mov eax, dword [0x540910]
mov byte [eax], 1
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fea54
call fcn.004049d0
je 0x4fdcce
mov eax, dword [0x540b68]
mov eax, dword [eax]
mov edx, 0x4fea54
call fcn.004049d0
je 0x4fdcce
xor eax, eax
jmp 0x4fdcd0
mov al, 1
test al, al
je 0x4fdcfc
mov eax, 0x7d0
call fcn.004d9234
mov eax, dword [0x540820]
mov eax, dword [eax]
call fcn.0046dd44
test al, al
je 0x4fdd10
mov eax, dword [0x540820]
mov eax, dword [eax]
call fcn.00409988
jmp 0x4fdd10
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fdd10
mov eax, 0x7d0
call fcn.004d9234
lea edx, [ebp - 0xa4]
mov eax, 0x32
call fcn.004ab8e8
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xa8]
pop edx
call fcn.0046ce80
sub eax, 0x7d0
mov dword [0x5403f4], eax
lea edx, [ebp - 0xac]
mov eax, 0x76
call fcn.004ab8e8
mov eax, dword [ebp - 0xac]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.0046d328
test al, al
je 0x4fddc1
lea edx, [ebp - 0xb4]
mov eax, 0x76
call fcn.004ab8e8
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xb8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xb8]
pop edx
call fcn.0046ce80
mov edx, dword [0x5407e8]
mov dword [edx], eax
jmp 0x4fddcc
mov eax, dword [0x5407e8]
mov dword [eax], 0x1f40
mov eax, dword [0x540ce0]
cmp byte [eax], 1
je 0x4fe012
lea edx, [ebp - 0xc0]
mov eax, 0x31
call fcn.004ab8e8
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
pop edx
call fcn.0046c538
mov edx, dword [ebp - 0xbc]
mov eax, 0x549b74
call fcn.0040460c
lea edx, [ebp - 0xcc]
mov eax, 0x11b
call fcn.004ab8e8
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xc8]
pop edx
call fcn.0046c538
mov edx, dword [ebp - 0xc8]
mov eax, 0x549b70
call fcn.0040460c
cmp dword [0x549b70], 0
je 0x4fdeb4
mov eax, 0x549b74
call fcn.004045b8
lea edx, [ebp - 0xd4]
mov eax, 0x11b
call fcn.004ab8e8
mov eax, dword [ebp - 0xd4]
push eax
lea edx, [ebp - 0xd8]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xd8]
pop edx
call fcn.0046d0fc
jmp 0x4fdeed
lea edx, [ebp - 0xe0]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046c538
mov edx, dword [ebp - 0xdc]
mov eax, 0x549b70
call fcn.0040460c
mov eax, dword [0x549b74]
mov edx, 0x4fea60
call fcn.004049d0
jne 0x4fdf23
cmp dword [0x549b70], 0
je 0x4fe012
mov eax, dword [0x549b70]
mov edx, dword [0x540bf0]
mov edx, dword [edx]
call fcn.004049d0
je 0x4fe012
lea edx, [ebp - 0xe4]
mov eax, 0x31
call fcn.004ab8e8
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xe8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0xe8]
mov ecx, 0x4fea60
pop edx
call fcn.0046c30c
lea edx, [ebp - 0xec]
mov eax, 0x124
call fcn.004ab8e8
push dword [ebp - 0xec]
push 0x4fea3c
mov eax, dword [0x54092c]
push dword [eax]
push 0x4fea6c
mov eax, 0x549b9c
mov edx, 4
call fcn.0040494c
mov eax, 0x549b9c
call fcn.004db564
lea edx, [ebp - 0xf0]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xf0]
mov ecx, dword [0x540bf0]
mov ecx, dword [ecx]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046c30c
test al, al
je 0x4fdfd6
mov eax, dword [0x549b9c]
call fcn.00409988
jmp 0x4fe012
lea edx, [ebp - 0xf4]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xf4]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046d0fc
push 0
mov eax, dword [0x540f14]
mov eax, dword [eax]
mov ecx, dword [0x549b9c]
mov edx, 0x4fea48
call fcn.004d9334
lea edx, [ebp - 0xf8]
mov eax, 0x11b
call fcn.004ab8e8
mov eax, dword [ebp - 0xf8]
push eax
lea edx, [ebp - 0xfc]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0xfc]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x100]
mov eax, 0x25
call fcn.004ab8e8
mov eax, dword [ebp - 0x100]
push eax
lea edx, [ebp - 0x104]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x104]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x108]
mov eax, 0x26
call fcn.004ab8e8
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x10c]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x10c]
pop edx
call fcn.0046d0fc
mov edx, dword [ebx]
mov eax, dword [0x540b9c]
mov ecx, 0x4fea7c
call fcn.004048d8
lea edx, [ebp - 0x110]
mov eax, 0x77
call fcn.004ab8e8
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebx]
mov eax, dword [0x540a64]
call fcn.004048d8
lea edx, [ebp - 0x114]
mov eax, 0x78
call fcn.004ab8e8
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebx]
mov eax, dword [0x5405d0]
call fcn.004048d8
mov eax, dword [0x540ce0]
cmp byte [eax], 2
jne 0x4fe37b
lea edx, [ebp - 0x118]
mov eax, 0x1a
call fcn.004ab8e8
mov ecx, dword [ebp - 0x118]
mov eax, 0x549b80
mov edx, dword [0x549b84]
call fcn.004048d8
lea edx, [ebp - 0x120]
mov eax, 0x1a
call fcn.004ab8e8
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebx]
lea eax, [ebp - 0x11c]
call fcn.004048d8
mov edx, dword [ebp - 0x11c]
mov eax, dword [0x549b80]
call fcn.004fc9a8
mov eax, 0x549b80
mov ecx, 0x4fea7c
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x540b9c]
mov edx, dword [edx]
mov eax, dword [0x549b80]
call fcn.004fc9a8
lea edx, [ebp - 0x124]
mov eax, 0x77
call fcn.004ab8e8
mov ecx, dword [ebp - 0x124]
mov eax, 0x549b80
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x540a64]
mov edx, dword [edx]
mov eax, dword [0x549b80]
call fcn.004fc9a8
lea edx, [ebp - 0x128]
mov eax, 0x78
call fcn.004ab8e8
mov ecx, dword [ebp - 0x128]
mov eax, 0x549b80
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x5405d0]
mov edx, dword [edx]
mov eax, dword [0x549b80]
call fcn.004fc9a8
lea edx, [ebp - 0x12c]
mov eax, 0x3e
call fcn.004ab8e8
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebx]
mov eax, 0x549b88
call fcn.004048d8
lea edx, [ebp - 0x130]
mov eax, 0x3e
call fcn.004ab8e8
mov ecx, dword [ebp - 0x130]
mov eax, 0x549b8c
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x549b88]
mov eax, dword [0x549b8c]
call fcn.004fc9a8
lea edx, [ebp - 0x134]
mov eax, 0x34
call fcn.004ab8e8
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebx]
mov eax, 0x549b88
call fcn.004048d8
lea edx, [ebp - 0x138]
mov eax, 0x34
call fcn.004ab8e8
mov ecx, dword [ebp - 0x138]
mov eax, 0x549b8c
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x549b88]
mov eax, dword [0x549b8c]
call fcn.004fc9a8
lea edx, [ebp - 0x13c]
mov eax, 0x3c
call fcn.004ab8e8
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebx]
mov eax, 0x549b88
call fcn.004048d8
lea edx, [ebp - 0x140]
mov eax, 0x3c
call fcn.004ab8e8
mov ecx, dword [ebp - 0x140]
mov eax, 0x549b8c
mov edx, dword [0x549b84]
call fcn.004048d8
mov edx, dword [0x549b88]
mov eax, dword [0x549b8c]
call fcn.004fc9a8
lea edx, [ebp - 0x144]
mov eax, 1
call fcn.004ab8e8
mov ecx, dword [ebp - 0x144]
mov eax, 0x549b7c
mov edx, dword [0x549b84]
call fcn.004048d8
push 0
mov eax, dword [0x549b7c]
call fcn.00404a84
mov esi, eax
push esi
mov eax, dword [0x549b78]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4fe37b
push 1
mov eax, 0x549b84
call fcn.00404adc
push eax
mov eax, dword [0x540af4]
mov eax, dword [eax]
call fcn.00404a84
push eax
push esi
push 0x4fea88
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4fe8e0
lea edx, [ebp - 0x148]
mov eax, 0x79
call fcn.004ab8e8
mov edx, dword [ebp - 0x148]
mov ecx, dword [0x540b34]
mov ecx, dword [ecx]
mov eax, dword [0x540de4]
call fcn.004048d8
lea edx, [ebp - 0x14c]
mov eax, 0x7a
call fcn.004ab8e8
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x150]
pop edx
call fcn.0046ce80
mov edx, dword [0x5406c0]
mov dword [edx], eax
call fcn.004f7774
mov eax, dword [0x5406c0]
cmp dword [eax], 0
jne 0x4fe697
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fe697
mov eax, dword [0x540ce0]
cmp byte [eax], 0
jne 0x4fe697
mov eax, dword [0x540554]
cmp dword [eax], 0
je 0x4fe525
mov eax, dword [0x540554]
mov eax, dword [eax]
call fcn.00462e40
test al, al
jne 0x4fe463
lea edx, [ebp - 0x154]
mov eax, 0x7c
call fcn.004ab8e8
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0046ce80
call fcn.004d9234
mov eax, dword [0x540554]
mov eax, dword [eax]
call fcn.00462e40
test al, al
je 0x4fe525
call fcn.004fcafc
test al, al
je 0x4fe525
lea edx, [ebp - 0x15c]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x15c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4fea98
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x160]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x160]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4feaac
pop eax
call fcn.0046cc5c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
add ebx, 0x7d0
jmp 0x4fe4ec
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
ja 0x4fe4e5
push 1
mov edx, dword [0x540820]
mov edx, dword [edx]
lea eax, [ebp - 0x164]
mov ecx, 0x4feac4
call fcn.004048d8
mov eax, dword [ebp - 0x164]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fe8e0
lea edx, [ebp - 0x16c]
mov eax, 0xb
call fcn.004ab8e8
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebx]
lea eax, [ebp - 0x168]
call fcn.004048d8
mov eax, dword [ebp - 0x168]
call fcn.0046dd44
test al, al
je 0x4fe697
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [0x549b90], eax
lea edx, [ebp - 0x178]
mov eax, 0xb
call fcn.004ab8e8
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebx]
lea eax, [ebp - 0x174]
call fcn.004048d8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
call fcn.00404e90
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [0x549b90]
push eax
call fcn.0046e05c
mov eax, dword [0x549b90]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4fe68d
mov eax, dword [0x549b90]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x4fe651
lea ecx, [ebp - 0x17c]
mov edx, esi
mov eax, dword [0x549b90]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x17c]
mov eax, 0x549b98
call fcn.0040460c
lea edx, [ebp - 0x180]
mov eax, 0xa
call fcn.004ab8e8
mov ecx, dword [ebp - 0x180]
mov eax, 0x549b94
mov edx, dword [0x549b98]
call fcn.004048d8
push 1
mov eax, 0x549b98
call fcn.00404adc
push eax
mov eax, 0x549b94
call fcn.00404adc
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4fe64b
mov edx, esi
mov eax, dword [0x549b90]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp esi, 0xffffffff
jne 0x4fe5d6
mov eax, dword [0x549b90]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4fe68d
lea edx, [ebp - 0x188]
mov eax, 0xb
call fcn.004ab8e8
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebx]
lea eax, [ebp - 0x184]
call fcn.004048d8
mov eax, dword [ebp - 0x184]
call fcn.00409988
mov eax, dword [0x549b90]
call fcn.004037ac
call fcn.004b108c
mov eax, dword [0x540910]
cmp byte [eax], 1
je 0x4fe6af
mov eax, dword [0x5407e8]
xor edx, edx
mov dword [eax], edx
cmp dword [0x5403f4], 0
jle 0x4fe6fb
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fe6fb
mov eax, dword [0x5403f4]
call fcn.004d9234
mov eax, dword [0x5407e8]
cmp dword [eax], 0
jle 0x4fe6fb
mov eax, dword [0x5407e8]
mov edx, dword [0x5403f4]
sub dword [eax], edx
mov eax, dword [0x5407e8]
cmp dword [eax], 0x7d0
jge 0x4fe6fb
mov eax, dword [0x5407e8]
mov dword [eax], 0x7d0
mov eax, dword [0x540a50]
mov dword [eax], 0x20
lea eax, [ebp - 0x18c]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x18c]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe778
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x190]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x190]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe7bb
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x194]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x194]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe7fe
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x198]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x198]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
call fcn.004037ac
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x5404ac]
mov dword [edx], eax
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00448198
call fcn.004ac15c
mov ecx, dword [0x540cc4]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4b6cfc]
call fcn.004481b0
mov ecx, dword [0x540a80]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4b5c6c]
call fcn.004481b0
mov edx, dword [0x540df4]
mov edx, dword [edx]
mov eax, dword [0x540cc4]
mov eax, dword [eax]
call fcn.004577bc
mov ecx, dword [0x5405a0]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4d603c]
call fcn.004481b0
mov edx, dword [0x540ae8]
mov edx, dword [edx]
mov eax, dword [0x5405a0]
mov eax, dword [eax]
call fcn.004577bc
mov ecx, dword [0x540720]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4aecf0]
call fcn.004481b0
mov eax, dword [0x5405a0]
mov eax, dword [eax]
mov edx, dword [0x540cc4]
mov edx, dword [edx]
mov dword [edx + 0x314], eax
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00448230
mov eax, dword [0x540844]
call fcn.0040e2f4
mov eax, 0x5403f0
call fcn.0040e2f4
mov eax, dword [0x54064c]
cmp byte [eax], 0
je 0x4fe92a
push 1
push 0x4feac8
push 0x4feac8
lea edx, [ebp - 0x19c]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.0044881c
mov eax, dword [ebp - 0x19c]
call fcn.00404a84
push eax
push 0x4feacc
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004b12b8
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe99a
lea eax, [ebp - 0x19c]
call fcn.004045b8
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0x188]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0x170]
call fcn.00404cf0
lea eax, [ebp - 0x16c]
mov edx, 0x57
call fcn.004045dc
ret