Function at 0x405500
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435130
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2b8
mov eax, dword [0x44301c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x1e0], edi
mov dword [ebp - 0x1f8], ecx
push 0
push 0
mov dword [ebp - 0x1f4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1e4], 0
push eax
push 0x437188
push 1
push 0
push 0x437198
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x4055bf
mov ecx, dword [ebp - 0x1e4]
test ecx, ecx
je 0x4056d8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor al, al
jmp 0x40666e
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x108]
movups xmm0, xmmword [ebp - 0xf0]
push eax
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x108]
lea eax, [ebp - 0x218]
push eax
movups xmmword [ebp - 0xd8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x218]
lea eax, [ebp - 0x208]
push eax
movups xmmword [ebp - 0x60], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x30]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x60]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x208]
push dword [ebp - 0x1e4]
movups xmmword [eax], xmm0
call esi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x1e4]
test esi, esi
jne 0x4055aa
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], esi
mov eax, dword [ecx]
push edx
push 0x43dba4
push ecx
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
jne 0x4056df
xor al, al
jmp 0x40666e
cmp byte [ebx + 0x10], 0
jne 0x406644
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1ec]
push edx
mov dword [ebp - 0x1ec], 0
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
lea ecx, [ebp - 0x1d8]
call fcn.00416370
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 4
call fcn.00405490
mov edi, eax
mov byte [ebp - 4], 5
cmp dword [edi + 0x14], 8
jb 0x405730
mov edi, dword [edi]
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x405735
sub esi, ecx
lea ecx, [ebp - 0x1d8]
sar esi, 1
call fcn.0040b800
lea ecx, [ebp - 0x1d8]
call fcn.0040b780
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
push eax
sub esp, 0x10
lea eax, [esi + esi]
lea ecx, [ebp - 0x204]
push eax
push edi
push edx
call fcn.0040b2a0
add esp, 0x20
cmp dword [ebp - 0x1d8], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
sete al
mov byte [ebp - 0x1d9], al
cmp ecx, 8
jb 0x4057d2
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4057c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40668c
push ecx
push edx
call fcn.00417ad7
mov al, byte [ebp - 0x1d9]
add esp, 8
test al, al
je 0x4057e2
mov byte [ebp - 0x1d9], 0
jmp 0x406610
push dword [ebp - 0x1f8]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x610054
sub esp, 0xc
mov dword [ebp - 0x4c], 0x6b0073
mov ecx, esp
mov dword [ebp - 0x48], 0x41002f
lea edx, [ebp - 0x50]
mov dword [ebp - 0x44], 0x740063
mov dword [ebp - 0x40], 0x6f0069
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x45002f
mov dword [ebp - 0x34], 0x650078
mov dword [ebp - 0x30], 0x2f0063
mov dword [ebp - 0x2c], 0x6f0043
mov dword [ebp - 0x28], 0x6d006d
mov dword [ebp - 0x24], 0x6e0061
mov dword [ebp - 0x20], 0x64
call fcn.00407400
lea ecx, [ebp - 0x68]
call fcn.00404fa0
add esp, 0xc
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x40586d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00416720
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x4058b7
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4058ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406691
push ecx
push edx
call fcn.00417ad7
add esp, 8
push 0x43dfc4
push str.Task_Settings_StopIfGoingOnBatteries
lea ecx, [ebp - 0x1d8]
call fcn.00416720
push 1
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
push 0x43dba4
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 0
movups xmmword [ebp - 0xc8], xmm0
call fcn.00403cd0
mov edi, dword [ebp - 0x1e0]
mov ecx, edi
mov byte [ebp - 4], 7
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405910
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xc8]
call fcn.00403c00
cmp dword [ebp - 0xb4], 8
lea esi, [ebp - 0xc8]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x610054
cmovae esi, dword [ebp - 0xc8]
lea edx, [ebp - 0x50]
sub esp, 0xc
mov dword [ebp - 0x4c], 0x6b0073
mov ecx, esp
mov dword [ebp - 0x48], 0x52002f
mov dword [ebp - 0x44], 0x670065
mov dword [ebp - 0x40], 0x730069
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x720074
mov dword [ebp - 0x38], 0x740061
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x49006e
mov dword [ebp - 0x2c], 0x66006e
mov dword [ebp - 0x28], 0x2f006f
mov dword [ebp - 0x24], 0x520055
mov dword [ebp - 0x20], 0x49
call fcn.00407400
lea ecx, [ebp - 0x68]
call fcn.00404fa0
add esp, 0xc
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x4059c5
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00416720
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x405a10
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405a06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406696
push ecx
push edx
call fcn.00417ad7
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
cmp byte [ebx + 0xc], cl
jne 0x405a44
push ecx
lea ecx, [ebp - 0x1d8]
call fcn.004166b0
sub esp, 0xc
mov dword [ebp - 0x40], 0x6e0049
mov ecx, esp
mov dword [ebp - 0x3c], 0x650074
lea eax, [ebp - 0x1e]
mov dword [ebp - 0x38], 0x610072
lea edx, [ebp - 0x40]
mov dword [ebp - 0x34], 0x740063
push ecx
push eax
push edx
mov dword [ebp - 0x30], 0x760069
mov dword [ebp - 0x2c], 0x540065
mov dword [ebp - 0x28], 0x6b006f
mov dword [ebp - 0x24], 0x6e0065
mov word [ebp - 0x20], 0
call fcn.00407400
lea ecx, [ebp - 0xe0]
call fcn.00404fa0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 9
cmp dword [esi + 0x14], 8
jb 0x405ab1
mov esi, dword [esi]
sub esp, 0xc
mov dword [ebp - 0xb0], 0x610054
mov ecx, esp
mov dword [ebp - 0xac], 0x6b0073
lea eax, [ebp - 0x68]
mov dword [ebp - 0xa8], 0x50002f
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xa4], 0x690072
push ecx
push eax
push edx
mov dword [ebp - 0xa0], 0x63006e
mov dword [ebp - 0x9c], 0x700069
mov dword [ebp - 0x98], 0x6c0061
mov dword [ebp - 0x94], 0x2f0073
mov dword [ebp - 0x90], 0x720050
mov dword [ebp - 0x8c], 0x6e0069
mov dword [ebp - 0x88], 0x690063
mov dword [ebp - 0x84], 0x610070
mov dword [ebp - 0x80], 0x2f006c
mov dword [ebp - 0x7c], 0x6f004c
mov dword [ebp - 0x78], 0x6f0067
mov dword [ebp - 0x74], 0x54006e
mov dword [ebp - 0x70], 0x700079
mov dword [ebp - 0x6c], 0x65
call fcn.00407400
lea ecx, [ebp - 0x68]
call fcn.00404fa0
add esp, 0xc
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
jb 0x405b80
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00416720
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x405bcb
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405bc1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40669b
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x405c23
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405c19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40669b
push ecx
push edx
call fcn.00417ad7
add esp, 8
cmp byte [ebx + 8], 0
je 0x405e0b
sub esp, 0xc
mov dword [ebp - 0x40], 0x690048
mov ecx, esp
mov dword [ebp - 0x3c], 0x680067
lea eax, [ebp - 0x1e]
mov dword [ebp - 0x38], 0x730065
lea edx, [ebp - 0x40]
mov dword [ebp - 0x34], 0x410074
push ecx
push eax
push edx
mov dword [ebp - 0x30], 0x610076
mov dword [ebp - 0x2c], 0x6c0069
mov dword [ebp - 0x28], 0x620061
mov dword [ebp - 0x24], 0x65006c
mov word [ebp - 0x20], 0
call fcn.00407400
lea ecx, [ebp - 0xe0]
call fcn.00404fa0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 8
jb 0x405c9a
mov esi, dword [esi]
sub esp, 0xc
mov dword [ebp - 0xb0], 0x610054
mov ecx, esp
mov dword [ebp - 0xac], 0x6b0073
lea eax, [ebp - 0x6a]
mov dword [ebp - 0xa8], 0x50002f
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xa4], 0x690072
push ecx
push eax
push edx
mov dword [ebp - 0xa0], 0x63006e
mov dword [ebp - 0x9c], 0x700069
mov dword [ebp - 0x98], 0x6c0061
mov dword [ebp - 0x94], 0x2f0073
mov dword [ebp - 0x90], 0x720050
mov dword [ebp - 0x8c], 0x6e0069
mov dword [ebp - 0x88], 0x690063
mov dword [ebp - 0x84], 0x610070
mov dword [ebp - 0x80], 0x2f006c
mov dword [ebp - 0x7c], 0x750052
mov dword [ebp - 0x78], 0x4c006e
mov dword [ebp - 0x74], 0x760065
mov dword [ebp - 0x70], 0x6c0065
mov word [ebp - 0x6c], 0
call fcn.00407400
lea ecx, [ebp - 0x68]
call fcn.00404fa0
add esp, 0xc
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x405d68
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00416720
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x405db3
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405da9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066a0
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x405e0b
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405e01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066a0
push ecx
push edx
call fcn.00417ad7
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
push ecx
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0xd
call fcn.00407050
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x214], 0x43e94c
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], eax
push 8
push ecx
push 0x43eb60
lea eax, [ebp - 0x214]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0040b870
mov dword [ebp - method.pugi::xml_writer.virtual_0], vtable.pugi::xml_writer.0
mov byte [ebp - 4], 0x10
xor eax, eax
mov edx, dword [ebp - 0x274]
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
mov word [ebp - 0x68], ax
mov dword [ebp - 0x1fc], eax
mov eax, edx
and al, 0x22
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x1f4], 4
movq qword [ebp - 0x204], xmm0
cmp al, 2
je 0x405ef2
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
test ecx, ecx
je 0x405ef2
cmp ecx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x2a0]
cmovb ecx, dword [ebp - 0x278]
mov edx, dword [eax]
sub ecx, edx
sar ecx, 1
jmp 0x405f28
test dl, 4
jne 0x405f1c
mov eax, dword [ebp - 0x294]
mov ecx, dword [eax]
test ecx, ecx
je 0x405f1c
mov eax, dword [ebp - 0x2a4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x284]
mov eax, dword [eax]
lea ecx, [ecx + eax*2]
sub ecx, edx
sar ecx, 1
jmp 0x405f28
mov ecx, dword [ebp - 0x200]
mov edx, dword [ebp - 0x204]
test edx, edx
je 0x405f36
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.00403ab0
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c8]
xor edx, edx
push 0
mov dword [ebp - 0x1f4], 3
add ecx, dword [eax + 4]
mov eax, 4
cmp dword [ecx + 0x38], edx
cmovne eax, edx
push eax
call fcn.00404e50
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0xd
call fcn.004050c0
mov ecx, dword [ebp - 0xb4]
cmp ecx, 8
jb 0x405fba
mov edx, dword [ebp - 0xc8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405fb0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066a5
push ecx
push edx
call fcn.00417ad7
add esp, 8
movups xmm1, xmmword [ebp - 0x68]
lea ecx, [ebp - 0xc8]
movq xmm0, qword [ebp - 0x58]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x1ec]
movq qword [ebp - 0xb8], xmm0
cmp dword [ebp - 0xb4], 8
movups xmmword [ebp - 0xc8], xmm1
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
movd eax, xmm1
cmovae ecx, eax
push ecx
push esi
call edx
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1f0], ecx
mov eax, dword [eax]
mov esi, dword [eax + 0x44]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x208]
lea eax, [ebp - 0x108]
push eax
movups xmmword [ebp - 0x60], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x108]
lea eax, [ebp - 0xf0]
push eax
movups xmmword [ebp - 0xd8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1f0]
movups xmm0, xmmword [ebp - 0x60]
push eax
sub esp, 0x10
mov eax, esp
push 0
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xf0]
push 6
push dword [ebp - 0x1ec]
movups xmmword [eax], xmm0
push 0
push dword [ebp - 0x1e8]
call esi
mov esi, eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 7
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x1f0]
test ecx, ecx
je 0x4060fd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1f0], 0
mov ecx, dword [ebp - 0x1ec]
test ecx, ecx
je 0x406117
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1ec], 0
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
je 0x406131
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1e8], 0
test esi, esi
js 0x406141
mov byte [ebp - 0x1d9], 1
jmp 0x4065af
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406146
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xc8]
call fcn.00403ab0
push 4
push str..xml
lea ecx, [ebp - 0xc8]
call fcn.00403c00
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
lea ecx, [ebp - 0x1d8]
cmovae eax, dword [ebp - 0xc8]
push eax
call fcn.00416500
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
push str._create__F__TN__
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xcc], 0
movups xmmword [ebp - 0xe0], xmm0
call fcn.00403cd0
mov ecx, edi
mov byte [ebp - 4], 0x14
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4061d0
sub ecx, edx
mov eax, 0x7ffffffe
mov edx, dword [ebp - 0xd0]
sub eax, edx
sar ecx, 1
cmp eax, ecx
jb 0x4066aa
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push ecx
cmovae eax, dword [ebp - 0xe0]
push edi
push edx
push eax
push ecx
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x110]
call fcn.00408490
push 9
push 0x43e06c
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x15
call fcn.00403c00
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 8
lea ecx, [ebp - 0x34]
push dword [ebp - 0xb8]
cmovae eax, dword [ebp - 0xc8]
push eax
call fcn.00403c00
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x54], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x68], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x58], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x43e068
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x17
call fcn.00403c00
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xf8], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0xe0]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0xf8]
push eax
movq qword [ebp - 0xe8], xmm0
call fcn.004074d0
mov ecx, dword [ebp - 0xe4]
cmp ecx, 8
jb 0x40635c
mov edx, dword [ebp - 0xf8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406352
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066af
push ecx
push edx
call fcn.00417ad7
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x40639a
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406390
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066af
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x4063ec
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4063e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066af
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp ecx, 8
jb 0x406444
mov edx, dword [ebp - 0x110]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40643a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066af
push ecx
push edx
call fcn.00417ad7
add esp, 8
cmp dword [ebp - 0xcc], 8
lea esi, [ebp - 0xe0]
lea eax, [ebp - 0x52]
mov dword [ebp - 0x64], 0x630073
cmovae esi, dword [ebp - 0xe0]
lea edx, [ebp - 0x64]
sub esp, 0xc
mov dword [ebp - 0x60], 0x740068
mov ecx, esp
mov dword [ebp - 0x5c], 0x730061
mov dword [ebp - 0x58], 0x73006b
mov word [ebp - 0x54], 0
push ecx
push eax
push edx
call fcn.00407400
lea ecx, [ebp - 0x34]
call fcn.00404fa0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4064a0
mov eax, dword [eax]
push 0
push 0
push esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x20]
cmp ecx, 8
jb 0x4064ed
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4064e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066b4
push ecx
push edx
call fcn.00417ad7
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
cmovae eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xd0], 0
cmovae eax, dword [ebp - 0xe0]
xor ecx, ecx
mov byte [ebp - 0x1d9], cl
mov word [eax], cx
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 8
mov dword [ebp - 0xb8], ecx
cmovae eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 7
mov word [eax], cx
mov ecx, dword [ebp - 0xcc]
cmp ecx, 8
jb 0x406592
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406588
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066b9
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xb4]
cmp ecx, 8
jb 0x4065f3
mov edx, dword [ebp - 0xc8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4065e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066b9
push ecx
push edx
call fcn.00417ad7
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 4], 0x18
call fcn.0040b800
lea ecx, [ebp - 0x1d8]
call fcn.0040b780
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x19
call fcn.0040b800
mov al, byte [ebp - 0x1d9]
jmp 0x40666e
mov eax, dword [ecx]
push 0
push edi
push ecx
call dword [eax + 0x3c]
mov edx, dword [ebp - 0x1e8]
mov dword [ebp - 0x1e0], eax
test edx, edx
je 0x406669
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov eax, dword [ebp - 0x1e0]
shr eax, 0x1f
xor al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00417848
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.004011c0
call fcn.0041d4bc
call fcn.0041d4bc
call fcn.0041d4bc
int3