Function at 0x40e7f0
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4aed
mov eax, dword fs:[0]
push eax
mov eax, 0xa950
call fcn.004a7530
mov eax, dword [0x51eee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xa920]
mov dword [ebp - 0xa910], eax
call fcn.00442860
push str.success
lea ecx, [ebp - 0xa90c]
mov dword [ebp - 4], 0
call fcn.00442820
lea eax, [ebp - 0xa90c]
push eax
push 0x4d968c
lea ecx, [ebp - 0xa920]
mov byte [ebp - 4], 1
call fcn.00442d00
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0xa90c]
mov byte [ebp - 4], 0
call fcn.00442a70
mov edi, dword [0x520340]
lea ecx, [edi + 1]
lea eax, [edi + 2]
imul eax, ecx
imul eax, edi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 5
jne 0x40e908
mov eax, edi
cdq
sub eax, edx
xor ecx, ecx
mov ebx, eax
sar ebx, 1
mov esi, 0xac
mov dword [ebp - 0xa8dc], ecx
mov dword [ebp - 0xa8e4], ebx
jmp 0x40e8c0
test ebx, ebx
jle 0x40e8fd
mov eax, edi
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
xor edx, edx
test edi, edi
jle 0x40e8ec
mov eax, edx
mov ecx, edi
lea ebx, [ebx]
add esi, eax
dec eax
dec ecx
jne 0x40e8e0
mov ecx, dword [ebp - 0xa8dc]
add edx, ecx
dec ebx
jne 0x40e8d2
mov ebx, dword [ebp - 0xa8e4]
mov edi, dword [0x520340]
inc ecx
mov dword [ebp - 0xa8dc], ecx
cmp ecx, esi
jl 0x40e8c0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004a7560
add esp, 0xc
call fcn.00417940
test al, al
jne 0x40e958
mov eax, 0x2e
mov esi, 0xcc
lea esp, [esp]
test esi, esi
je 0x40e951
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x40e940
add eax, esi
mov dword [0x520340], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8ec], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa8ec]
push str.__s_
push eax
mov byte [ebp - 4], 2
call fcn.00406160
add esp, 0xc
call fcn.00417c50
test al, al
jne 0x40e9b0
inc dword [0x5205d8]
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8e0], eax
push 0xb
push str._echo_off_r_n
lea ecx, [ebp - 0xa8e0]
mov byte [ebp - 4], 3
call fcn.0040b980
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
mov eax, str._GOTO_END_r_n
shr eax, 0x10
mov byte [ebp - 4], 4
mov dword [ebp - 0xa8fc], eax
mov ecx, str._GOTO_END_r_n
test eax, eax
jne 0x40ea2d
movzx esi, cx
push eax
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40ea3f
push esi
push eax
lea ecx, [ebp - 0xa8dc]
call fcn.00407650
jmp 0x40ea3f
push 0xb
push str._GOTO_END_r_n
lea ecx, [ebp - 0xa8dc]
call fcn.00409950
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8e4], eax
mov eax, str.IF_NOT_EXIST
shr eax, 0x10
mov byte [ebp - 4], 6
mov dword [ebp - 0xa8f4], eax
mov ecx, str.IF_NOT_EXIST
test eax, eax
jne 0x40ea94
movzx esi, cx
push eax
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40eaa6
push esi
push eax
lea ecx, [ebp - 0xa8e4]
call fcn.00407650
jmp 0x40eaa6
push 0xd
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xa8e4]
call fcn.00409950
lea eax, [ebp - 0xa8ec]
push eax
lea eax, [ebp - 0xa8e4]
push eax
lea eax, [ebp - 0xa8f0]
push eax
mov byte [ebp - 4], 7
call fcn.0040b660
lea ecx, [ebp - 0xa8dc]
push ecx
push eax
lea eax, [ebp - 0xa8f8]
push eax
mov byte [ebp - 4], 8
call fcn.0040b660
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xa8e0]
push dword [eax - 0xc]
mov byte [ebp - 4], 9
push eax
call fcn.0040b980
mov edx, dword [ebp - 0xa8f8]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 8
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40eb1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8f0]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eb3d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8e4]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eb60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eb83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xc
push str.SET__a_i0_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
push 9
push str.:REPEAT_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
push 0x16
push str.IF__i_100_GOTO_END_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
mov ebx, dword [0x520340]
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 9
idiv ecx
cmp edx, 5
jne 0x40ec35
mov eax, ebx
cdq
sub eax, edx
xor ecx, ecx
mov ebx, eax
sar ebx, 1
mov esi, 0xd8
mov dword [ebp - 0xa8dc], ecx
mov dword [ebp - 0xa8f0], ebx
lea ecx, [ecx]
test ebx, ebx
jle 0x40ec27
mov eax, dword [0x520340]
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
xor edx, edx
test edi, edi
jle 0x40ec1c
mov eax, edx
mov ecx, edi
lea ecx, [ecx]
add esi, eax
dec eax
dec ecx
jne 0x40ec10
mov ecx, dword [ebp - 0xa8dc]
add edx, ecx
dec ebx
jne 0x40ec05
mov ebx, dword [ebp - 0xa8f0]
inc ecx
mov dword [ebp - 0xa8dc], ecx
cmp ecx, esi
jl 0x40ebf0
or edi, 0xffffffff
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8e4], eax
mov eax, 0x4daedc
mov byte [ebp - 4], 0xa
test eax, 0xffff0000
jne 0x40ec7c
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40ec8e
push esi
push eax
lea ecx, [ebp - 0xa8e4]
call fcn.00407650
jmp 0x40ec8e
push 2
push 0x4daedc
lea ecx, [ebp - 0xa8e4]
call fcn.00409950
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 0xb
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
mov eax, str.DEL
mov byte [ebp - 4], 0xc
test eax, 0xffff0000
jne 0x40ecd9
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40eceb
push esi
push eax
lea ecx, [ebp - 0xa8dc]
call fcn.00407650
jmp 0x40eceb
push 4
push str.DEL
lea ecx, [ebp - 0xa8dc]
call fcn.00409950
lea eax, [ebp - 0xa8ec]
push eax
lea eax, [ebp - 0xa8dc]
push eax
lea eax, [ebp - 0xa8f8]
push eax
mov byte [ebp - 4], 0xd
call fcn.0040b660
lea ecx, [ebp - 0xa8e4]
push ecx
push eax
lea eax, [ebp - 0xa8f0]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040b660
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xa8e0]
push dword [eax - 0xc]
mov byte [ebp - 4], 0xf
push eax
call fcn.0040b980
mov edx, dword [ebp - 0xa8f0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ed5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8f8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ed7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xb
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eda2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8e4]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40edc5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8e4], eax
cmp dword [ebp - 0xa8fc], 0
mov byte [ebp - 4], 0x10
jne 0x40ee0e
mov eax, str._GOTO_END_r_n
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40ee20
push esi
push eax
lea ecx, [ebp - 0xa8e4]
call fcn.00407650
jmp 0x40ee20
push 0xb
push str._GOTO_END_r_n
lea ecx, [ebp - 0xa8e4]
call fcn.00409950
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 0x11
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
cmp dword [ebp - 0xa8f4], 0
mov byte [ebp - 4], 0x12
jne 0x40ee6d
mov eax, str.IF_NOT_EXIST
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40ee7f
push esi
push eax
lea ecx, [ebp - 0xa8dc]
call fcn.00407650
jmp 0x40ee7f
push 0xd
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xa8dc]
call fcn.00409950
lea eax, [ebp - 0xa8ec]
push eax
lea eax, [ebp - 0xa8dc]
push eax
lea eax, [ebp - 0xa8f8]
push eax
mov byte [ebp - 4], 0x13
call fcn.0040b660
lea ecx, [ebp - 0xa8e4]
push ecx
push eax
lea eax, [ebp - 0xa8f0]
push eax
mov byte [ebp - 4], 0x14
call fcn.0040b660
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xa8e0]
push dword [eax - 0xc]
mov byte [ebp - 4], 0x15
push eax
call fcn.0040b980
mov edx, dword [ebp - 0xa8f0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x14
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eef0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8f8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ef13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ef36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8e4]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ef59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x21
push str.ping_1.1.1.1__n_1__w_1000___nul_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
push 0x10
push str.SET__a_i_i_1_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
push 0xd
push str.GOTO_REPEAT_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
mov ecx, dword [0x520340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xe
idiv ecx
cmp edx, 3
jne 0x40efc6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 6
push str.:END_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
mov esi, dword [0x520340]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 7
idiv ecx
cmp edx, 2
jne 0x40effe
dec esi
mov dword [0x520340], esi
push 8
push str.DEL__0_r_n
lea ecx, [ebp - 0xa8e0]
call fcn.0040b980
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a7560
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
jne 0x40f0e5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
push 0x2b
push str.createDeleteSelfBatchFile_error_GetTempPath
lea ecx, [ebp - 0xa8dc]
mov byte [ebp - 4], 0x16
call fcn.00409950
lea eax, [ebp - 0xa8dc]
push eax
lea eax, [ebp - 0xa8b8]
push eax
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0xa90c]
mov byte [ebp - 4], 0x17
call fcn.00442780
lea eax, [ebp - 0xa90c]
push eax
push 0x4d968c
lea ecx, [ebp - 0xa920]
mov byte [ebp - 4], 0x18
call fcn.00442d00
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0xa90c]
mov byte [ebp - 4], 0x17
call fcn.00442a70
cmp dword [ebp - 0xa8a4], 0x10
jb 0x40f0da
push dword [ebp - 0xa8b8]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0xa8dc]
jmp 0x40f59d
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8e8], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x19
test eax, 0xffff0000
jne 0x40f123
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40f152
push esi
push eax
lea ecx, [ebp - 0xa8e8]
call fcn.00407650
jmp 0x40f152
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f130
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa8e8]
call fcn.00409950
mov byte [ebp - 4], 0x1a
call fcn.004179a0
test al, al
jne 0x40f1d0
mov esi, dword [0x520340]
mov eax, 0x891ac73b
imul esi
add edx, esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0xef
mov eax, esi
sub eax, ecx
xor edi, edi
cmp eax, 0x9e
je 0x40f1c7
jmp 0x40f190
mov eax, esi
or eax, 0xffffff7b
add esi, eax
mov eax, esi
imul eax, esi
inc edi
cmp edi, eax
jg 0x40f1c7
mov eax, 0x891ac73b
imul esi
add edx, esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0xef
mov eax, esi
sub eax, ecx
cmp eax, 0x9e
jne 0x40f190
mov dword [0x520340], edi
or edi, 0xffffffff
mov eax, dword [ebp - 0xa8e8]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x40f8fa
cmp ecx, edx
jg 0x40f8fa
cmp word [eax + ecx*2], 0x5c
je 0x40f205
push 1
push 0x4d95f8
lea ecx, [ebp - 0xa8e8]
call fcn.0040b980
lea eax, [ebp - 0xa8fc]
push eax
call fcn.0044f130
push str..bat
push eax
lea eax, [ebp - 0xa8f4]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0040b720
add esp, 0x10
mov eax, dword [eax]
lea ecx, [ebp - 0xa8e8]
push dword [eax - 0xc]
mov byte [ebp - 4], 0x1c
push eax
call fcn.0040b980
mov edx, dword [ebp - 0xa8f4]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f262
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8fc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f285
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00417b30
test al, al
jne 0x40f2b2
mov esi, dword [0x520340]
mov ecx, 1
cmp esi, ecx
jle 0x40f2ac
lea ecx, [ecx]
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x40f2a0
mov dword [0x520340], ecx
lea eax, [ebp - 0xa8e0]
push eax
lea eax, [ebp - 0xa8b8]
push eax
call fcn.0044ef60
add esp, 8
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 0x1d
jb 0x40f2d6
mov esi, dword [esi]
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x40f32d
test esi, 0xffff0000
jne 0x40f31d
movzx esi, si
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x40f33c
push esi
push eax
lea ecx, [ebp - 0xa8dc]
call fcn.0040bdf0
jmp 0x40f33c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f322
sub ecx, edx
jmp 0x40f32f
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0xa8dc]
call fcn.0040c240
lea eax, [ebp - 0xa8dc]
push eax
lea eax, [ebp - 0xa8e8]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00434d50
mov edx, dword [ebp - 0xa8dc]
add esp, 8
test al, al
sete bl
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1d
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f37e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xa8a4], 0x10
mov byte [ebp - 4], 0x1a
jb 0x40f399
push dword [ebp - 0xa8b8]
call fcn.004a5bbe
add esp, 4
test bl, bl
je 0x40f46d
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8dc], eax
mov byte [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa8dc]
push str.createDeleteSelfBatchFile_error_WriteToFile__d
push eax
call fcn.00406160
lea eax, [ebp - 0xa8dc]
push eax
lea eax, [ebp - 0xa8b8]
push eax
call fcn.0044ef60
add esp, 0x14
push eax
lea ecx, [ebp - 0xa90c]
mov byte [ebp - 4], 0x21
call fcn.00442780
lea eax, [ebp - 0xa90c]
push eax
push 0x4d968c
lea ecx, [ebp - 0xa920]
mov byte [ebp - 4], 0x22
call fcn.00442d00
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0xa90c]
mov byte [ebp - 4], 0x21
call fcn.00442a70
cmp dword [ebp - 0xa8a4], 0x10
jb 0x40f441
push dword [ebp - 0xa8b8]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0xa8dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40f597
push 0x3c
lea eax, [ebp - 0xa95c]
push 0
push eax
call fcn.004a7560
mov edx, dword [0x520340]
mov eax, dword [ebp - 0xa8e8]
mov dword [ebp - 0xa94c], eax
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xa
idiv ecx
add esp, 0xc
mov dword [ebp - 0xa95c], 0x3c
mov dword [ebp - 0xa950], str.open
mov dword [ebp - 0xa940], 0
mov dword [ebp - 0xa958], 0x440
cmp edx, 8
jne 0x40f4f1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebp - 0xa95c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.004177a0
mov ebx, 4
test al, al
jne 0x40f548
mov esi, dword [0x520340]
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a5340
push eax
call fcn.004a7190
add esp, 8
mov esi, dword [0x520340]
mov ecx, 0x12
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
cmp edx, 3
jne 0x40f597
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a5340
push eax
call fcn.004a7190
add esp, 8
mov edx, dword [ebp - 0xa8e8]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f5ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8e0]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f5dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa8ec]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f600
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004179a0
test al, al
jne 0x40f67e
xor eax, eax
push 0xa686
push eax
mov word [ebp - 0xa8a0], ax
lea eax, [ebp - 0xa89e]
push eax
call fcn.004a7560
add esp, 0xc
xor edi, edi
xor esi, esi
jmp 0x40f630
xor edx, edx
test edi, edi
je 0x40f65a
test edx, edx
je 0x40f65a
lea eax, [esi + edx]
lea ecx, [ebp - 0xa8a0]
lea ecx, [ecx + eax*2]
lea eax, [esi + edx]
mov ax, word [ebp + eax*2 - 0xa9c4]
inc ax
add ax, word [ecx - 2]
mov word [ecx], ax
inc edx
cmp edx, 0x92
jl 0x40f632
add esi, 0x92
inc edi
cmp esi, 0x5344
jl 0x40f630
movsx eax, word [ebp - 0x21a]
mov dword [0x520340], eax
lea ecx, [ebp - 0xa8d8]
call fcn.004449b0
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 0x23
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xa8dc], esi
lea eax, [ebp - 0xa920]
push eax
lea eax, [ebp - 0xa8b8]
push eax
lea ecx, [ebp - 0xa8d8]
mov byte [ebp - 4], 0x24
call fcn.004478c0
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x25
jb 0x40f6ce
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x40f6ed
xor ecx, ecx
jmp 0x40f6fb
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f6f2
sub ecx, ebx
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0xa8f4]
push eax
call fcn.0044ee90
add esp, 0x1c
mov eax, dword [eax]
lea ebx, [esi - 0x10]
lea edi, [eax - 0x10]
mov byte [ebp - 4], 0x26
cmp edi, ebx
je 0x40f7d0
cmp dword [ebx + 0xc], 0
jl 0x40f7bb
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x40f7bb
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x40f75c
cmp ecx, dword [edi]
jne 0x40f75c
mov esi, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40f799
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x40f770
call fcn.0040c2e0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004a7195
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40f7b0
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0xa8dc], esi
jmp 0x40f7d0
push dword [eax - 0xc]
lea ecx, [ebp - 0xa8dc]
push eax
call fcn.00409950
mov esi, dword [ebp - 0xa8dc]
mov edx, dword [ebp - 0xa8f4]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x25
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f7f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xa8a4], 0x10
mov byte [ebp - 4], 0x24
jb 0x40f811
push dword [ebp - 0xa8b8]
call fcn.004a5bbe
add esp, 4
mov edi, dword [ebp - 0xa910]
mov eax, 8
mov word [edi], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40f832
call fcn.0040c2e0
mov dword [edi + 8], eax
mov edi, dword [0x520340]
mov eax, edi
imul eax, edi
cdq
mov ecx, 0x11
idiv ecx
cmp edx, 0xe
jne 0x40f866
lea ecx, [edx - 0xd]
cmp edi, ecx
jle 0x40f860
mov eax, edi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, edi
jl 0x40f854
mov dword [0x520340], ecx
add esi, 0xfffffff0
mov byte [ebp - 4], 0x23
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x40f881
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xa8c0], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0xa8d8], 0x4d9684
jb 0x40f8a6
push dword [ebp - 0xa8d4]
call fcn.004a5bbe
add esp, 4
lea ecx, [ebp - 0xa8d8]
mov dword [ebp - 0xa8c0], 0xf
mov dword [ebp - 0xa8c4], 0
mov byte [ebp - 0xa8d4], 0
call fcn.00444ab0
lea ecx, [ebp - 0xa920]
mov dword [ebp - 4], 0xffffffff
call fcn.00442a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a63c4
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00404480
int3