Function at 0x41d040
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x24e4
call fcn.00436600
mov eax, dword [0x4747974]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, 0xa
je 0x41d0d9
mov eax, dword [0x32fb544]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0xc8c8
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x4741af4]
mov ecx, dword [0x4741aec]
mov edx, eax
sub edx, ecx
push edx
mov edx, dword [0x4741af0]
push edx
push ecx
mov ecx, dword [0x4741af8]
lea edx, [esp + 0x4c]
push ecx
push eax
push str.___d_______d_____d_____d_____d
push edx
call fcn.004361ae
lea edi, [esp + 0x5c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x40]
push ecx
push eax
push 0xb4
push ebp
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x32fb544]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x47404fc]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, ebx
je 0x41d11c
mov eax, dword [0x4747978]
inc eax
cmp eax, 0x190
mov dword [0x4747978], eax
jle 0x41d11c
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 1
push 0x45
push 0x7e
call esi
push 0x32
call edi
push ebx
push 3
push 0x45
push 0x7e
call esi
mov dword [0x4747978], ebx
mov eax, dword [0x4741b10]
cmp eax, ebx
je 0x41d13c
inc eax
cmp eax, 0x14
mov dword [0x4741b10], eax
jle 0x41d13c
mov dword [0x4741b10], ebx
mov dword [0x4741b0c], ebx
cmp dword [0x4741c5c], ebx
je 0x41d165
xor esi, esi
cmp dword [0x4741c2c], ebx
je 0x41d15a
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x41d146
jmp 0x41d15f
call fcn.00406ab0
mov dword [0x4741c5c], ebx
cmp dword [0x4741c60], ebx
je 0x41d18e
xor esi, esi
cmp dword [0x4741c30], ebx
je 0x41d183
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x41d16f
jmp 0x41d188
call fcn.00406b50
mov dword [0x4741c60], ebx
mov eax, dword [0x4742958]
mov esi, 2
cmp eax, 1
jne 0x41d1a8
mov dword [0x4742958], esi
call fcn.0040bf50
mov ecx, dword [0x4742954]
mov eax, 1
cmp ecx, eax
mov edi, 4
jne 0x41d5fd
mov ecx, dword [0x47b534]
mov dword [0x4742954], esi
cmp ecx, ebx
je 0x41d2d7
cmp dword [0x474295c], ebx
jne 0x41d2d7
cmp dword [0x4741c40], ebx
je 0x41d2d7
mov dword [0x474295c], eax
mov dword [0x1f80f00], eax
mov eax, dword [0x47b52c]
mov dword [0x4742960], ebx
cmp eax, ebx
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x72], bx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], 0x173
mov dword [esp + 0x6c], edi
mov word [esp + 0x70], bp
jl 0x41d25d
mov ecx, dword [0x47b530]
cmp ecx, ebx
jl 0x41d25d
mov edx, dword [0x19cc794]
add edx, 0xffffff60
cmp eax, edx
jg 0x41d25d
mov eax, dword [0x19cc798]
add eax, 0xffffff88
cmp ecx, eax
jle 0x41d269
mov dword [0x47b52c], ebx
mov dword [0x47b530], ebx
push str.Veb.exe
push 0x4959f8
lea ecx, [esp + 0x574]
push str._s_s
push ecx
call fcn.004361ae
mov edx, dword [0x47b530]
mov eax, dword [0x47b52c]
push edx
push eax
push str.Veb.exe
push 0x4959f8
lea ecx, [esp + 0x18c]
push str.__s_s___d__d_TIMER
push ecx
call fcn.004361ae
add esp, 0x28
lea edx, [esp + 0x10]
lea eax, [esp + 0x40]
lea ecx, [esp + 0x16c]
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x58c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x4742960]
cmp eax, 1
je 0x41d2e5
cmp eax, esi
jne 0x41d2fb
cmp dword [0x474295c], ebx
jne 0x41d2fb
cmp dword [0x4741c40], ebx
je 0x41d2fb
mov dword [0x474295c], edi
mov al, byte [0x47b549]
test al, al
je 0x41d311
cmp dword [0x4741c2c], ebx
jne 0x41d311
call fcn.00406ab0
mov al, byte [0x47b551]
test al, al
je 0x41d327
cmp dword [0x4741c30], ebx
jne 0x41d327
call fcn.00406b50
mov eax, dword [0x47b538]
mov esi, dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_MoveWindow]
cmp eax, ebx
je 0x41d421
cmp dword [0x4740564], ebx
jne 0x41d421
mov eax, dword [0x47404b0]
push ebx
cmp eax, ebx
push fcn.00422a60
jne 0x41d375
mov eax, dword [0x32fb544]
mov ecx, dword [0x3ecde54]
push eax
push 0x48326c
push ecx
jmp 0x41d387
mov edx, dword [0x32fb544]
mov eax, dword [0x3ecde54]
push edx
push 0x483258
push eax
call esi
mov ecx, dword [0x32fb544]
push 8
push 0xe0
push ecx
mov dword [0x4740564], eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x4740564]
lea edx, [esp + 0x10]
push edx
push eax
call edi
mov eax, dword [0x47b51c]
cmp eax, ebx
jl 0x41d3e3
mov ecx, dword [0x47b520]
cmp ecx, ebx
jl 0x41d3e3
mov edx, dword [0x19cc794]
add edx, 0xffffffe2
cmp eax, edx
jg 0x41d3e3
mov edx, dword [0x19cc798]
add edx, 0xffffffe2
cmp ecx, edx
jle 0x41d3f5
mov eax, 0xa
mov ecx, eax
mov dword [0x47b51c], eax
mov dword [0x47b520], ecx
mov edx, dword [esp + 0x1c]
push ebx
sub edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
push edx
push ecx
push eax
mov eax, dword [0x4740564]
push eax
call ebp
mov ecx, dword [0x4740564]
push ebx
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [0x47b53c], ebx
je 0x41d5ef
cmp dword [0x47428c8], ebx
jne 0x41d5ef
mov eax, dword [0x474051c]
cmp eax, ebx
mov eax, dword [0x474058c]
je 0x41d48c
cmp eax, 0x100
jne 0x41d48c
mov eax, dword [0x47404b0]
push ebx
cmp eax, ebx
push fcn.0041f970
jne 0x41d474
mov edx, dword [0x32fb544]
mov eax, dword [0x3ecde54]
push edx
push str.IDD_DIALOG111
push eax
jmp 0x41d571
mov ecx, dword [0x32fb544]
mov edx, dword [0x3ecde54]
push ecx
push 0x483234
push edx
jmp 0x41d571
cmp dword [0x4740588], ebx
jne 0x41d53b
cmp eax, 1
je 0x41d53b
cmp eax, ebx
jne 0x41d4ad
cmp dword [0x4740590], ebx
je 0x41d50b
cmp dword [0x474059c], ebx
je 0x41d50b
mov eax, dword [0x47bb10]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
xor ecx, ecx
mov cx, word [eax + edx*2 + 0x4ede61]
mov eax, dword [0x47baf0]
cmp ecx, eax
jne 0x41d50b
mov eax, dword [0x47404b0]
push ebx
cmp eax, ebx
push fcn.0041f970
jne 0x41d4f6
mov edx, dword [0x32fb544]
mov eax, dword [0x3ecde54]
push edx
push str.IDD_DIALOG1111
push eax
jmp 0x41d571
mov ecx, dword [0x32fb544]
mov edx, dword [0x3ecde54]
push ecx
push 0x483210
push edx
jmp 0x41d571
mov eax, dword [0x47404b0]
push ebx
cmp eax, ebx
push fcn.0041f970
jne 0x41d527
mov eax, dword [0x32fb544]
push eax
push str.IDD_DIALOG1
jmp 0x41d56a
mov edx, dword [0x32fb544]
mov eax, dword [0x3ecde54]
push edx
push 0x4831f4
push eax
jmp 0x41d571
mov eax, dword [0x47404b0]
push ebx
cmp eax, ebx
push fcn.0041f970
jne 0x41d55f
mov ecx, dword [0x32fb544]
mov edx, dword [0x3ecde54]
push ecx
push str.IDD_DIALOG11
push edx
jmp 0x41d571
mov eax, dword [0x32fb544]
push eax
push 0x4831d0
mov ecx, dword [0x3ecde54]
push ecx
call esi
lea edx, [esp + 0x10]
mov dword [0x47428c8], eax
push edx
push eax
call edi
mov eax, dword [0x47b524]
cmp eax, ebx
jl 0x41d5ad
mov ecx, dword [0x47b528]
cmp ecx, ebx
jl 0x41d5ad
mov edx, dword [0x19cc794]
add edx, 0xffffffe2
cmp eax, edx
jg 0x41d5ad
mov edx, dword [0x19cc798]
add edx, 0xffffffe2
cmp ecx, edx
jle 0x41d5bf
mov eax, 0xa
mov ecx, eax
mov dword [0x47b524], eax
mov dword [0x47b528], ecx
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
sub edx, edi
mov edi, dword [esp + 0x10]
push ebx
push edx
mov edx, dword [esp + 0x20]
sub edx, edi
push edx
push ecx
push eax
mov eax, dword [0x47428c8]
push eax
call ebp
mov ecx, dword [0x47428c8]
push ebx
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.00415770
mov eax, dword [0x474797c]
inc eax
cmp eax, 4
mov dword [0x474797c], eax
jle 0x41d6e4
mov edx, dword [0x32fb544]
push ebx
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x474796c]
mov edx, dword [0x4747988]
mov ecx, dword [0x4747984]
cmp eax, ebx
mov dword [0x474798c], edx
mov dword [0x4747988], ecx
mov dword [0x4747984], eax
je 0x41d688
cmp ecx, ebx
je 0x41d688
cmp edx, ebx
je 0x41d676
cmp eax, ecx
jne 0x41d676
cmp eax, edx
jne 0x41d676
mov dword [0x4747970], ebx
mov dword [0x474798c], ebx
mov dword [0x4747988], ebx
mov dword [0x4747984], ebx
mov dword [0x474796c], ebx
jmp 0x41d688
cmp ecx, ebx
je 0x41d688
cmp edx, ebx
je 0x41d688
mov dword [0x4747970], 1
mov ebp, dword [0x47bb10]
mov edi, dword [0x47baf0]
mov dword [0x4747980], ebx
xor esi, esi
mov eax, 0x1f90f10
mov cl, byte [eax]
test cl, cl
je 0x41d6d3
xor edx, edx
mov dl, byte [eax + 7]
cmp edx, ebp
jne 0x41d6c7
cmp dword [0x4741c64], ebx
je 0x41d6bc
cmp edi, esi
je 0x41d6c0
inc cl
mov byte [eax], cl
cmp byte [eax], 4
jle 0x41d6d3
jmp 0x41d6d0
inc cl
cmp cl, 0xe
mov byte [eax], cl
jle 0x41d6d3
mov byte [eax], 0
add eax, 0x5a
inc esi
cmp eax, 0x1fa6ea0
jl 0x41d6a1
mov dword [0x474797c], ebx
cmp dword [0x4747830], ebx
je 0x41d716
cmp dword [0x4741c64], ebx
je 0x41d6fd
cmp dword [0x47bc00], 0xffffffff
je 0x41d716
mov eax, dword [0x47bc04]
push eax
push 0x4cf7b4
call fcn.0041bcb0
add esp, 8
mov dword [0x4747830], ebx
mov ecx, dword [0x4740574]
cmp ecx, ebx
je 0x41d794
cmp dword [0x4741c64], ebx
jne 0x41d794
mov eax, dword [0x47bb10]
cmp ecx, ebx
jle 0x41d761
inc ecx
cmp ecx, 8
mov dword [0x4740574], ecx
jle 0x41d794
cmp eax, 0xc8
jge 0x41d78e
inc eax
cmp eax, 0xc9
jge 0x41d755
push eax
call fcn.0041a470
add esp, 4
mov dword [0x4740574], 7
jmp 0x41d794
dec ecx
cmp ecx, 0xfffffff8
mov dword [0x4740574], ecx
jge 0x41d794
cmp eax, ebx
je 0x41d78e
dec eax
cmp eax, 0xc9
jge 0x41d782
push eax
call fcn.0041a470
add esp, 4
mov dword [0x4740574], 0xfffffff9
jmp 0x41d794
mov dword [0x4740574], ebx
cmp dword [0x678bc8], ebx
jne 0x41d7a4
cmp dword [0x4741b0c], ebx
je 0x41d7a9
mov ebx, 1
mov eax, dword [0x475fa0]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x41dc34
cmp dword [0x4747990], ebx
je 0x41d7e6
test ebx, ebx
jne 0x41d7e0
push 0x475ff8
call fcn.004366e2
add esp, 4
mov dword [0x4740500], eax
mov dword [0x4747990], ebx
mov eax, dword [0x47611c]
test eax, eax
je 0x41d9d3
test ebx, ebx
je 0x41d9d3
push 0x476120
call fcn.004366e2
lea eax, [eax + eax*4]
mov ecx, dword [0x4740504]
add esp, 4
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cmp ecx, eax
jle 0x41d9d3
xor ebx, ebx
push 0x475ff8
mov dword [0x4740504], ebx
call fcn.004366e2
push 0x476140
mov dword [0x4740500], eax
call fcn.004366e2
mov edx, dword [0x3301438]
lea eax, [eax + eax*4]
add esp, 8
lea eax, [eax + eax*4]
push 0x1388
push edx
lea ecx, [eax + eax*4]
shl ecx, 3
mov dword [0x4740508], ecx
call esi
mov eax, dword [0x47428bc]
mov edx, dword [0x486cbc]
mov ecx, dword [eax*4 + 0x47b22c]
push ecx
push edx
push 0x46960dc
call fcn.0042e140
mov eax, dword [0x3301438]
add esp, 0xc
push ebx
push 1
push eax
call ebp
call fcn.00436817
and eax, 0x800000ff
jns 0x41d8a5
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x10], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d8bc
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x11], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d8d3
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x12], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d8ea
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x13], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d901
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x14], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d918
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x15], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d92f
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x16], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d946
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x17], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d95d
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x18], al
call fcn.00436817
and eax, 0x800000ff
jns 0x41d974
dec eax
or eax, 0xffffff00
inc eax
mov cx, word [0x47baf0]
lea edx, [esp + 0x20]
mov byte [esp + 0x19], al
push edx
lea eax, [esp + 0x14]
push 0xa
push eax
push 0x4e
mov word [esp + 0x24], cx
call fcn.0042f0e0
mov ecx, dword [0x3301438]
add esp, 0x10
mov edi, eax
push 0x1388
push ecx
call esi
mov edx, dword [0x47428bc]
lea ecx, [esp + 0x20]
mov eax, dword [edx*4 + 0x47b22c]
push eax
push edi
push ecx
call fcn.0042e140
mov edx, dword [0x3301438]
add esp, 0xc
push 0
push 1
push edx
call ebp
cmp dword [0x47478a8], ebx
je 0x41dc34
xor edi, edi
cmp ebx, edi
je 0x41db2b
cmp dword [0x4740508], edi
jne 0x41dc34
mov eax, dword [0x475fcc]
cmp eax, 1
jle 0x41dafd
cmp eax, 2
jne 0x41da32
mov eax, dword [0x1f80f08]
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 3
push eax
call edi
mov ecx, dword [0x1f80f08]
push 5
push ecx
call edi
mov eax, dword [0x475fcc]
mov dword [0x4740504], 0
cmp eax, 3
jne 0x41da94
mov edx, dword [0x1f5f0ec]
push 0x1388
push edx
call esi
lea eax, [esp + 0x10]
push 5
push eax
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], 1
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 8
call fcn.0042ec90
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1f5f0ec]
push 0
push 1
push ecx
call ebp
mov eax, dword [0x475fcc]
mov dword [0x4740504], 0
cmp eax, 4
jne 0x41db20
mov edx, dword [0x1f5f0ec]
push 0x1388
push edx
call esi
push 0x476018
lea eax, [esp + 0x44]
push str._s_r_n
push eax
call fcn.004361ae
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
call fcn.0042ec90
mov edx, dword [0x1f5f0ec]
add esp, 0x14
push 0
push 1
push edx
call ebp
mov dword [0x4740504], 0
mov dword [0x47478a8], ebx
jmp 0x41dc34
cmp eax, edi
je 0x41db0b
mov eax, dword [0x1f80f08]
push 3
push eax
jmp 0x41db14
mov ecx, dword [0x1f80f08]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [0x4740504], edi
mov dword [0x47478a8], ebx
jmp 0x41dc34
mov eax, dword [0x475fcc]
mov dword [0x4740504], edi
cmp eax, 1
jle 0x41dc0d
cmp eax, 3
jne 0x41db96
mov edx, dword [0x1f5f0ec]
push 0x1388
push edx
call esi
lea eax, [esp + 0x10]
push 5
push eax
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0x88
call fcn.0042ec90
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1f5f0ec]
push edi
push 1
push ecx
call ebp
mov eax, dword [0x475fcc]
cmp eax, 4
jne 0x41dbeb
mov edx, dword [0x1f5f0ec]
push 0x1388
push edx
call esi
push 0x476098
lea eax, [esp + 0x44]
push str._s_r_n
push eax
call fcn.004361ae
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
call fcn.0042ec90
mov edx, dword [0x1f5f0ec]
add esp, 0x14
push 0
push 1
push edx
call ebp
mov eax, dword [0x475fcc]
cmp eax, 2
jne 0x41dc2a
mov eax, dword [0x1f80f08]
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 4
push eax
call edi
mov ecx, dword [0x1f80f08]
push 6
push ecx
call edi
jmp 0x41dc2a
cmp eax, edi
je 0x41dc1c
mov edx, dword [0x1f80f08]
push 4
push edx
jmp 0x41dc24
mov eax, dword [0x1f80f08]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [0x47478a8], 0
mov eax, dword [0x4741cfc]
test eax, eax
je 0x41dff4
cmp eax, 1
mov dword [0x4741cfc], 0
jne 0x41dc69
push 0
push str.mail
push 0x4741d00
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41dfe6
cmp eax, 2
jne 0x41dc90
mov ecx, dword [0x32fb544]
push 1
push 0
push 0
push 0x4741d00
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41dfe6
cmp eax, 0x15
jne 0x41dcae
push 0
push str.Error
push 0x4741d00
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41dfe6
cmp eax, 0x17
jne 0x41de0c
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x4741d00
push 0x4959f8
lea edx, [esp + 0x174]
push str._s_s
push edx
call fcn.004361ae
lea eax, [esp + 0x17c]
push str.send.txt
push eax
call fcn.00436480
add esp, 0x18
test eax, eax
jne 0x41dd15
lea ecx, [esp + 0x16c]
push ecx
call fcn.00401330
push eax
lea edx, [esp + 0x174]
push 0x48222c
push edx
call fcn.004361ae
add esp, 0x10
mov al, byte [esp + 0x16c]
test al, al
je 0x41dfe6
lea eax, [esp + 0x16c]
push 0x48215c
push eax
call fcn.00436380
add esp, 8
test eax, eax
je 0x41dd85
push eax
call fcn.00436200
lea ecx, [esp + 0x170]
push str.send.txt
push ecx
call fcn.00436480
add esp, 0xc
test eax, eax
jne 0x41dd85
push 3
push 0x4826a8
push 0x48318c
push eax
call esi
sub eax, 2
je 0x41dfe6
sub eax, 4
je 0x41dd85
dec eax
je 0x41dcbd
jmp 0x41dfe6
lea edx, [esp + 0x16c]
push 0x482148
push edx
call fcn.00436380
mov esi, eax
add esp, 8
test esi, esi
je 0x41dfe6
mov eax, dword [0x4747844]
push esi
push 1
push eax
push 0x1f8d418
call fcn.00436256
push esi
call fcn.00436200
lea ecx, [esp + 0x180]
push str.send.txt
push ecx
call fcn.00436480
add esp, 0x1c
test eax, eax
je 0x41dfe6
lea edx, [esp + 0x16c]
lea eax, [esp + 0x56c]
push edx
push str.notepad.exe___s_
push eax
call fcn.004361ae
add esp, 0xc
lea ecx, [esp + 0x56c]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x41dfe6
cmp eax, 0x16
jne 0x41de8d
cmp dword [0x47bc08], 0x100
jb 0x41de3a
push 4
push 0x474831c
push 0x4741d00
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x41dfe6
lea edx, [esp + 0x20]
push edx
push 0xa
push 0x1e31fdc
push 0x68
call fcn.0042f0e0
add esp, 0x10
mov edi, eax
mov eax, dword [0x3301438]
push 0x1388
push eax
call esi
mov ecx, dword [0x47428bc]
lea eax, [esp + 0x20]
mov edx, dword [ecx*4 + 0x47b22c]
push edx
push edi
push eax
call fcn.0042e140
mov ecx, dword [0x3301438]
add esp, 0xc
push 0
push 1
push ecx
call ebp
jmp 0x41dfe6
cmp eax, 0x2b
jne 0x41deae
push 0xc15c
push 0x4998f4
push 0x4cf6b4
call fcn.0041cc20
add esp, 0xc
jmp 0x41dfe6
cmp eax, 0x2a
jne 0x41df4a
cmp dword [0x47bc08], 0x100
jb 0x41dee0
push 4
push 0x474831c
push 0x4741d00
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x41dfe6
push 0xc544
push 0x4cf6b4
push 0x4878a0
call fcn.0041cc20
lea edx, [esp + 0x4c]
push edx
push 0x10a
push 0x1e31fdc
push 0x6f
call fcn.0042f0e0
add esp, 0x1c
mov edi, eax
mov eax, dword [0x3301438]
push 0x1388
push eax
call esi
mov ecx, dword [0x47428bc]
lea eax, [esp + 0x40]
mov edx, dword [ecx*4 + 0x47b22c]
push edx
push edi
push eax
call fcn.0042e140
mov ecx, dword [0x3301438]
add esp, 0xc
push 0
push 1
push ecx
call ebp
jmp 0x41dfe6
cmp eax, 0xd
jne 0x41dff4
push str.i.vbs
push 0x4959f8
lea edx, [esp + 0x174]
push str._s_s
push edx
call fcn.004361ae
lea eax, [esp + 0x17c]
push 0x482148
push eax
call fcn.00436380
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41dfe6
mov edi, 0x4741d00
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
push ecx
push 0x4741d00
call fcn.00436256
push esi
call fcn.00436200
push str.i.vbs
push 0x4959f8
lea ecx, [esp + 0x188]
push str.wscript.exe___s_s_
push ecx
call fcn.004361ae
add esp, 0x24
lea edx, [esp + 0x16c]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x4740524], 1
mov ecx, 0x2ee
xor eax, eax
mov edi, 0x4741d00
rep stosd dword es:[edi], eax
mov eax, dword [0x4740524]
test eax, eax
je 0x41e231
inc eax
cmp eax, 0xa
mov dword [0x4740524], eax
jle 0x41e1c6
push 0x48274c
push 0x4959f8
lea eax, [esp + 0x174]
push str._s_s
push eax
call fcn.004361ae
lea ecx, [esp + 0x17c]
push 0x482234
push ecx
call fcn.00436380
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41e1c6
push esi
call fcn.00412230
push esi
mov edi, eax
call fcn.00436200
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x41e1c6
lea edx, [esp + 0x16c]
push 0x48215c
push edx
call fcn.00436380
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x41e1c6
push ebp
call fcn.00412230
mov ebx, eax
lea edi, [ebx + 1]
push edi
call fcn.004367fe
mov esi, eax
add esp, 8
test esi, esi
je 0x41e188
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push 1
push ebx
push esi
rep stosb byte es:[edi], al
call fcn.00436393
push esi
lea eax, [esp + 0x980]
push 0x48222c
push eax
call fcn.004361ae
lea ecx, [esp + 0x1540]
lea edi, [esp + 0x988]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x98c]
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
push edx
push 0x55
call fcn.0042f0e0
add esp, 0x2c
mov edi, eax
mov eax, dword [0x3301438]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x47428bc]
lea eax, [esp + 0x1524]
mov edx, dword [ecx*4 + 0x47b22c]
push edx
push edi
push eax
call fcn.0042e140
mov ecx, dword [0x3301438]
add esp, 0xc
push 0
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call fcn.0043680c
push str.i.vbs
push 0x4959f8
lea edx, [esp + 0x578]
push str._s_s
push edx
mov dword [0x4740524], 0
call fcn.004361ae
lea eax, [esp + 0x580]
push eax
call fcn.00436863
add esp, 0x18
push ebp
call fcn.00436200
mov eax, dword [0x4740524]
add esp, 4
test eax, eax
jne 0x41e1c6
push 0x48274c
push 0x4959f8
lea ecx, [esp + 0x574]
push str._s_s
push ecx
call fcn.004361ae
lea edx, [esp + 0x57c]
push edx
call fcn.00436863
add esp, 0x14
cmp dword [0x4740524], 0xc8
jle 0x41e231
push str.i.vbs
push 0x4959f8
lea eax, [esp + 0x174]
push str._s_s
push eax
mov dword [0x4740524], 0
call fcn.004361ae
lea ecx, [esp + 0x17c]
push ecx
call fcn.00436863
push 0x48274c
push 0x4959f8
lea edx, [esp + 0x188]
push str._s_s
push edx
call fcn.004361ae
lea eax, [esp + 0x190]
push eax
call fcn.00436863
add esp, 0x28
mov eax, dword [0x4741c98]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x41e276
fld qword [0x47bae8]
fcomp qword [0x43e428]
fnstsw ax
test ah, 0x41
jne 0x41e276
fld qword [0x3e8a680]
fcomp qword [0x47bae8]
fnstsw ax
test ah, 1
je 0x41e276
fld qword [0x3e8a680]
fadd qword [0x43e468]
fstp qword [0x3e8a680]
mov eax, dword [0x47babc]
test eax, eax
je 0x41e2b7
fld qword [0x47bac0]
fcomp qword [0x43e428]
fnstsw ax
test ah, 0x41
jne 0x41e2b7
fld qword [0x47bac8]
fcomp qword [0x47bac0]
fnstsw ax
test ah, 1
je 0x41e2b7
fld qword [0x47bac8]
fadd qword [0x43e468]
fstp qword [0x47bac8]
mov eax, dword [0x47bad0]
test eax, eax
je 0x41e2f8
fld qword [0x47bad8]
fcomp qword [0x43e428]
fnstsw ax
test ah, 0x41
jne 0x41e2f8
fld qword [0x47bae0]
fcomp qword [0x47bad8]
fnstsw ax
test ah, 1
je 0x41e2f8
fld qword [0x47bae0]
fadd qword [0x43e468]
fstp qword [0x47bae0]
mov eax, dword [0x4741c64]
test eax, eax
mov eax, dword [0x47bc0c]
je 0x41e30a
test eax, eax
jne 0x41e318
mov ecx, dword [0x4747854]
test ecx, ecx
je 0x41e342
test eax, eax
je 0x41e342
mov ecx, dword [0x330145c]
mov edx, dword [0x3301458]
mov eax, dword [0x47b4cc]
push ecx
mov ecx, dword [0x47b4c8]
push edx
mov edx, dword [0x4959f4]
push eax
push ecx
push edx
call fcn.004125c0
add esp, 0x14
mov eax, dword [0x4741c64]
test eax, eax
jne 0x41e37d
cmp dword [0x47428d4], 6
jge 0x41e37d
mov eax, dword [0x678bc4]
mov ecx, dword [0x678bc0]
mov edx, dword [0x47b4cc]
push eax
mov eax, dword [0x47b4c8]
push ecx
mov ecx, dword [0x4959f4]
push edx
push eax
push ecx
call fcn.004125c0
add esp, 0x14
mov edx, dword [0x47b49c]
mov eax, dword [0x47b498]
mov ecx, dword [0x4959f4]
push edx
push eax
push ecx
call fcn.0041aa20
add esp, 0x24f0
ret