Function at 0x40d170
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get file size
Hash data with crc32
Read file via mapping
Resolve function by parsing pe exports
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1000
mov edx, str.imagesplitVERSION
mov eax, 0x43c0a0
push edi
push esi
push ebx
sub esp, 0x30c
call fcn.00407710
test al, al
je 0x40e634
mov dword [esp + 4], 1
mov dword [esp], 0x408190
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40e751
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [0x43c088], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x43c084], 0
mov dword [0x43c080], eax
mov ebp, eax
mov eax, dword [0x43c088]
sub esp, 8
cmp byte [eax + 1], 0x41
lea edi, [eax + 3]
movzx ecx, byte [eax + 2]
setne dl
cmp byte [eax], 0x4b
mov dword [0x43c088], edi
setne al
or dl, al
jne 0x40e747
cmp cl, 0x59
jne 0x40e747
mov dword [esp], 0x20000
mov dword [0x43f0a8], 0
call sub.msvcrt.dll_malloc
mov dword [0x43f0b4], eax
test eax, eax
je 0x40e648
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40e63e
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x40de33
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x43f0a4], esi
mov dword [0x43f0a8], edi
mov dword [0x43f0b0], 0
mov dword [0x43f0ac], ebp
mov ebp, 0x43b880
mov ebx, dword [0x43f0b8]
mov esi, dword [0x43f0bc]
mov dword [esp + 0x48], ebp
lea esi, [esi]
lea eax, [esp + 0x200]
xor edx, edx
mov edi, 2
mov dword [esp + 0x38], eax
lea esi, [esi]
mov eax, ebx
sub eax, esi
jne 0x40d431
mov ebp, dword [0x43f0b0]
mov ecx, dword [0x43f0ac]
cmp ebp, ecx
setb al
or dl, al
je 0x40d490
mov eax, dword [0x43f0a4]
mov dword [0x43f0bc], 0
mov dword [0x43f0b8], 0x20000
call fcn.0040be10
mov ebx, dword [0x43f0bc]
cmp dword [0x43f0b8], ebx
sete dl
cmp eax, 0xffffff88
ja 0x40d498
xor esi, esi
mov eax, ebx
mov dword [0x43f0b8], ebx
mov dword [0x43f0bc], 0
sub eax, esi
je 0x40d3ce
cmp eax, edi
mov byte [esp + 0x3c], dl
cmova eax, edi
mov ebp, eax
mov eax, dword [0x43f0b4]
mov dword [esp + 8], ebp
add eax, esi
add esi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x38], ebp
sub edi, ebp
movzx edx, byte [esp + 0x3c]
mov dword [0x43f0bc], esi
jne 0x40d3c8
movzx eax, word [esp + 0x200]
mov ecx, dword [esp + 0x48]
mov word [ecx], ax
test ax, ax
je 0x40d4a2
add ecx, 2
mov dword [esp + 0x48], ecx
jmp 0x40d3b0
cmp ebp, ecx
je 0x40d3c8
mov eax, str.Error__couldnt_decode_attached_data.
call fcn.00407f10
movzx ecx, word [0x43b880]
test cx, cx
je 0x40de47
movzx edx, word [0x43c0a0]
xor esi, esi
mov eax, 2
mov word [0x439880], si
test dx, dx
jne 0x40d4e6
jmp 0x40ddcc
add eax, 2
cmp eax, 0x2002
je 0x415a2f
mov word [eax + 0x43987e], dx
movzx edx, word [eax + 0x43c0a0]
test dx, dx
jne 0x40d4d8
add eax, 0x439880
xor ebx, ebx
mov word [eax], bx
cmp word [0x439880], 0
je 0x40ddc2
mov edx, 0x1000
mov eax, 0x439880
lea esi, [esi]
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d520
test edx, edx
je 0x40e7c9
mov dword [eax], 0x5c
cmp word [0x439880], 0
je 0x40ddd6
mov edx, 0x1000
mov eax, 0x439880
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d558
test edx, edx
je 0x40e7bf
mov ebx, 0x43b880
jmp 0x40d580
test edx, edx
je 0x40e7ba
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40d578
xor edx, edx
cmp word [0x439080], 0
mov word [eax], dx
je 0x40dd48
lea eax, [esp + 0x200]
mov edx, 8
call fcn.0040d080
lea eax, [esp + 0x200]
mov edx, 4
mov ebx, dword [esp + 0x200]
mov esi, dword [esp + 0x204]
call fcn.0040d080
mov eax, dword [esp + 0x200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x60], eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x439880
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x54], eax
cmp eax, 0xffffffff
je 0x40ddb7
mov dword [esp + 4], 0
mov ebp, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov dword [esp + 0x4c], eax
cmp eax, 0xffffffff
je 0x40dd90
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
sub esp, 0x18
mov dword [esp + 0x5c], eax
test eax, eax
je 0x40dd90
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [esp + 0x64], eax
test eax, eax
je 0x40e09c
cmp dword [esp + 0x4c], 0x16
jbe 0x40ddab
mov ebp, eax
test al, 3
je 0x40e6d3
mov edx, dword [esp + 0x4c]
mov eax, 0xffffffff
jmp 0x40d6f6
test ebp, 3
je 0x40dde5
add ebp, 1
mov ecx, eax
xor al, byte [ebp - 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
sub edx, 1
jne 0x40d6ea
mov dword [esp + 0x4c], edx
mov eax, 0xffffffff
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x38], ecx
mov ecx, ebp
mov dword [esp + 0x3c], 0
xor edx, edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x74], esi
mov esi, ebp
xor ebp, ebp
mov dword [esp + 0x78], eax
mov eax, edx
mov edi, dword [esp + 0x38]
xor edi, dword [esi]
add esi, 0x14
xor ebp, dword [esi - 4]
mov ebx, edi
mov ecx, dword [esp + 0x48]
xor ecx, dword [esi - 0x10]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x50], ebp
movzx ebp, bl
mov ebx, edi
mov ebp, dword [ebp*4 + 0x417a80]
xor edx, dword [esi - 0xc]
shr ebx, 0x18
xor eax, dword [esi - 8]
xor ebp, dword [ebx*4 + 0x418680]
mov ebx, edi
shr edi, 0x10
movzx ebx, bh
xor ebp, dword [ebx*4 + 0x417e80]
mov ebx, edi
movzx edi, bl
mov ebx, dword [edi*4 + 0x418280]
movzx edi, cl
mov edi, dword [edi*4 + 0x417a80]
xor ebx, ebp
movzx ebp, ch
mov dword [esp + 0x38], ebx
mov ebx, ecx
shr ecx, 0x10
shr ebx, 0x18
movzx ecx, cl
xor edi, dword [ebx*4 + 0x418680]
mov ebx, dword [ecx*4 + 0x418280]
movzx ecx, dl
xor edi, dword [ebp*4 + 0x417e80]
mov ecx, dword [ecx*4 + 0x417a80]
xor ebx, edi
movzx edi, dh
mov dword [esp + 0x48], ebx
mov ebx, edx
shr edx, 0x10
shr ebx, 0x18
movzx edx, dl
xor ecx, dword [ebx*4 + 0x418680]
xor ecx, dword [edi*4 + 0x417e80]
xor ecx, dword [edx*4 + 0x418280]
movzx edx, al
mov edi, dword [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov ecx, eax
mov edx, dword [edx*4 + 0x417a80]
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x418680]
movzx ecx, ah
shr eax, 0x10
movzx eax, al
xor edx, dword [ecx*4 + 0x417e80]
mov ecx, edi
xor edx, dword [eax*4 + 0x418280]
movzx ecx, cl
mov eax, edx
mov edx, edi
mov ebp, dword [ecx*4 + 0x417a80]
mov ecx, edi
shr edx, 0x18
xor ebp, dword [edx*4 + 0x418680]
movzx edx, ch
shr ecx, 0x10
xor ebp, dword [edx*4 + 0x417e80]
movzx edx, cl
xor ebp, dword [edx*4 + 0x418280]
sub dword [esp + 0x58], 1
jne 0x40d74d
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x78]
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x50], ebp
mov esi, dword [esp + 0x74]
lea eax, [eax + eax*4]
lea ebp, [ecx + eax*4]
mov eax, dword [esp + 0x38]
xor eax, dword [ebp]
movzx edx, al
shr eax, 8
xor edi, dword [ebp + 4]
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x418a80]
mov eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x418a80]
mov eax, edx
movzx edx, dl
shr eax, 8
xor eax, edi
xor eax, dword [edx*4 + 0x418a80]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x418a80]
mov eax, dword [esp + 0x3c]
mov ecx, edx
movzx edx, dl
xor eax, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [edx*4 + 0x418a80]
mov edx, ecx
movzx ecx, cl
shr edx, 8
xor eax, edx
xor eax, dword [ecx*4 + 0x418a80]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x418a80]
mov eax, dword [esp + 0x48]
mov ecx, edx
movzx edx, dl
xor eax, dword [ebp + 0xc]
shr ecx, 8
xor ecx, dword [edx*4 + 0x418a80]
mov edx, ecx
movzx ecx, cl
shr edx, 8
xor eax, edx
xor eax, dword [ecx*4 + 0x418a80]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x418a80]
mov eax, dword [esp + 0x50]
mov ecx, edx
movzx edx, dl
xor eax, dword [ebp + 0x10]
shr ecx, 8
xor ecx, dword [edx*4 + 0x418a80]
mov edx, ecx
movzx ecx, cl
shr edx, 8
xor eax, edx
xor eax, dword [ecx*4 + 0x418a80]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x418a80]
mov eax, edx
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x418a80]
mov edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x418a80]
lea edx, [ebp + 0x14]
mov edi, dword [esp + 0x4c]
cmp edi, 7
jbe 0x40db2c
mov ecx, eax
xor al, byte [edx]
sub edi, 8
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 1]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 3]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 5]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 6]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 7]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
cmp edi, 7
jbe 0x40db20
mov ecx, eax
xor al, byte [edx + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 9]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 0xa]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 0xb]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 0xc]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 0xd]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
mov ecx, eax
xor al, byte [edx + 0xe]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
xor cl, byte [edx + 0xf]
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x418a80]
and dword [esp + 0x4c], 7
shr edi, 3
lea edx, [edx + edi*8 + 8]
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x40dbd9
mov ecx, eax
xor al, byte [edx]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 1
je 0x40dbd9
xor al, byte [edx + 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 2
je 0x40dbd9
xor al, byte [edx + 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 3
je 0x40dbd9
xor al, byte [edx + 3]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 4
je 0x40dbd9
xor al, byte [edx + 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 5
je 0x40dbd9
xor al, byte [edx + 5]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
cmp edi, 6
je 0x40dbd9
xor al, byte [edx + 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x418a80]
mov eax, ecx
not eax
test eax, eax
mov edi, eax
mov eax, 1
cmove edi, eax
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
sub esp, 4
mov eax, dword [esp + 0x5c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call ebp
sub esp, 4
cmp dword [esp + 0x60], edi
je 0x40dd02
mov eax, 0x439880
call fcn.00408060
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x439880
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebp, eax
cmp eax, 0xffffffff
je 0x40e716
mov eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, esi
je 0x40dcf1
xor eax, eax
mov edx, 0x8000
mov ecx, eax
cmp edx, ebx
sbb ecx, esi
cmovae eax, esi
cmovae edx, ebx
mov dword [esp + 0x44], eax
mov eax, 0x41d040
mov dword [esp + 0x40], edx
call fcn.0040d080
lea eax, [esp + 0x200]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x200], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41d040
mov dword [esp], ebp
call edi
sub esp, 0x14
test eax, eax
je 0x40e760
sub ebx, dword [esp + 0x40]
sbb esi, dword [esp + 0x44]
mov eax, ebx
or eax, esi
jne 0x40dc80
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40d398
mov eax, ebx
or eax, esi
je 0x40d398
lea esi, [esi]
xor eax, eax
mov edx, 0x8000
cmp edx, ebx
mov ecx, eax
sbb ecx, esi
cmovae eax, esi
cmovae edx, ebx
mov ebp, eax
mov edi, edx
mov eax, 0x41d040
call fcn.0040d080
sub ebx, edi
sbb esi, ebp
mov eax, ebx
or eax, esi
jne 0x40dd10
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], ebp
jmp 0x40d398
movzx edx, word [0x439880]
mov eax, 2
test dx, dx
jne 0x40dd6e
jmp 0x40e62a
add eax, 2
cmp eax, 0x2002
je 0x415a2f
mov word [eax + 0x43907e], dx
movzx edx, word [eax + 0x439880]
test dx, dx
jne 0x40dd60
add eax, 0x439080
xor ebp, ebp
mov word [eax], bp
jmp 0x40d5a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40dc15
mov edx, eax
mov eax, 0xffffffff
jmp 0x40d9e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dc15
mov eax, 0x439880
jmp 0x40d534
mov eax, 0x439880
jmp 0x40d4fe
mov eax, 0x439880
mov edx, 0x1000
jmp 0x40d56c
mov dword [esp + 0x38], eax
mov eax, 0xcccccccd
mov ecx, edx
mul edx
shr edx, 4
mov eax, edx
lea edx, [edx + edx*4]
shl edx, 2
sub eax, 1
sub ecx, edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x4c], ecx
mov ecx, ebp
test eax, eax
jne 0x40d729
mov dword [esp + 0x50], 0
xor edi, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0x3c], 0
jmp 0x40d89c
mov eax, 7
cpuid
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x40d344
mov ebx, dword [0x43f0a4]
test ebx, ebx
je 0x40df09
mov esi, dword [ebx + 0x7380]
test esi, esi
jne 0x40df09
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov ebp, dword [ebx + 0x7374]
test esi, esi
je 0x40deb9
mov edx, dword [esi]
mov eax, dword [esi + 0x6ab4]
mov ecx, dword [esi + 0x6ab8]
test edx, edx
je 0x40e701
test eax, eax
je 0x40e7ad
mov dword [esp], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 4], edx
call eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ecx
call eax
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x40e6be
test edi, edi
je 0x40e7a0
mov dword [esp + 4], eax
mov dword [esp], ebp
call edi
mov dword [ebx + 0x73a0], 0
mov dword [esp + 4], ebx
mov dword [esp], ebp
call edi
mov eax, dword [0x43f0b4]
xor ebx, ebx
mov esi, pe_nt_image_headers32
lea edi, [esp + 0x86]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x4170fc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x180]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call fcn.00401ad0
movzx eax, byte [esp + 0x180]
mov word [esp + 0x200], bx
lea ebx, [esp + 0x200]
test al, al
je 0x40dff5
mov byte [esp + 0x86], al
lea eax, [esp + 0x90]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x87], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x415a2f
cmp word [ebx], 0
movzx ecx, word [esp + 0x90]
mov edx, esi
mov eax, ebx
je 0x40dfc4
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40dfb8
test edx, edx
je 0x415a2f
xor edx, edx
mov word [eax], cx
add ebx, 2
mov word [eax + 2], dx
mov eax, 1
lea edx, [esi - 1]
sub eax, esi
movzx eax, byte [esp + eax + 0x200]
test al, al
je 0x40dff5
mov esi, edx
jmp 0x40df6c
xor ecx, ecx
mov esi, 0x28
mov eax, 0x4e
mov word [esp + 0x130], cx
lea edi, [esp + 0x130]
mov ebx, edi
mov byte [esp + 0x88], al
lea eax, [esp + 0x88]
mov dword [esp + 4], eax
lea eax, [esp + 0x94]
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x89], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x415a2f
cmp word [ebx], 0
movzx ecx, word [esp + 0x94]
mov edx, esi
mov eax, ebx
je 0x40e06c
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e060
test edx, edx
je 0x415a2f
xor ebp, ebp
mov word [eax], cx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], bp
mov eax, 1
sub eax, esi
movzx eax, byte [eax + 0x417340]
test al, al
je 0x40e0a7
mov esi, edx
jmp 0x40e012
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dbf7
lea eax, [esp + 0x200]
mov dword [esp], edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 4], eax
call ebx
sub esp, 8
cmp word [0x425040], 0
je 0x40e669
xor ecx, ecx
mov edi, 0x28
mov eax, 0x4e
mov word [esp + 0xe0], cx
lea esi, [esp + 0xe0]
mov byte [esp + 0x8a], al
lea eax, [esp + 0x8a]
mov dword [esp + 4], eax
lea eax, [esp + 0x98]
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x8b], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x415a2f
cmp word [esi], 0
movzx ecx, word [esp + 0x98]
mov edx, edi
mov eax, esi
je 0x40e144
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e138
test edx, edx
je 0x415a2f
xor edx, edx
mov word [eax], cx
add esi, 2
mov word [eax + 2], dx
mov eax, 1
lea edx, [edi - 1]
sub eax, edi
movzx eax, byte [eax + 0x417356]
test al, al
je 0x40e174
mov edi, edx
jmp 0x40e0e9
lea eax, [esp + 0xe0]
mov dword [esp + 4], 0x425040
xor ebp, ebp
mov dword [esp], eax
call ebx
xor eax, eax
mov ecx, 0x11
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 8
lea edi, [esp + 0x9c]
rep stosd dword es:[edi], eax
mov dword [esp], 0xfffffff6
mov dword [esp + 0xc8], 0x100
call ebx
sub esp, 4
mov dword [esp + 0xd4], eax
mov dword [esp], 0xfffffff5
call ebx
sub esp, 4
mov dword [esp + 0xd8], eax
mov dword [esp], 0xfffffff4
call ebx
sub esp, 4
mov dword [esp + 0xdc], eax
mov dword [esp + 0x9c], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x8c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov word [0x429060], bp
sub esp, 8
mov esi, eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x427060
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x415a2f
mov edi, dword [esp + 0x8c]
mov dword [esi], 0x427060
xor ebx, ebx
test edi, edi
jle 0x40e527
mov edi, dword [esi + ebx*4]
mov ebp, str.__t_n_v_
mov eax, 0x20
jmp 0x40e280
movzx eax, word [ebp + 2]
add ebp, 2
test ax, ax
je 0x40e411
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_wcschr
test eax, eax
je 0x40e270
cmp word [0x429060], 0
mov edx, 0x8000
mov eax, 0x429060
je 0x40e2b8
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e2a4
test edx, edx
je 0x415a2f
mov edx, dword [esi + ebx*4]
mov dword [eax], 0x22
mov dword [esp + 0x38], esi
movzx ebp, word [edx]
cmp bp, 0x5c
jne 0x40e395
xor eax, eax
lea esi, [esi]
mov ecx, edx
movzx ebp, word [edx + 2]
add edx, 2
mov edi, eax
add eax, 1
cmp bp, 0x5c
je 0x40e2d8
test bp, bp
je 0x40e4a4
cmp bp, 0x22
je 0x40e404
xor esi, esi
test eax, eax
jle 0x40e349
lea esi, [esi]
cmp word [0x429060], 0
mov ebp, 0x8000
mov eax, 0x429060
je 0x40e334
lea esi, [esi]
add eax, 2
sub ebp, 1
cmp word [eax], 0
jne 0x40e320
test ebp, ebp
je 0x415a2f
mov dword [eax], 0x5c
lea eax, [esi + 1]
cmp esi, edi
je 0x40e345
mov esi, eax
jmp 0x40e308
movzx ebp, word [ecx + 2]
cmp word [0x429060], 0
je 0x40e3fa
mov ecx, 0x8000
mov eax, 0x429060
lea esi, [esi]
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40e368
test ecx, ecx
je 0x40e7c4
xor ecx, ecx
add edx, 2
mov word [eax], bp
mov word [eax + 2], cx
movzx ebp, word [edx]
cmp bp, 0x5c
je 0x40e2d2
test bp, bp
je 0x40e652
cmp bp, 0x22
jne 0x40e349
mov esi, 1
xor edi, edi
lea esi, [esi]
nop
cmp word [0x429060], 0
mov ecx, 0x8000
mov eax, 0x429060
je 0x40e3dc
lea esi, [esi]
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40e3c8
test ecx, ecx
je 0x415a2f
add edi, 1
mov dword [eax], 0x5c
cmp edi, esi
jne 0x40e3b0
cmp word [0x429060], 0
movzx ebp, word [edx]
jne 0x40e357
mov eax, 0x429060
jmp 0x40e37c
lea esi, [eax + eax + 1]
test esi, esi
jg 0x40e3a9
jmp 0x40e349
mov edi, dword [esi + ebx*4]
mov edx, 0x8000
mov eax, 0x429060
cmp word [0x429060], 0
movzx ecx, word [edi]
je 0x40e65b
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e42f
test cx, cx
je 0x40e45c
test edx, edx
je 0x415a2f
add edi, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [edi]
test cx, cx
jne 0x40e440
xor edx, edx
add ebx, 1
mov word [eax], dx
cmp ebx, dword [esp + 0x8c]
jge 0x40e527
cmp word [0x429060], 0
mov edx, 0x8000
mov eax, 0x429060
je 0x40e499
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e485
test edx, edx
je 0x415a2f
mov dword [eax], 0x20
jmp 0x40e257
add eax, eax
mov esi, dword [esp + 0x38]
test eax, eax
jle 0x40e4e9
xor edi, edi
cmp word [0x429060], 0
mov ecx, 0x8000
mov edx, 0x429060
je 0x40e4dc
lea esi, [esi]
add edx, 2
sub ecx, 1
cmp word [edx], 0
jne 0x40e4c8
test ecx, ecx
je 0x415a2f
add edi, 1
mov dword [edx], 0x5c
cmp edi, eax
jne 0x40e4b0
cmp word [0x429060], 0
mov edx, 0x8000
mov eax, 0x429060
je 0x40e511
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e4fd
test edx, edx
je 0x415a2f
mov dword [eax], 0x22
add ebx, 1
cmp ebx, dword [esp + 0x8c]
jl 0x40e471
lea eax, [esp + 0x200]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x429060
mov dword [esp], 0x439080
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40e77e
mov eax, dword [esp + 0x204]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x200]
mov dword [esp + 0x180], 0
mov dword [0x439060], eax
test eax, eax
je 0x40e613
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x180]
mov dword [esp + 4], eax
mov eax, dword [0x439060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x40e5fc
mov dword [esp + 0x180], 1
mov eax, dword [0x439060]
mov dword [esp], eax
call ebx
mov dword [0x439060], 0
sub esp, 4
call fcn.00408120
mov eax, dword [esp + 0x180]
add esp, 0x30c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x439080
jmp 0x40dd86
mov eax, str.imagesplitVERSION
call fcn.00407e60
mov dword [0x43f0a4], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.00407f10
mov esi, dword [esp + 0x38]
jmp 0x40e4e9
test cx, cx
jne 0x40e448
jmp 0x40e45c
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0x425040
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x425040
sub esp, 0xc
cmp word [0x425040], 0
jne 0x40e6ab
jmp 0x40e6b4
cmp eax, 0x427042
je 0x415a2f
add eax, 2
cmp word [eax], 0
jne 0x40e6a0
xor esi, esi
mov word [eax], si
jmp 0x40e0ce
test edi, edi
jne 0x40df00
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40df09
mov eax, dword [esp + 0x4c]
mov edx, 0xcccccccd
mov dword [esp + 0x38], 0xffffffff
mul edx
shr edx, 4
mov eax, edx
lea edx, [edx + edx*4]
sub eax, 1
shl edx, 2
sub dword [esp + 0x4c], edx
mov dword [esp + 0x58], eax
jmp 0x40de0a
test eax, eax
jne 0x40deb0
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40deb9
mov dword [esp], 2
call dword [0x416054]
mov dword [esp + 8], 0x439880
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401aa0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__couldnt_find_attached_data_header.
call fcn.00407f10
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.00407f10
lea esi, [esi]
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_unpack_file_to_target_path.
call fcn.00407e90
mov dword [esp], 2
call sub.msvcrt.dll_exit
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_launch_child
call fcn.00407e90
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40e6c6
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x40e709
jmp 0x415a2f
jmp 0x415a2f
jmp 0x415a2f
jmp 0x415a2f
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
jmp fcn.004014c0