Function at 0x4f1994
Capabilities:
Create process on windows
Get common file path
Move file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x4f199c
push ebx
push esi
push edi
mov eax, 0x4f11f4
call fcn.00406d80
mov esi, 0x5340cc
xor eax, eax
push ebp
push 0x4f29c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d84
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004a94e4
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404978
jne 0x4f1a03
mov eax, dword [0x53452c]
mov byte [eax], 0
jmp 0x4f1a0b
mov eax, dword [0x53452c]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408dc0
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5346e4]
call fcn.004045d0
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408dc0
mov edx, dword [ebp - 0x28]
mov eax, dword [0x534748]
call fcn.004045d0
mov eax, dword [0x53452c]
cmp byte [eax], 0
jne 0x4f1a7b
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004a94e4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x53455c]
call fcn.004045d0
jmp 0x4f1aa4
lea edx, [ebp - 0x38]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.004099ac
mov edx, dword [ebp - 0x34]
mov eax, dword [0x53455c]
call fcn.004045d0
push 0x4f29e4
mov eax, dword [0x534a7c]
push dword [eax]
push 0x4f29e4
mov eax, dword [0x5347b4]
mov edx, 3
call fcn.004048f4
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29f0
call fcn.00404978
jne 0x4f1b77
fld xword [0x4f29f4]
mov eax, dword [0x5345ec]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4f1b77
call fcn.0046adfc
test al, al
jne 0x4f1b77
call fcn.0040b010
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409388
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x534748]
call fcn.004045d0
lea edx, [ebp - 0x40]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.0046d634
mov eax, dword [ebp - 0x40]
call fcn.00404a2c
push eax
mov eax, dword [0x5346e4]
push dword [eax]
push 0x4f2a08
mov eax, dword [0x534748]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x44]
call fcn.00404a2c
push eax
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00404a2c
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046ae78
jmp 0x4f291d
lea edx, [ebp - 0x48]
mov eax, dword [0x534848]
mov eax, dword [eax]
call fcn.00408d84
mov edx, dword [ebp - 0x48]
mov eax, 0x53b7d4
call fcn.004045d0
mov eax, dword [0x53b7d4]
call fcn.00462f9c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409388
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004a94e4
mov edx, dword [ebp - 0x50]
mov eax, 0x53b7d0
pop ecx
call fcn.00404880
mov dl, 1
mov eax, dword [0x462da4]
call fcn.00403740
mov dword [0x5340c8], eax
mov edx, dword [0x53b7d0]
mov eax, dword [0x5340c8]
call fcn.00462e48
test eax, eax
jne 0x4f1d43
mov eax, 0x4f2a0c
xor edx, edx
call fcn.004ef744
mov ebx, eax
test ebx, ebx
je 0x4f277b
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a20
call fcn.00404978
jne 0x4f1c2e
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f277b
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a30
call fcn.00404978
jne 0x4f1c55
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f277b
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a40
call fcn.00404978
jne 0x4f1c7c
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f277b
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a4c
call fcn.00404978
jne 0x4f277b
mov edx, dword [0x534748]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x534748]
cmp dword [eax], 0
jne 0x4f1cbc
mov eax, dword [0x534748]
mov edx, 0x4f2a08
call fcn.004045d0
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x534748]
mov eax, dword [eax]
call fcn.00404834
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x53b7cc
mov ecx, 1
mov edx, dword [0x4f11a8]
call fcn.00405ec4
add esp, 4
mov eax, dword [0x534748]
call fcn.00404a84
mov edx, eax
mov eax, dword [0x53b7cc]
call fcn.00409ca8
mov edi, dword [0x53b7cc]
test esi, esi
jle 0x4f1d2f
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4f1d15
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f277b
lea edx, [ebp - 0x58]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.004099ac
mov edx, dword [ebp - 0x54]
mov eax, dword [0x5349d8]
call fcn.004045d0
mov eax, dword [0x534994]
mov dword [eax], 0x20b9
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004efe68
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x534974]
call fcn.004045d0
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.004efe68
mov edx, dword [ebp - 0x60]
mov eax, dword [0x5346d8]
call fcn.004045d0
mov eax, dword [0x53b7d4]
call fcn.00404834
push eax
mov eax, 0x53b7d4
call fcn.00404a84
pop edx
call fcn.004ef96c
mov edx, dword [0x534994]
add dword [edx], eax
mov eax, 0x7fffffff
call fcn.0040307c
mov dword [0x53b7d8], eax
mov eax, 0x400
call fcn.0040307c
add eax, 0x400
mov dword [0x53b7dc], eax
mov eax, 0x2800
call fcn.0040307c
add eax, 0x2800
mov dword [0x53b7e0], eax
mov eax, 0x7fffffff
call fcn.0040307c
mov dword [0x53b7e4], eax
mov eax, 0x7d000
call fcn.0040307c
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.004efe68
mov edx, dword [ebp - 0x64]
mov eax, 0x53b7e8
mov ecx, 0x4f2a58
call fcn.00404880
call fcn.00402b00
lea edx, [ebp - 0x68]
mov eax, 4
call fcn.004a94e4
mov ecx, dword [ebp - 0x68]
mov edx, dword [0x534848]
mov edx, dword [edx]
mov eax, dword [0x534470]
call fcn.00404880
lea edx, [ebp - 0x6c]
mov eax, 3
call fcn.004a94e4
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x534848]
mov edx, dword [edx]
mov eax, dword [0x534880]
call fcn.00404880
lea edx, [ebp - 0x70]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00408d84
mov edx, dword [ebp - 0x70]
mov eax, 0x53b7b4
call fcn.004045d0
push 0x104
mov eax, dword [0x534538]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4f1f12
lea edx, [ebp - 0x74]
mov eax, dword [0x534538]
call fcn.00409ea8
mov edx, dword [ebp - 0x74]
mov eax, dword [0x5342b8]
call fcn.004045d0
mov eax, dword [0x5342b8]
mov eax, dword [eax]
call fcn.00404834
cmp eax, 3
jle 0x4f1eed
mov eax, dword [0x5342b8]
mov edx, 0x4f2a68
call fcn.0040483c
mov eax, dword [0x5342b8]
mov eax, dword [0x5342b8]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4f1f1a
mov eax, dword [0x5342b8]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x534528]
mov byte [edx], al
jmp 0x4f1f1a
mov eax, dword [0x534528]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x534538]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x2e
call fcn.004a94e4
mov eax, dword [ebp - 0x78]
call fcn.00404a2c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x534538]
call fcn.00409e8c
mov edx, eax
mov eax, 0x53b7b8
call fcn.0040476c
mov eax, 0x53b7b8
call fcn.0046a8b0
mov eax, dword [0x53b7b4]
cmp byte [eax], 0x5c
jne 0x4f1f74
mov eax, dword [0x53487c]
mov byte [eax], 2
jmp 0x4f1f8f
mov edx, dword [0x53b7b4]
mov eax, dword [0x53b7b8]
call fcn.00404b70
dec eax
jne 0x4f1f8f
mov eax, dword [0x53487c]
mov byte [eax], 1
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a74
call fcn.00404978
jne 0x4f1faa
mov eax, dword [0x534544]
mov byte [eax], 1
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2a80
call fcn.00404978
je 0x4f1fd4
mov eax, dword [0x534748]
mov eax, dword [eax]
mov edx, 0x4f2a80
call fcn.00404978
je 0x4f1fd4
xor eax, eax
jmp 0x4f1fd6
mov al, 1
test al, al
je 0x4f2002
mov eax, 0x7d0
call fcn.004d25dc
mov eax, dword [0x534470]
mov eax, dword [eax]
call fcn.0046d6bc
test al, al
je 0x4f2016
mov eax, dword [0x534470]
mov eax, dword [eax]
call fcn.004098f0
jmp 0x4f2016
mov eax, dword [0x534544]
cmp byte [eax], 1
jne 0x4f2016
mov eax, 0x7d0
call fcn.004d25dc
lea edx, [ebp - 0x7c]
mov eax, 0x11b
call fcn.004a94e4
mov eax, dword [ebp - 0x7c]
push eax
lea edx, [ebp - 0x80]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x80]
pop edx
call fcn.0046cc88
mov eax, dword [0x534544]
cmp byte [eax], 1
jne 0x4f21dd
mov eax, dword [0x53487c]
cmp byte [eax], 0
jne 0x4f21dd
lea edx, [ebp - 0x88]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x88]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x84]
call fcn.00404880
mov eax, dword [ebp - 0x84]
call fcn.0046d6bc
test al, al
je 0x4f21dd
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [0x53b7c0], eax
lea edx, [ebp - 0x94]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x94]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.00404880
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
call fcn.00404e38
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [0x53b7c0]
push eax
call fcn.0046d9d4
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4f21d3
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4f2191
lea ecx, [ebp - 0x98]
mov edx, ebx
mov eax, dword [0x53b7c0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x98]
mov eax, 0x53b7c8
call fcn.004045d0
lea edx, [ebp - 0x9c]
mov eax, 0xa
call fcn.004a94e4
mov ecx, dword [ebp - 0x9c]
mov eax, 0x53b7c4
mov edx, dword [0x53b7c8]
call fcn.00404880
push 1
mov eax, 0x53b7c8
call fcn.00404a84
push eax
mov eax, 0x53b7c4
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4f218b
mov edx, ebx
mov eax, dword [0x53b7c0]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4f2116
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4f21d3
lea edx, [ebp - 0xa4]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
call fcn.00404880
mov eax, dword [ebp - 0xa0]
call fcn.004098f0
mov eax, dword [0x53b7c0]
call fcn.00403770
mov eax, dword [0x534654]
mov dword [eax], 0x20
lea eax, [ebp - 0xa8]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f225a
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xac]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xac]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f229d
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb0]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f22e0
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb4]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov ebx, eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x534180]
mov dword [edx], eax
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.004480b4
call fcn.004a9d58
mov ecx, dword [0x534868]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4b0818]
call fcn.004480cc
mov ecx, dword [0x53467c]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4ae984]
call fcn.004480cc
mov edx, dword [0x534974]
mov edx, dword [edx]
mov eax, dword [0x534868]
mov eax, dword [eax]
call fcn.004576d8
mov ecx, dword [0x534250]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4cf8f8]
call fcn.004480cc
mov edx, dword [0x5346d8]
mov edx, dword [edx]
mov eax, dword [0x534250]
mov eax, dword [eax]
call fcn.004576d8
mov ecx, dword [0x534384]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4ac880]
call fcn.004480cc
mov eax, dword [0x534250]
mov eax, dword [eax]
mov edx, dword [0x534868]
mov edx, dword [edx]
mov dword [edx + 0x31c], eax
lea edx, [ebp - 0xbc]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408dc0
mov eax, dword [ebp - 0xb8]
mov edx, 0x4f29f0
call fcn.00404978
jne 0x4f247f
lea edx, [ebp - 0xc0]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xc0]
mov ecx, 0x1a803549
mov edx, 0x4f2a8c
call fcn.0046c7e8
lea edx, [ebp - 0xc8]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00408dc0
mov eax, dword [ebp - 0xc4]
mov edx, 0x4f2a9c
call fcn.00404978
jne 0x4f245f
lea edx, [ebp - 0xcc]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xcc]
mov ecx, 0x1a803549
mov edx, 0x4f2aa8
call fcn.0046c7e8
jmp 0x4f247f
lea edx, [ebp - 0xd0]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xd0]
mov edx, 0x4f2aa8
call fcn.0046cc88
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov edx, dword [0x534708]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534704]
mov dword [edx], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xdc]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0xdc]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xd8]
call fcn.00404880
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0xd4]
push eax
push ebx
call fcn.0046d9d4
test al, al
je 0x4f2500
mov byte [0x53b7ec], 1
cmp byte [0x53b7ec], 0
je 0x4f2666
jmp 0x4f2652
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00408fd4
mov edx, dword [ebp - 0xe0]
mov eax, 0x53b7bc
call fcn.004045d0
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [0x53b7bc], 0
je 0x4f26f9
mov edx, dword [0x53b7bc]
mov eax, 0x4f2ab8
call fcn.00404b70
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4f2581
mov edx, dword [0x53b7bc]
mov eax, 0x4f2ac4
call fcn.00404b70
mov dword [esi], eax
cmp dword [esi], 0
je 0x4f26f9
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [esi]
dec ecx
mov edx, 1
mov eax, dword [0x53b7bc]
call fcn.00404a8c
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00408fd4
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x534708]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf4]
push eax
mov edx, dword [esi]
inc edx
mov ecx, 0x400
mov eax, dword [0x53b7bc]
call fcn.00404a8c
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00408fd4
mov edx, dword [ebp - 0xf0]
mov eax, 0x53b7bc
call fcn.004045d0
mov eax, dword [0x53b7bc]
cmp byte [eax], 0x7c
jne 0x4f263a
mov eax, 0x53b7bc
mov ecx, 1
mov edx, 1
call fcn.00404acc
mov eax, dword [0x53b7bc]
call fcn.004093f8
mov edx, eax
neg edx
mov eax, dword [0x534704]
mov eax, dword [eax]
call fcn.00416c4c
jmp 0x4f2652
mov eax, dword [0x53b7bc]
call fcn.004093f8
mov edx, eax
mov eax, dword [0x534704]
mov eax, dword [eax]
call fcn.00416c4c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4f2512
jmp 0x4f26f9
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov eax, dword [0x5342b8]
push dword [eax]
push 0x4f2ad0
push dword [0x53b7e8]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f10c4
test al, al
jne 0x4f2652
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xfc]
mov ecx, dword [0x53b7e8]
call fcn.00404880
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f10c4
test al, al
jne 0x4f2652
mov eax, ebx
call fcn.00403770
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4f2732
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, 0x4f2ae4
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x534704]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00416c4c
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4f275c
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040307c
mov edx, dword [0x5342ec]
mov dword [edx], eax
jmp 0x4f2765
mov eax, dword [0x5342ec]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.0044814c
mov eax, dword [0x534494]
call fcn.0040e218
mov eax, 0x5340c8
call fcn.0040e218
mov eax, dword [0x5342d8]
cmp byte [eax], 0
je 0x4f27c5
push 1
push 0x4f2af8
push 0x4f2af8
lea edx, [ebp - 0x100]
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.00448738
mov eax, dword [ebp - 0x100]
call fcn.00404a2c
push eax
push 0x4f2afc
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5341f4]
cmp byte [eax], 0
je 0x4f290d
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov ebx, eax
lea edx, [ebp - 0x10c]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
call fcn.00404880
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00404e38
mov eax, dword [ebp - 0x104]
push eax
push ebx
call fcn.0046d9d4
test al, al
jne 0x4f2906
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov eax, dword [0x5342b8]
push dword [eax]
push 0x4f2ad0
push dword [0x53b7e8]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f10c4
test al, al
jne 0x4f28bf
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x114]
mov ecx, dword [0x53b7e8]
call fcn.00404880
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f10c4
test al, al
je 0x4f2906
lea edx, [ebp - 0x120]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0x120]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x11c]
call fcn.00404880
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00404e38
mov eax, dword [ebp - 0x118]
push eax
push ebx
call fcn.0046d968
mov eax, ebx
call fcn.00403770
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f29d1
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x118]
call fcn.00404c98
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.004045a0
lea eax, [ebp - 0x104]
call fcn.00404c98
lea eax, [ebp - 0x100]
mov edx, 0xb
call fcn.004045a0
lea eax, [ebp - 0xd4]
call fcn.00404c98
lea eax, [ebp - 0xd0]
mov edx, 7
call fcn.004045a0
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0xa4]
mov edx, 6
call fcn.004045a0
lea eax, [ebp - 0x8c]
call fcn.00404c98
lea eax, [ebp - 0x88]
mov edx, 0x1e
call fcn.004045a0
ret