Function at 0x404f50
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47fae8
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x49a6f0]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push esi
push edi
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x420]
mov dword fs:[0], eax
push method.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.virtual_20
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ebx, ebx
push ebx
mov dword [esp + 0x2c], ebx
call fcn.0045b2c2
add esp, 4
push eax
call fcn.0045c716
add esp, 4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esp + 0x24], eax
je 0x404fdb
push ebx
push ebx
push eax
push 0x424d00
push ebx
push ebx
call fcn.0045c83f
add esp, 0x18
mov dword [esp + 0x28], eax
push str.start...
call fcn.004049a0
add esp, 4
call fcn.0040f1c0
test al, al
je 0x405003
push 0x483d70
call fcn.004049a0
add esp, 4
jmp 0x4063e5
call fcn.00402950
test al, al
je 0x40501e
push 0x483d7c
call fcn.004049a0
add esp, 4
jmp 0x4063e5
push 0x24
push str.55929495_6657_1C9B_5EB6_07E4F4CF7E8A
lea ecx, [esp + 0x124]
mov dword [esp + 0x13c], 0xf
mov dword [esp + 0x138], ebx
mov byte [esp + 0x128], bl
call fcn.00402ed0
mov dword [esp + 0x428], ebx
mov eax, dword [esp + 0x120]
mov esi, 0x10
cmp dword [esp + 0x134], esi
jae 0x40506d
lea eax, [esp + 0x120]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4050c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x428], 0xffffffff
cmp dword [esp + 0x134], esi
jb 0x4050b1
mov eax, dword [esp + 0x120]
push eax
call fcn.0045ac5a
add esp, 4
mov dword [esp + 0x134], 0xf
jmp 0x4063d7
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str.._KI_Process_Protect__
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405108
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 4
lea edx, [esp + 0x24]
push edx
push 0x222004
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp edi, ebx
je 0x405113
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x483db0
call fcn.004049a0
add esp, 4
mov edi, 0x49b8b8
call fcn.004023a0
test al, al
jne 0x405140
push 0x483dbc
call fcn.004049a0
add esp, 4
jmp 0x40508d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x49b8f4
mov byte [ecx + 4], bl
call fcn.004032f0
call fcn.00429710
add esp, 0x1c
push 0x78
call fcn.0045b07a
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, ebx
mov byte [esp + 0x428], 1
mov edi, 0xf
je 0x4051b3
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 2
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x483dc8
mov byte [ecx + 4], bl
call fcn.00402ed0
call fcn.00404610
mov esi, eax
jmp 0x4051b5
xor esi, esi
mov ecx, esi
mov byte [esp + 0x428], bl
call fcn.00428580
lea ecx, [esp + 0x2b8]
push ecx
mov dword [esp + 0x2b4], edi
mov dword [esp + 0x2b0], ebx
mov byte [esp + 0x2a0], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x2b4], esi
mov dword [esp + 0x2d0], ebx
push 0x483dcc
mov byte [esp + 0x42c], 2
call fcn.004049a0
add esp, 4
mov dword [esp + 0x18c], edi
mov dword [esp + 0x188], ebx
mov byte [esp + 0x178], bl
push 6
push str.BFC001
lea ecx, [esp + 0x17c]
mov byte [esp + 0x430], 3
call fcn.00402ed0
mov dword [esp + 0x278], edi
mov dword [esp + 0x274], ebx
mov byte [esp + 0x264], bl
mov dword [esp + 0x294], edi
mov dword [esp + 0x290], ebx
mov byte [esp + 0x280], bl
lea edx, [esp + 0x174]
push edx
lea eax, [esp + 0x194]
push eax
lea ecx, [esp + 0x268]
mov byte [esp + 0x430], 4
call fcn.00411100
add esp, 8
mov byte [esp + 0x428], 5
cmp byte [esp + 0x190], bl
jne 0x4053c5
lea ecx, [esp + 0x194]
push ecx
mov ecx, 0x483de0
lea edi, [esp + 0x15c]
call fcn.00406fc0
add esp, 4
mov byte [esp + 0x428], 6
mov eax, dword [esp + 0x15c]
mov esi, 0x10
cmp dword [esp + 0x170], esi
jae 0x4052df
lea eax, [esp + 0x15c]
push eax
call fcn.004049a0
add esp, 4
cmp dword [esp + 0x170], esi
jb 0x405301
mov edx, dword [esp + 0x15c]
push edx
call fcn.0045ac5a
add esp, 4
cmp dword [esp + 0x1ac], esi
mov dword [esp + 0x170], 0xf
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
jb 0x405333
mov eax, dword [esp + 0x198]
push eax
call fcn.0045ac5a
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x260]
mov dword [esp + 0x1ac], edi
mov dword [esp + 0x1a8], ebx
mov byte [esp + 0x198], bl
call fcn.00406470
mov esi, 0x10
cmp dword [esp + 0x18c], esi
jb 0x405377
mov ecx, dword [esp + 0x178]
push ecx
call fcn.0045ac5a
add esp, 4
lea edx, [esp + 0x298]
push edx
mov dword [esp + 0x190], edi
mov dword [esp + 0x18c], ebx
mov byte [esp + 0x17c], bl
mov byte [esp + 0x42c], bl
call fcn.004046c0
mov dword [esp + 0x428], 0xffffffff
cmp dword [esp + 0x134], esi
jb 0x4063d0
mov eax, dword [esp + 0x120]
push eax
jmp 0x4063c8
mov esi, 0xf
mov dword [esp + 0x2ec], esi
mov dword [esp + 0x2e8], ebx
mov byte [esp + 0x2d8], bl
mov dword [esp + 0x308], esi
mov dword [esp + 0x304], ebx
mov byte [esp + 0x2f4], bl
mov dword [esp + 0x324], esi
mov dword [esp + 0x320], ebx
mov byte [esp + 0x310], bl
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x17c]
push ecx
lea ecx, [esp + 0x2e0]
mov byte [esp + 0x434], 7
call fcn.004032f0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x268]
push edx
lea ecx, [esp + 0x2fc]
call fcn.004032f0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x284]
push eax
lea ecx, [esp + 0x318]
call fcn.004032f0
mov dword [esp + 0x1c8], esi
mov dword [esp + 0x1c4], ebx
mov byte [esp + 0x1b4], bl
lea ecx, [esp + 0x1b0]
push ecx
lea edx, [esp + 0x2d8]
push edx
lea edi, [esp + 0x1f0]
mov byte [esp + 0x430], 8
call fcn.00410e40
add esp, 8
mov byte [esp + 0x428], 9
mov cl, byte [eax]
push 0xffffffffffffffff
push ebx
add eax, 4
mov byte [esp + 0x198], cl
push eax
lea ecx, [esp + 0x1a0]
call fcn.004032f0
mov edi, 0x10
mov byte [esp + 0x428], 8
cmp dword [esp + 0x204], edi
jb 0x4054dc
mov edx, dword [esp + 0x1f0]
push edx
call fcn.0045ac5a
add esp, 4
cmp byte [esp + 0x190], bl
jne 0x4055c2
lea eax, [esp + 0x194]
push eax
mov ecx, 0x483df0
lea edi, [esp + 0x15c]
call fcn.00406fc0
add esp, 4
mov byte [esp + 0x428], 0xa
mov eax, dword [esp + 0x15c]
mov edi, 0x10
cmp dword [esp + 0x170], edi
jae 0x405529
lea eax, [esp + 0x15c]
push eax
call fcn.004049a0
add esp, 4
cmp dword [esp + 0x170], edi
jb 0x40554b
mov ecx, dword [esp + 0x15c]
push ecx
call fcn.0045ac5a
add esp, 4
cmp dword [esp + 0x1c8], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
jb 0x405579
mov edx, dword [esp + 0x1b4]
push edx
call fcn.0045ac5a
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x2d4]
mov dword [esp + 0x1c8], edi
mov dword [esp + 0x1c4], ebx
mov byte [esp + 0x1b4], bl
call fcn.00406520
cmp dword [esp + 0x1ac], 0x10
jb 0x405338
mov eax, dword [esp + 0x198]
push eax
call fcn.0045ac5a
add esp, 4
jmp 0x405338
mov dword [esp + 0x37c], esi
mov dword [esp + 0x378], ebx
mov byte [esp + 0x368], bl
mov dword [esp + 0x398], esi
mov dword [esp + 0x394], ebx
mov byte [esp + 0x384], bl
mov dword [esp + 0x3b4], esi
mov dword [esp + 0x3b0], ebx
mov byte [esp + 0x3a0], bl
lea ecx, [esp + 0x1b0]
push ecx
lea edx, [esp + 0x368]
push edx
mov byte [esp + 0x430], 0xb
call fcn.0040d400
test al, al
jne 0x4056e3
push 0x483e00
lea ecx, [esp + 0x13c]
call fcn.00402de0
mov byte [esp + 0x428], 0xc
cmp dword [esp + 0x150], edi
mov eax, dword [esp + 0x13c]
jae 0x405656
lea eax, [esp + 0x13c]
push eax
call fcn.004049a0
add esp, 4
lea ecx, [esp + 0x138]
call fcn.00402e50
lea esi, [esp + 0x364]
call fcn.00406520
lea ecx, [esp + 0x1b0]
call fcn.00402e50
lea esi, [esp + 0x2d4]
call fcn.00406520
lea esi, [esp + 0x190]
call fcn.004064c0
lea esi, [esp + 0x260]
call fcn.00406470
lea esi, [esp + 0x174]
call fcn.00406440
lea eax, [esp + 0x298]
push eax
mov byte [esp + 0x42c], bl
call fcn.004046c0
lea ecx, [esp + 0x11c]
mov dword [esp + 0x428], 0xffffffff
call fcn.00402e50
jmp 0x4063e5
push 0x483e0c
call fcn.004049a0
add esp, 4
mov dword [esp + 0x1e4], esi
mov dword [esp + 0x1e0], ebx
mov byte [esp + 0x1d0], bl
mov dword [esp + 0x220], esi
mov dword [esp + 0x21c], ebx
mov byte [esp + 0x20c], bl
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x36c]
push ecx
lea ecx, [esp + 0x214]
mov byte [esp + 0x434], 0xe
call fcn.004032f0
mov dword [esp + 0x344], esi
mov dword [esp + 0x340], ebx
mov byte [esp + 0x330], bl
mov dword [esp + 0x360], esi
mov dword [esp + 0x35c], ebx
mov byte [esp + 0x34c], bl
lea edx, [esp + 0x208]
push edx
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x334]
mov byte [esp + 0x430], 0xf
call fcn.00411100
add esp, 8
mov byte [esp + 0x428], 0x10
cmp byte [esp + 0x1e8], bl
jne 0x405875
lea ecx, [esp + 0x1ec]
push ecx
mov ecx, 0x483e18
lea edi, [esp + 0x13c]
call fcn.00406fc0
add esp, 4
mov byte [esp + 0x428], 0x11
cmp dword [esp + 0x150], 0x10
mov eax, dword [esp + 0x13c]
jae 0x4057db
lea eax, [esp + 0x13c]
push eax
call fcn.004049a0
add esp, 4
lea ecx, [esp + 0x138]
call fcn.00402e50
lea esi, [esp + 0x1e8]
call fcn.004064c0
lea esi, [esp + 0x32c]
call fcn.00406470
lea esi, [esp + 0x208]
call fcn.00406440
lea ecx, [esp + 0x1cc]
call fcn.00402e50
lea esi, [esp + 0x364]
call fcn.00406520
lea ecx, [esp + 0x1b0]
call fcn.00402e50
lea esi, [esp + 0x2d4]
call fcn.00406520
lea esi, [esp + 0x190]
call fcn.004064c0
lea esi, [esp + 0x260]
call fcn.00406470
lea esi, [esp + 0x174]
call fcn.00406440
lea edx, [esp + 0x298]
push edx
jmp 0x4056bb
lea eax, [esp + 0x3bc]
call fcn.004064f0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0x3c8]
mov byte [esp + 0x434], 0x12
call fcn.004032f0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x334]
push ecx
lea ecx, [esp + 0x3e4]
call fcn.004032f0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x350]
push edx
lea ecx, [esp + 0x400]
call fcn.004032f0
mov dword [esp + 0x25c], 0xf
mov dword [esp + 0x258], ebx
mov byte [esp + 0x248], bl
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0x3c0]
push ecx
lea edi, [esp + 0x140]
mov byte [esp + 0x430], 0x13
call fcn.00410e40
add esp, 8
mov byte [esp + 0x428], 0x14
mov dl, byte [eax]
push 0xffffffffffffffff
push ebx
add eax, 4
push eax
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x1f4], dl
call fcn.004032f0
mov esi, edi
mov byte [esp + 0x428], 0x13
call fcn.004064c0
cmp byte [esp + 0x1e8], bl
jne 0x405a3c
lea eax, [esp + 0x1ec]
push eax
mov ecx, 0x483e28
lea edi, [esp + 0x13c]
call fcn.00406fc0
add esp, 4
mov byte [esp + 0x428], 0x15
cmp dword [esp + 0x150], 0x10
mov eax, dword [esp + 0x13c]
jae 0x40598a
lea eax, [esp + 0x13c]
push eax
call fcn.004049a0
add esp, 4
lea ecx, [esp + 0x138]
call fcn.00402e50
lea ecx, [esp + 0x244]
call fcn.00402e50
lea esi, [esp + 0x3bc]
call fcn.00406520
lea esi, [esp + 0x1e8]
call fcn.004064c0
lea esi, [esp + 0x32c]
call fcn.00406470
lea esi, [esp + 0x208]
call fcn.00406440
lea ecx, [esp + 0x1cc]
call fcn.00402e50
lea esi, [esp + 0x364]
call fcn.00406520
lea ecx, [esp + 0x1b0]
call fcn.00402e50
lea esi, [esp + 0x2d4]
call fcn.00406520
lea esi, [esp + 0x190]
call fcn.004064c0
lea esi, [esp + 0x260]
call fcn.00406470
lea esi, [esp + 0x174]
call fcn.00406440
lea ecx, [esp + 0x298]
push ecx
jmp 0x4056bb
lea edx, [esp + 0x138]
push edx
call fcn.0040ed50
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x434], 0x16
call fcn.004032f0
lea ecx, [esp + 0x138]
mov byte [esp + 0x428], 0x13
call fcn.00402e50
sub esp, 0x1c
lea eax, [esp + 0x1e8]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
lea esi, [esp + 0x264]
call fcn.00402e20
mov ecx, esi
call fcn.0040f030
add esp, 0x1c
lea esi, [esp + 0x158]
call fcn.00404c30
mov ecx, 0x483c32
mov eax, esi
mov byte [esp + 0x428], 0x17
call fcn.00402fe0
test eax, eax
je 0x405b33
push 0x483e38
lea ecx, [esp + 0x13c]
call fcn.00402de0
mov byte [esp + 0x428], 0x18
mov eax, dword [esp + 0x13c]
mov esi, 0x10
cmp dword [esp + 0x150], esi
jae 0x405af8
lea eax, [esp + 0x13c]
push eax
call fcn.004049a0
mov eax, dword [esp + 0x160]
add esp, 4
cmp dword [esp + 0x170], esi
jae 0x405b18
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x138]
mov byte [esp + 0x428], 0x17
call fcn.00402e50
lea esi, [esp + 0x18]
call fcn.004065a0
push 1
lea ecx, [esp + 0x228]
call fcn.0041da70
push str.code
lea ecx, [esp + 0xa0]
mov byte [esp + 0x42c], 0x1a
call fcn.00402de0
mov eax, str.install
lea esi, [esp + 0xec]
mov byte [esp + 0x428], 0x1b
call fcn.0041db00
push str.action
lea ecx, [esp + 0x84]
mov byte [esp + 0x42c], 0x1c
call fcn.00402de0
mov eax, str.360se
lea esi, [esp + 0xd4]
mov byte [esp + 0x428], 0x1d
call fcn.0041db00
push str.name
lea ecx, [esp + 0x4c]
mov byte [esp + 0x42c], 0x1e
call fcn.00402de0
lea esi, [esp + 0xb8]
mov byte [esp + 0x428], 0x1f
call fcn.00425930
lea esi, [esp + 0x104]
mov byte [esp + 0x428], 0x20
call fcn.0041db40
push str.time
lea ecx, [esp + 0x68]
mov byte [esp + 0x42c], 0x21
call fcn.00402de0
mov eax, 0x483e48
lea esi, [esp + 0x2c]
mov byte [esp + 0x428], 0x22
call fcn.0041db00
push str.type
lea ecx, [esp + 0x13c]
mov byte [esp + 0x42c], 0x23
call fcn.00402de0
lea ecx, [esp + 0x224]
push ecx
push ecx
lea edx, [esp + 0xf4]
push edx
push ecx
lea eax, [esp + 0xe4]
push eax
push ecx
lea ecx, [esp + 0x11c]
push ecx
mov edx, esi
push ecx
push edx
lea edi, [esp + 0x15c]
lea esi, [esp + 0x3c]
mov byte [esp + 0x44c], 0x24
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x80]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x5c]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x8c]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0xa0]
mov esi, eax
call fcn.004289c0
lea ecx, [esp + 0x138]
call fcn.00402e50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x428], 0x22
call fcn.0041dd60
lea ecx, [esp + 0x64]
call fcn.00402e50
lea ecx, [esp + 0x104]
mov byte [esp + 0x428], 0x20
call fcn.0041dd60
lea ecx, [esp + 0xb8]
call fcn.00402e50
lea ecx, [esp + 0x48]
call fcn.00402e50
lea ecx, [esp + 0xd4]
mov byte [esp + 0x428], 0x1d
call fcn.0041dd60
lea ecx, [esp + 0x80]
call fcn.00402e50
lea ecx, [esp + 0xec]
mov byte [esp + 0x428], 0x1b
call fcn.0041dd60
mov ecx, edi
call fcn.00402e50
lea ecx, [esp + 0x224]
mov byte [esp + 0x428], 0x19
call fcn.0041dd60
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x29c]
call fcn.00429530
mov ecx, edi
call fcn.004295f0
lea eax, [esp + 0x18]
mov byte [esp + 0x428], 0x17
call fcn.004066b0
mov dword [esp + 0x14], ebx
lea esp, [esp]
push 0x483e84
call fcn.004049a0
mov eax, dword [esp + 0x1d4]
add esp, 4
cmp dword [esp + 0x1e4], 0x10
jae 0x405da5
lea eax, [esp + 0x1d0]
push 1
push ebx
push str.__silent_install3_1_1___360se_pid3112914
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edi, edi
lea esp, [esp]
lea esi, [esp + 0x224]
call fcn.00404c30
mov ecx, 0x483c32
mov eax, esi
mov byte [esp + 0x428], 0x25
call fcn.00402fe0
test eax, eax
jne 0x405e36
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x10
mov byte [esp + 0x428], 0x17
cmp dword [esp + 0x23c], esi
jb 0x405e15
mov ecx, dword [esp + 0x228]
push ecx
call fcn.0045ac5a
add esp, 4
add edi, 1
cmp edi, 0x1e
jl 0x405dc0
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x14], eax
jl 0x405d80
jmp 0x4061d5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x248]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.004032f0
call fcn.00404e50
add esp, 0x1c
push 0x483ec4
call fcn.004049a0
add esp, 4
mov byte [esp + 0x428], 0x17
cmp dword [esp + 0x23c], 0x10
jb 0x405e93
mov eax, dword [esp + 0x228]
push eax
call fcn.0045ac5a
add esp, 4
call fcn.00406df0
mov dword [esp + 0x1c], eax
mov byte [eax + 0x49], 1
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], eax
mov eax, dword [esp + 0x1c]
mov dword [eax + 8], eax
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x34]
and ecx, 0xfffffe01
or ecx, 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebx
push str.code
lea ecx, [esp + 0x68]
mov byte [esp + 0x42c], 0x27
call fcn.00402de0
mov eax, str.show
lea esi, [esp + 0x104]
mov byte [esp + 0x428], 0x28
call fcn.0041db00
push str.action
lea ecx, [esp + 0x4c]
mov byte [esp + 0x42c], 0x29
call fcn.00402de0
mov eax, str.360se
lea esi, [esp + 0xd4]
mov byte [esp + 0x428], 0x2a
call fcn.0041db00
push str.name
lea ecx, [esp + 0x84]
mov byte [esp + 0x42c], 0x2b
call fcn.00402de0
lea esi, [esp + 0x138]
mov byte [esp + 0x428], 0x2c
call fcn.00425930
lea esi, [esp + 0xec]
mov byte [esp + 0x428], 0x2d
call fcn.0041db40
push str.time
lea ecx, [esp + 0xa0]
mov byte [esp + 0x42c], 0x2e
call fcn.00402de0
mov eax, 0x483e48
lea esi, [esp + 0x224]
mov byte [esp + 0x428], 0x2f
call fcn.0041db00
push str.type
lea ecx, [esp + 0xbc]
mov byte [esp + 0x42c], 0x30
call fcn.00402de0
lea edx, [esp + 0x2c]
push edx
push ecx
lea eax, [esp + 0x10c]
push eax
push ecx
lea ecx, [esp + 0xe4]
push ecx
push ecx
lea edx, [esp + 0x104]
mov byte [esp + 0x440], 0x31
push edx
mov eax, esi
push ecx
push eax
lea edi, [esp + 0xdc]
lea esi, [esp + 0x3c]
call fcn.004289c0
add esp, 4
lea edi, [esp + 0xb8]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x94]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x54]
mov esi, eax
call fcn.004289c0
add esp, 4
lea edi, [esp + 0x68]
mov esi, eax
call fcn.004289c0
cmp dword [esp + 0xd0], 0x10
jb 0x40605f
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.0045ac5a
add esp, 4
mov esi, 0xf
lea ecx, [esp + 0x224]
mov dword [esp + 0xd0], esi
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], bl
mov byte [esp + 0x428], 0x2f
call fcn.0041dd60
mov edi, 0x10
cmp dword [esp + 0xb4], edi
jb 0x4060ab
mov edx, dword [esp + 0xa0]
push edx
call fcn.0045ac5a
add esp, 4
lea ecx, [esp + 0xec]
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
mov byte [esp + 0x428], 0x2d
call fcn.0041dd60
cmp dword [esp + 0x150], edi
jb 0x4060ed
mov eax, dword [esp + 0x13c]
push eax
call fcn.0045ac5a
add esp, 4
cmp dword [esp + 0x98], edi
mov dword [esp + 0x150], esi
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x13c], bl
jb 0x40611b
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0045ac5a
add esp, 4
lea ecx, [esp + 0xd4]
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov byte [esp + 0x428], 0x2a
call fcn.0041dd60
cmp dword [esp + 0x60], edi
jb 0x406157
mov edx, dword [esp + 0x4c]
push edx
call fcn.0045ac5a
add esp, 4
lea ecx, [esp + 0x104]
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov byte [esp + 0x428], 0x28
call fcn.0041dd60
cmp dword [esp + 0x7c], edi
jb 0x40618a
mov eax, dword [esp + 0x68]
push eax
call fcn.0045ac5a
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov byte [esp + 0x428], 0x26
call fcn.0041dd60
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x29c]
call fcn.00429530
mov ecx, edi
call fcn.004295f0
lea eax, [esp + 0x18]
mov byte [esp + 0x428], 0x17
call fcn.004066b0
mov esi, 0x10
call fcn.00402660
cmp dword [esp + 0x170], esi
jb 0x4061f3
mov edx, dword [esp + 0x15c]
push edx
call fcn.0045ac5a
add esp, 4
cmp dword [esp + 0x25c], esi
mov edi, 0xf
mov dword [esp + 0x170], edi
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
jb 0x406226
mov eax, dword [esp + 0x248]
push eax
call fcn.0045ac5a
add esp, 4
lea esi, [esp + 0x3bc]
mov dword [esp + 0x25c], edi
mov dword [esp + 0x258], ebx
mov byte [esp + 0x248], bl
call fcn.00406520
cmp dword [esp + 0x204], 0x10
jb 0x406261
mov ecx, dword [esp + 0x1f0]
push ecx
call fcn.0045ac5a
add esp, 4
lea esi, [esp + 0x32c]
mov dword [esp + 0x204], edi
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
call fcn.00406470
mov esi, 0x10
cmp dword [esp + 0x220], esi
jb 0x4062a0
mov edx, dword [esp + 0x20c]
push edx
call fcn.0045ac5a
add esp, 4
cmp dword [esp + 0x1e4], esi
mov dword [esp + 0x220], edi
mov dword [esp + 0x21c], ebx
mov byte [esp + 0x20c], bl
jb 0x4062ce
mov eax, dword [esp + 0x1d0]
push eax
call fcn.0045ac5a
add esp, 4
lea esi, [esp + 0x364]
mov dword [esp + 0x1e4], edi
mov dword [esp + 0x1e0], ebx
mov byte [esp + 0x1d0], bl
call fcn.00406520
cmp dword [esp + 0x1c8], 0x10
jb 0x406309
mov ecx, dword [esp + 0x1b4]
push ecx
call fcn.0045ac5a
add esp, 4
lea esi, [esp + 0x2d4]
mov dword [esp + 0x1c8], edi
mov dword [esp + 0x1c4], ebx
mov byte [esp + 0x1b4], bl
call fcn.00406520
cmp dword [esp + 0x1ac], 0x10
jb 0x406344
mov edx, dword [esp + 0x198]
push edx
call fcn.0045ac5a
add esp, 4
lea esi, [esp + 0x260]
mov dword [esp + 0x1ac], edi
mov dword [esp + 0x1a8], ebx
mov byte [esp + 0x198], bl
call fcn.00406470
mov esi, 0x10
cmp dword [esp + 0x18c], esi
jb 0x406383
mov eax, dword [esp + 0x178]
push eax
call fcn.0045ac5a
add esp, 4
lea ecx, [esp + 0x298]
push ecx
mov dword [esp + 0x190], edi
mov dword [esp + 0x18c], ebx
mov byte [esp + 0x17c], bl
mov byte [esp + 0x42c], bl
call fcn.004046c0
mov dword [esp + 0x428], 0xffffffff
cmp dword [esp + 0x134], esi
jb 0x4063d0
mov edx, dword [esp + 0x120]
push edx
call fcn.0045ac5a
add esp, 4
mov dword [esp + 0x134], edi
mov dword [esp + 0x130], ebx
mov byte [esp + 0x120], bl
push 0x483ed8
call fcn.004049a0
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, ebx
je 0x406401
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x406419
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x420]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0045b0e4
mov esp, ebp
pop ebp
ret