Function at 0x40cba5
Capabilities:
Check for time delay via gettickcount
Create directory
Get geographical location
Parse pe header
Set file attributes
Set uefi variable

Disassembly:
push 0x244
mov eax, 0x44145b
call fcn.0042b376
mov ebx, ecx
mov dword [ebp - 0x130], ebx
push ebx
mov dword [ebp - 4], 6
call fcn.0041f382
lea eax, [ebx + 0x18]
push eax
mov byte [ebp - 4], 7
call fcn.00405636
lea eax, [ebx + 0xe0]
push eax
mov byte [ebp - 4], 8
call fcn.00402091
lea edi, [ebx + 0x138]
mov dword [ebp - 0x16c], edi
call fcn.00426071
lea esi, [ebx + 0x180]
call fcn.00402e5f
lea esi, [ebx + 0x19c]
mov dword [ebp - 0x168], esi
call fcn.00402e5f
lea esi, [ebx + 0x1b8]
call fcn.00402e5f
lea esi, [ebx + 0x1d8]
mov dword [ebp - 0x164], esi
call fcn.00402e5f
lea esi, [ebx + 0x1f8]
call fcn.00402e5f
lea eax, [ebx + 0x214]
push eax
mov byte [ebp - 4], 0xf
call fcn.00417a22
lea eax, [ebx + 0x22c]
push eax
mov byte [ebp - 4], 0x10
call fcn.00417a22
lea esi, [ebx + 0x244]
mov dword [ebp - 0x15c], esi
call fcn.00402e5f
lea esi, [ebx + 0x260]
mov dword [ebp - 0x134], esi
call fcn.00402e5f
lea esi, [ebx + 0x288]
call fcn.00402e5f
lea esi, [ebx + 0x2a4]
call fcn.00402e5f
push 4
mov byte [ebp - 4], 0x15
lea esi, [ebx + 0x2c0]
call fcn.0042a190
pop ecx
test eax, eax
je 0x40ccac
mov dword [eax], esi
jmp 0x40ccae
xor eax, eax
mov dword [esi], eax
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
lea esi, [ebx + 0x2d8]
push 4
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x170], esi
call fcn.0042a190
pop ecx
cmp eax, edi
je 0x40ccdb
mov dword [eax], esi
jmp 0x40ccdd
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
push 4
mov byte [ebp - 4], 0x19
lea esi, [ebx + 0x2f0]
call fcn.0042a190
pop ecx
cmp eax, edi
je 0x40cd02
mov dword [eax], esi
jmp 0x40cd04
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
lea esi, [ebx + 0x30c]
call fcn.00402e5f
lea esi, [ebx + 0x328]
mov dword [ebp - 0x158], esi
call fcn.00402e5f
lea esi, [ebx + 0x344]
call fcn.00402e5f
lea esi, [ebx + 0x360]
call fcn.00402e5f
lea esi, [ebx + 0x37c]
call fcn.00402e5f
mov byte [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40cd75
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
jmp 0x40cd77
xor eax, eax
dec eax
jne 0x40cd84
call fcn.0040cb42
call fcn.0040958f
cmp dword [0x4558e0], 3
jne 0x40cd92
call fcn.0040e391
push edi
call fcn.0042a13f
lea eax, [ebp - 0x121]
pop ecx
mov byte [ebp - 0x121], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cda9
sub eax, edx
je 0x40cdbe
call fcn.004095d8
call fcn.0040966c
mov ecx, ebx
call fcn.0040e439
or esi, 0xffffffff
push esi
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x180]
call fcn.004031c2
push esi
push edi
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebx + 0x30c]
call fcn.004031c2
mov ecx, dword [ebp - 0x158]
push esi
push edi
lea eax, [ebp + 0x40]
push eax
call fcn.004031c2
push esi
push edi
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebx + 0x344]
call fcn.004031c2
push esi
push edi
lea eax, [ebp + 0x78]
push eax
lea ecx, [ebx + 0x360]
call fcn.004031c2
push esi
push edi
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebx + 0x37c]
call fcn.004031c2
push esi
push edi
lea eax, [ebp + 0xb0]
push eax
lea ecx, [ebx + 0x2a4]
call fcn.004031c2
lea eax, [ebp - 0x121]
mov byte [ebp - 0x121], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ce55
sub eax, esi
je 0x40ce91
push 4
lea eax, [ebp - 0x120]
push eax
push 0x20001009
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x154]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call fcn.004096af
sub esp, 0x1c
lea eax, [ebx + 0x30c]
mov ecx, esp
mov dword [ebp - 0x120], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov byte [ebp - 4], 0x21
lea eax, [ebx + 0x360]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov byte [ebp - 4], 0x22
lea eax, [ebx + 0x344]
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov byte [ebp - 4], 0x23
mov ecx, esp
mov dword [ebp - 0x128], esp
push dword [ebp - 0x158]
call fcn.00402e94
lea ecx, [ebx + 0xe0]
mov byte [ebp - 4], 0x20
call fcn.004021c8
mov esi, ebx
call fcn.0040e82c
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x17a]
push eax
call fcn.00428e0f
pop ecx
call fcn.00428e21
cdq
push 0xa
pop ecx
idiv ecx
mov esi, edx
call fcn.00428e21
cdq
push 0xa
pop ecx
idiv ecx
cmp esi, edx
setl al
test al, al
je 0x40cf6c
movzx eax, al
mov dword [ebp - 0x120], eax
fild dword [ebp - 0x120]
call fcn.00439020
fstp dword [ebp - 0x120]
fld dword [ebp - 0x120]
jmp 0x40cf7f
fldz
call fcn.00438ef0
fstp dword [ebp - 0x120]
fld dword [ebp - 0x120]
call fcn.00439110
cmp eax, edi
je 0x40cf92
call fcn.00409720
call fcn.004097b4
call fcn.0040e87e
push 0x103
lea eax, [ebp - 0x11b]
push edi
push eax
mov byte [ebp - 0x11c], 0
call fcn.00431170
add esp, 0xc
push 0x104
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d046
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x21
push 0x447d80
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov byte [ebp - 4], 0x24
call fcn.00426f82
mov byte [ebp - 4], 0x25
cmp dword [eax + 0x18], 0x10
jb 0x40d012
mov eax, dword [eax + 4]
jmp 0x40d015
add eax, 4
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
mov ebx, dword [ebp - 0x130]
jmp 0x40d058
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x11c]
push eax
call fcn.00403254
push ebx
call fcn.0040e9c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x40d071
dec eax
dec eax
je 0x40d071
sub eax, 4
jne 0x40d079
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, ebx
mov dword [ebp - 4], 0x20
call fcn.0040ebd1
test eax, eax
jge 0x40d0ff
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x17
push 0x447da4
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x28
call fcn.004270be
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x18], 0x10
jb 0x40d0ce
mov eax, dword [eax + 4]
jmp 0x40d0d1
add eax, 4
push eax
push 1
call fcn.0040e8e1
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
mov ebx, dword [ebp - 0x130]
push ebx
call fcn.0040ec69
push ebx
mov dword [ebp - 4], 0x20
call fcn.0040fe9f
push ebx
call fcn.00410568
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x2c
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x45
push str.SOFTWA_0
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x2d
call fcn.00427269
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x18], 0x10
jb 0x40d176
mov eax, dword [eax + 4]
jmp 0x40d179
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x30
call fcn.0041092b
push 0
and eax, 0x80004005
push 1
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x120], eax
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x31
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x31
push 0x447e08
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov byte [ebp - 4], 0x32
call fcn.00426f18
mov byte [ebp - 4], 0x33
cmp dword [eax + 0x18], 0x10
jb 0x40d21e
mov eax, dword [eax + 4]
jmp 0x40d221
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x35
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
lea eax, [ebp - 0x121]
mov byte [ebp - 0x121], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d275
sub eax, esi
je 0x40d285
call fcn.00409825
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x36
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x45
push str.SOFTWA_0
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x37
call fcn.00427269
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x18], 0x10
jb 0x40d2e3
mov eax, dword [eax + 4]
jmp 0x40d2e6
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x3a
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
call fcn.0041e2de
test eax, eax
je 0x40d338
call fcn.004098a1
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x3b
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x31
push 0x447e3c
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov byte [ebp - 4], 0x3c
call fcn.0042700a
mov byte [ebp - 4], 0x3d
cmp dword [eax + 0x18], 0x10
jb 0x40d394
mov eax, dword [eax + 4]
jmp 0x40d397
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x3f
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
push 1
lea eax, [ebp - 0x194]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 4
push 0x447e70
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x40
call fcn.004270be
mov byte [ebp - 4], 0x41
cmp dword [eax + 0x18], 0x10
jb 0x40d420
mov eax, dword [eax + 4]
jmp 0x40d423
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push eax
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x42
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x38
push 0x447e78
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov byte [ebp - 4], 0x43
call fcn.00426f18
mov byte [ebp - 4], 0x44
cmp dword [eax + 0x18], 0x10
jb 0x40d479
mov eax, dword [eax + 4]
jmp 0x40d47c
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x46
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x244]
call fcn.00417161
push 0
push 1
lea ecx, [ebp - 0x194]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
push 1
lea eax, [ebp - 0x194]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 3
push 0x447eb4
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x47
call fcn.004270be
mov byte [ebp - 4], 0x48
cmp dword [eax + 0x18], 0x10
jb 0x40d51f
mov eax, dword [eax + 4]
jmp 0x40d522
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push eax
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x49
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x38
push str.SOFT_6_2___
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x4a
call fcn.00427269
mov byte [ebp - 4], 0x4b
cmp dword [eax + 0x18], 0x10
jb 0x40d57a
mov eax, dword [eax + 4]
jmp 0x40d57d
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, closesocket
mov byte [ebp - 4], 0x4d
call fcn.0041092b
and dword [ebp - 0x120], eax
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
call fcn.00417161
push edi
push 1
lea ecx, [ebp - 0x194]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40d603
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
xor eax, eax
inc eax
jmp 0x40d605
xor eax, eax
dec eax
jne 0x40d639
call fcn.00401d8f
push 4
lea eax, [ebp - 0x128]
push eax
push 0x20001009
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x154]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x4e
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x4f
push str.i._br.
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x4f
call fcn.0042700a
mov byte [ebp - 4], 0x50
cmp dword [eax + 0x18], 0x10
jb 0x40d695
mov eax, dword [eax + 4]
jmp 0x40d698
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, reloc.WS2_32.dll_closesocket
mov byte [ebp - 4], 0x52
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push 0x4445ef
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x53
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0x3b
push 0x447f48
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x54
call fcn.00426f18
mov byte [ebp - 4], 0x55
cmp dword [eax + 0x18], 0x10
jb 0x40d738
mov eax, dword [eax + 4]
jmp 0x40d73b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
push ebx
mov ecx, reloc.WS2_32.dll_closesocket
mov byte [ebp - 4], 0x57
call fcn.0041092b
and dword [ebp - 0x120], eax
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
cmp dword [ebp - 0x120], 0
jge 0x40d9c3
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x34
push 0x447f84
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x58
call fcn.00426f82
mov byte [ebp - 4], 0x59
cmp dword [eax + 0x18], 0x10
jb 0x40d7cd
mov eax, dword [eax + 4]
jmp 0x40d7d0
add eax, 4
push eax
push 1
call fcn.0040e8e1
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x40d81c
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x40d821
call fcn.00409935
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push dword [ebp - 0x15c]
call fcn.00402e94
lea eax, [ebp - 0x194]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x5a
mov esi, esp
mov dword [ebp - 0x12c], esp
push 0xb
push 0x447fbc
call fcn.0040801d
lea edi, [ebp - 0x244]
call fcn.00426ea5
mov byte [ebp - 4], 0x5b
call fcn.00426f82
mov byte [ebp - 4], 0x5c
cmp dword [eax + 0x18], 0x10
jb 0x40d87c
mov eax, dword [eax + 4]
jmp 0x40d87f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.00402e72
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0x5d
mov esi, esp
mov dword [ebp - 0x160], esp
push 0x31
push 0x447e3c
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x5e
call fcn.0042700a
mov byte [ebp - 4], 0x5f
cmp dword [eax + 0x18], 0x10
jb 0x40d8d5
mov eax, dword [eax + 4]
jmp 0x40d8d8
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402e72
push dword [ebp - 0x130]
mov byte [ebp - 4], 0x63
call fcn.00417185
push ebx
push 1
lea ecx, [ebp - 0x150]
mov edi, eax
call fcn.0040329c
lea esi, [ebp - 0x1ec]
call fcn.00417161
push ebx
push 1
lea ecx, [ebp - 0x194]
call fcn.0040329c
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 0x20
call fcn.00417161
cmp edi, ebx
jge 0x40d9bd
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x26
push 0x447fc8
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x64
call fcn.00426f18
mov byte [ebp - 4], 0x65
cmp dword [eax + 0x18], 0x10
jb 0x40d979
mov eax, dword [eax + 4]
jmp 0x40d97c
add eax, 4
mov ebx, dword [ebp - 0x130]
push eax
push 1
call fcn.0040e8e1
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
call fcn.0040121a
test eax, eax
je 0x40d9bd
call fcn.004099b1
call fcn.00409a22
mov ebx, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x170]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
test eax, eax
jne 0x40da4d
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x21
push 0x447ff0
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x66
call fcn.0042700a
mov byte [ebp - 4], 0x67
cmp dword [eax + 0x18], 0x10
jb 0x40da1c
mov eax, dword [eax + 4]
jmp 0x40da1f
add eax, 4
push eax
push 1
call fcn.0040e8e1
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
mov ebx, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x134]
push 0xffffffffffffffff
xor esi, esi
push esi
push dword [ebp - 0x168]
call fcn.004031c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x40da76
dec eax
dec eax
je 0x40da76
sub eax, 4
jne 0x40da85
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00409a93
mov eax, dword [ebx + 0x274]
cmp eax, esi
je 0x40dab8
lea edi, [eax - 1]
mov eax, dword [ebp - 0x134]
call fcn.00408121
cmp byte [eax], 0x5c
je 0x40dab8
mov edi, dword [ebp - 0x134]
xor ebx, ebx
push 0x5c
inc ebx
call fcn.0040842d
mov ebx, dword [ebp - 0x130]
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 8
push 0x448014
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x68
call fcn.004270be
mov byte [ebp - 4], 0x69
cmp dword [eax + 0x18], 0x10
jb 0x40dafb
mov eax, dword [eax + 4]
jmp 0x40dafe
add eax, 4
push eax
push dword [ebp - 0x134]
call fcn.004080db
xor edi, edi
push 0
inc edi
push edi
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push dword [ebp - 0x134]
call fcn.00402e94
call fcn.0040eb99
test eax, eax
jge 0x40dc10
mov esi, dword [ebp - 0x134]
cmp dword [esi + 0x18], 0x10
jb 0x40db5e
mov eax, dword [esi + 4]
jmp 0x40db61
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40db93
cmp dword [esi + 0x18], 0x10
jb 0x40db79
mov esi, dword [esi + 4]
jmp 0x40db7c
add esi, 4
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00401271
mov dword [ebp - 4], 0x20
jmp 0x40dc10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x150]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x128], esp
push 0x24
push 0x448020
call fcn.0040801d
lea edi, [ebp - 0x1ec]
call fcn.00426ea5
mov byte [ebp - 4], 0x6c
call fcn.00426f82
mov byte [ebp - 4], 0x6d
cmp dword [eax + 0x18], 0x10
jb 0x40dbdb
mov eax, dword [eax + 4]
jmp 0x40dbde
add eax, 4
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x150]
call fcn.0040329c
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x20
call fcn.00417161
mov ebx, dword [ebp - 0x130]
xor edi, edi
inc edi
push dword [ebp - 0x158]
lea ecx, [ebp - 0x154]
call fcn.00402e94
push dword [ebp - 0x164]
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x6e
call fcn.00402e94
mov esi, dword [ebp - 0x16c]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x194]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 0x70
call fcn.004031c2
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x154]
push eax
mov ecx, esi
call fcn.004031c2
mov ax, word [ebp + 0xcc]
mov word [esi + 0x1c], ax
mov dword [esi + 0x3c], edi
xor esi, esi
push esi
push edi
lea ecx, [ebp - 0x194]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp - 0x154]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 8]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0x24]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0x40]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0x5c]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0x78]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0x94]
call fcn.0040329c
push esi
push edi
lea ecx, [ebp + 0xb0]
call fcn.0040329c
mov eax, ebx
call fcn.0042b3f9
ret 0xc8