Function at 0x4ed928
Capabilities:
Copy file
Create process on windows
Get common file path
Move file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x4ed930
push ebx
push esi
push edi
mov eax, 0x4ed1b8
call fcn.00406d60
mov esi, 0x53009c
mov ebx, dword [0x530a44]
xor eax, eax
push ebp
push 0x4eea2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebx]
call fcn.00409a28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d5c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004a802c
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404958
jne 0x4ed998
mov eax, dword [0x5304fc]
mov byte [eax], 0
jmp 0x4ed9a0
mov eax, dword [0x5304fc]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408d98
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5306b0]
call fcn.004045b0
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408d98
mov edx, dword [ebp - 0x28]
mov eax, dword [0x530714]
call fcn.004045b0
mov eax, dword [0x5304fc]
cmp byte [eax], 0
jne 0x4eda10
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004a802c
mov edx, dword [ebp - 0x30]
mov eax, dword [0x53052c]
call fcn.004045b0
jmp 0x4eda34
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.00409a28
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x34]
mov eax, dword [0x53052c]
call fcn.004045b0
push 0x4eea48
push dword [ebx]
push 0x4eea48
mov eax, dword [0x53077c]
mov edx, 3
call fcn.004048d4
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eea54
call fcn.00404958
jne 0x4edaf4
fld xword [0x4eea58]
mov eax, dword [0x5305b8]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4edaf4
call fcn.00469b3c
test al, al
jne 0x4edaf4
call fcn.0040af28
call fcn.00402b6c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409360
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x530714]
call fcn.004045b0
lea edx, [ebp - 0x40]
mov eax, dword [ebx]
call fcn.0046c374
mov eax, dword [ebp - 0x40]
call fcn.00404a0c
push eax
mov eax, dword [0x5306b0]
push dword [eax]
push 0x4eea6c
mov eax, dword [0x530714]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x44]
call fcn.00404a0c
push eax
mov eax, dword [ebx]
call fcn.00404a0c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00469bb8
jmp 0x4ee983
lea edx, [ebp - 0x48]
mov eax, dword [0x530810]
mov eax, dword [eax]
call fcn.00408d5c
mov edx, dword [ebp - 0x48]
mov eax, 0x537748
call fcn.004045b0
mov eax, dword [0x537748]
call fcn.00461cb8
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409360
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004a802c
mov edx, dword [ebp - 0x50]
mov eax, 0x537740
pop ecx
call fcn.00404860
mov dl, 1
mov eax, dword [0x461ac0]
call fcn.00403720
mov dword [0x530098], eax
mov edx, dword [0x537740]
mov eax, dword [0x530098]
call fcn.00461b64
test eax, eax
jne 0x4edcc0
mov eax, 0x4eea70
xor edx, edx
call fcn.004eba80
mov ebx, eax
test ebx, ebx
je 0x4ee7e1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eea84
call fcn.00404958
jne 0x4edbab
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ee7e1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eea94
call fcn.00404958
jne 0x4edbd2
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ee7e1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eeaa4
call fcn.00404958
jne 0x4edbf9
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ee7e1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eeab0
call fcn.00404958
jne 0x4ee7e1
mov edx, dword [0x530714]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x530714]
cmp dword [eax], 0
jne 0x4edc39
mov eax, dword [0x530714]
mov edx, 0x4eea6c
call fcn.004045b0
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x530714]
mov eax, dword [eax]
call fcn.00404814
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x53773c
mov ecx, 1
mov edx, dword [0x4ed16c]
call fcn.00405ea4
add esp, 4
mov eax, dword [0x530714]
call fcn.00404a64
mov edx, eax
mov eax, dword [0x53773c]
call fcn.00409bf0
mov edi, dword [0x53773c]
test esi, esi
jle 0x4edcac
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4edc92
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ee7e1
lea edx, [ebp - 0x58]
mov eax, dword [ebx]
call fcn.00409a28
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x54]
mov eax, dword [0x5309a0]
call fcn.004045b0
mov edx, dword [0x5309a0]
mov edx, dword [edx]
mov eax, 0x4eeabc
call fcn.00404b50
dec eax
jne 0x4edd6c
mov eax, dword [0x530810]
push dword [eax]
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [0x5309a0]
mov eax, dword [eax]
mov ecx, 0x400
mov edx, 9
call fcn.00404a6c
push dword [ebp - 0x5c]
push 0x4eead0
mov eax, 0x537744
mov edx, 3
call fcn.004048d4
mov eax, 0x7d0
call fcn.004d06d0
push 0
mov eax, 0x537744
call fcn.00404a64
push eax
mov eax, ebx
call fcn.00404a64
push eax
call sub.kernel32.dll_CopyFileA
mov eax, ebx
mov edx, dword [0x537744]
call fcn.004045b0
mov eax, dword [0x530714]
call fcn.0040455c
mov eax, dword [0x530714]
cmp dword [eax], 0
jne 0x4ede0b
mov eax, dword [0x5306b0]
cmp dword [eax], 0
jne 0x4edd93
mov eax, dword [0x5306b0]
mov edx, 0x4eeae0
call fcn.004045b0
call fcn.0040af28
call fcn.00402b6c
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.00409360
mov edx, dword [ebp - 0x60]
mov eax, dword [0x530714]
call fcn.004045b0
push 1
lea edx, [ebp - 0x64]
mov eax, dword [ebx]
call fcn.0046c374
mov eax, dword [ebp - 0x64]
call fcn.00404a0c
push eax
mov eax, dword [0x5306b0]
push dword [eax]
push 0x4eea6c
mov eax, dword [0x530714]
push dword [eax]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x68]
call fcn.00404a0c
push eax
mov eax, dword [ebx]
call fcn.00404a0c
push eax
push 0x4eeae4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4ee7e1
mov eax, dword [0x53095c]
mov dword [eax], 0x20b9
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.004ebf20
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x53093c]
call fcn.004045b0
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.004ebf20
mov edx, dword [ebp - 0x70]
mov eax, dword [0x5306a4]
call fcn.004045b0
mov eax, dword [0x537748]
call fcn.00404814
push eax
mov eax, 0x537748
call fcn.00404a64
pop edx
call fcn.004ebc10
mov edx, dword [0x53095c]
add dword [edx], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x53774c], eax
mov eax, 0x400
call fcn.0040305c
add eax, 0x400
mov dword [0x537750], eax
mov eax, 0x2800
call fcn.0040305c
add eax, 0x2800
mov dword [0x537754], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x537758], eax
mov eax, 0x7d000
call fcn.0040305c
lea edx, [ebp - 0x74]
xor eax, eax
call fcn.004ebf20
mov edx, dword [ebp - 0x74]
mov eax, 0x53775c
mov ecx, 0x4eeaf4
call fcn.00404860
call fcn.00402b00
lea edx, [ebp - 0x78]
mov eax, 4
call fcn.004a802c
mov ecx, dword [ebp - 0x78]
mov edx, dword [0x530810]
mov edx, dword [edx]
mov eax, dword [0x530440]
call fcn.00404860
lea edx, [ebp - 0x7c]
mov eax, 3
call fcn.004a802c
mov ecx, dword [ebp - 0x7c]
mov edx, dword [0x530810]
mov edx, dword [edx]
mov eax, dword [0x530844]
call fcn.00404860
lea edx, [ebp - 0x80]
mov eax, dword [ebx]
call fcn.00408d5c
mov edx, dword [ebp - 0x80]
mov eax, 0x537720
call fcn.004045b0
push 0x104
mov eax, dword [0x530508]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4edfb2
lea edx, [ebp - 0x84]
mov eax, dword [0x530508]
call fcn.00409df0
mov edx, dword [ebp - 0x84]
mov eax, dword [0x530288]
call fcn.004045b0
mov eax, dword [0x530288]
mov eax, dword [eax]
call fcn.00404814
cmp eax, 3
jle 0x4edf8d
mov eax, dword [0x530288]
mov edx, 0x4eeb04
call fcn.0040481c
mov eax, dword [0x530288]
mov eax, dword [0x530288]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4edfba
mov eax, dword [0x530288]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x5304f8]
mov byte [edx], al
jmp 0x4edfba
mov eax, dword [0x5304f8]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x530508]
push eax
lea edx, [ebp - 0x88]
mov eax, 0x2e
call fcn.004a802c
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x530508]
call fcn.00409dd4
mov edx, eax
mov eax, 0x537724
call fcn.0040474c
mov eax, 0x537724
call fcn.004695f0
mov eax, dword [0x537720]
cmp byte [eax], 0x5c
jne 0x4ee01a
mov eax, dword [0x530840]
mov byte [eax], 2
jmp 0x4ee035
mov edx, dword [0x537720]
mov eax, dword [0x537724]
call fcn.00404b50
dec eax
jne 0x4ee035
mov eax, dword [0x530840]
mov byte [eax], 1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eeb10
call fcn.00404958
jne 0x4ee050
mov eax, dword [0x530514]
mov byte [eax], 1
mov eax, dword [0x5306b0]
mov eax, dword [eax]
mov edx, 0x4eeb1c
call fcn.00404958
je 0x4ee07a
mov eax, dword [0x530714]
mov eax, dword [eax]
mov edx, 0x4eeb1c
call fcn.00404958
je 0x4ee07a
xor eax, eax
jmp 0x4ee07c
mov al, 1
test al, al
je 0x4ee0a8
mov eax, 0x7d0
call fcn.004d06d0
mov eax, dword [0x530440]
mov eax, dword [eax]
call fcn.0046c3fc
test al, al
je 0x4ee0bc
mov eax, dword [0x530440]
mov eax, dword [eax]
call fcn.004098c8
jmp 0x4ee0bc
mov eax, dword [0x530514]
cmp byte [eax], 1
jne 0x4ee0bc
mov eax, 0x7d0
call fcn.004d06d0
lea edx, [ebp - 0x8c]
mov eax, 0x11b
call fcn.004a802c
mov eax, dword [ebp - 0x8c]
push eax
lea edx, [ebp - 0x90]
mov eax, 0x13
call fcn.004a802c
mov eax, dword [ebp - 0x90]
pop edx
call fcn.0046b9c8
mov eax, dword [0x530514]
cmp byte [eax], 1
jne 0x4ee2ab
mov eax, dword [0x530840]
cmp byte [eax], 0
jne 0x4ee2ab
lea edx, [ebp - 0x98]
mov eax, 0xb
call fcn.004a802c
mov ecx, dword [ebp - 0x98]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x94]
call fcn.00404860
mov eax, dword [ebp - 0x94]
call fcn.0046c3fc
test al, al
je 0x4ee2ab
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [0x53772c], eax
lea edx, [ebp - 0xa4]
mov eax, 0xb
call fcn.004a802c
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
call fcn.00404860
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
call fcn.00404e18
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [0x53772c]
push eax
call fcn.0046c714
mov eax, dword [0x53772c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4ee2a1
mov eax, dword [0x53772c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x4ee25f
mov dword [0x537738], eax
lea ecx, [ebp - 0xa8]
mov edx, dword [0x537738]
mov eax, dword [0x53772c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xa8]
mov eax, 0x537734
call fcn.004045b0
lea edx, [ebp - 0xac]
mov eax, 0xa
call fcn.004a802c
mov ecx, dword [ebp - 0xac]
mov eax, 0x537730
mov edx, dword [0x537734]
call fcn.00404860
push 1
mov eax, 0x537734
call fcn.00404a64
push eax
mov eax, 0x537730
call fcn.00404a64
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4ee24c
mov edx, dword [0x537738]
mov eax, dword [0x53772c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec dword [0x537738]
cmp dword [0x537738], 0xffffffff
jne 0x4ee1cf
mov eax, dword [0x53772c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4ee2a1
lea edx, [ebp - 0xb4]
mov eax, 0xb
call fcn.004a802c
mov ecx, dword [ebp - 0xb4]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0xb0]
call fcn.00404860
mov eax, dword [ebp - 0xb0]
call fcn.004098c8
mov eax, dword [0x53772c]
call fcn.00403750
mov eax, dword [0x530620]
mov dword [eax], 0x20
lea eax, [ebp - 0xb8]
mov edx, dword [ebx]
call fcn.00404e18
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x530620]
mov dx, word [edx]
call fcn.0046c78c
mov edx, dword [0x530464]
mov dword [edx], eax
mov eax, dword [0x530464]
cmp dword [eax], 0
jne 0x4ee31c
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xbc]
mov edx, dword [ebx]
call fcn.00404e18
mov eax, dword [ebp - 0xbc]
mov edx, dword [0x530620]
mov dx, word [edx]
call fcn.0046c78c
mov edx, dword [0x530464]
mov dword [edx], eax
mov eax, dword [0x530464]
cmp dword [eax], 0
jne 0x4ee359
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xc0]
mov edx, dword [ebx]
call fcn.00404e18
mov eax, dword [ebp - 0xc0]
mov edx, dword [0x530620]
mov dx, word [edx]
call fcn.0046c78c
mov edx, dword [0x530464]
mov dword [edx], eax
mov eax, dword [0x530464]
cmp dword [eax], 0
jne 0x4ee396
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xc4]
mov edx, dword [ebx]
call fcn.00404e18
mov eax, dword [ebp - 0xc4]
mov edx, dword [0x530620]
mov dx, word [edx]
call fcn.0046c78c
mov edx, dword [0x530464]
mov dword [edx], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x530150]
mov dword [edx], eax
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.0044804c
call fcn.004a88e0
mov ecx, dword [0x530830]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov edx, dword [0x4aecb8]
call fcn.00448064
mov ecx, dword [0x530648]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov edx, dword [0x4adcc8]
call fcn.00448064
mov edx, dword [0x53093c]
mov edx, dword [edx]
mov eax, dword [0x530830]
mov eax, dword [eax]
call fcn.004563f4
mov ecx, dword [0x530220]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov edx, dword [0x4cdb74]
call fcn.00448064
mov edx, dword [0x5306a4]
mov edx, dword [edx]
mov eax, dword [0x530220]
mov eax, dword [eax]
call fcn.004563f4
mov ecx, dword [0x530354]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov edx, dword [0x4ab268]
call fcn.00448064
mov eax, dword [0x530220]
mov eax, dword [eax]
mov edx, dword [0x530830]
mov edx, dword [edx]
mov dword [edx + 0x31c], eax
lea edx, [ebp - 0xcc]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.00408d98
mov eax, dword [ebp - 0xc8]
mov edx, 0x4eea54
call fcn.00404958
jne 0x4ee527
lea edx, [ebp - 0xd0]
mov eax, 0x11a
call fcn.004a802c
mov eax, dword [ebp - 0xd0]
mov ecx, 0x1a803549
mov edx, 0x4eeb28
call fcn.0046b528
lea edx, [ebp - 0xd8]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.00408d98
mov eax, dword [ebp - 0xd4]
mov edx, 0x4eeb38
call fcn.00404958
jne 0x4ee507
lea edx, [ebp - 0xdc]
mov eax, 0x11a
call fcn.004a802c
mov eax, dword [ebp - 0xdc]
mov ecx, 0x1a803549
mov edx, 0x4eeb44
call fcn.0046b528
jmp 0x4ee527
lea edx, [ebp - 0xe0]
mov eax, 0x11a
call fcn.004a802c
mov eax, dword [ebp - 0xe0]
mov edx, 0x4eeb44
call fcn.0046b9c8
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov edx, dword [0x5306d4]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov edx, dword [0x5306d0]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0xec]
mov eax, 5
call fcn.004a802c
mov ecx, dword [ebp - 0xec]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0xe8]
call fcn.00404860
mov edx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0xe4]
push eax
push ebx
call fcn.0046c714
test al, al
je 0x4ee5af
mov byte [0x537760], 1
cmp byte [0x537760], 0
je 0x4ee6cc
jmp 0x4ee6b8
lea ecx, [ebp - 0xf4]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00408fac
mov edx, dword [ebp - 0xf0]
mov eax, 0x537728
call fcn.004045b0
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [0x537728], 0
je 0x4ee75f
mov edx, dword [0x537728]
mov eax, 0x4eeb54
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4ee630
mov edx, dword [0x537728]
mov eax, 0x4eeb60
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
je 0x4ee75f
lea eax, [ebp - 0xfc]
push eax
mov ecx, dword [esi]
dec ecx
mov edx, 1
mov eax, dword [0x537728]
call fcn.00404a6c
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.00408fac
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x5306d4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x104]
push eax
mov edx, dword [esi]
inc edx
mov ecx, 0x400
mov eax, dword [0x537728]
call fcn.00404a6c
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.00408fac
mov eax, dword [ebp - 0x100]
call fcn.004093d0
mov edx, eax
mov eax, dword [0x5306d0]
mov eax, dword [eax]
call fcn.00416b64
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4ee5c1
jmp 0x4ee75f
mov eax, dword [0x537754]
push eax
mov eax, dword [0x537758]
push eax
mov eax, dword [0x530288]
push dword [eax]
push 0x4eeb6c
push dword [0x53775c]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [0x537750]
mov edx, dword [0x53774c]
mov eax, ebx
call fcn.004ed088
test al, al
jne 0x4ee6b8
mov eax, dword [0x537754]
push eax
mov eax, dword [0x537758]
push eax
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x10c]
mov ecx, dword [0x53775c]
call fcn.00404860
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [0x537750]
mov edx, dword [0x53774c]
mov eax, ebx
call fcn.004ed088
test al, al
jne 0x4ee6b8
mov eax, ebx
call fcn.00403750
mov eax, dword [0x5306d4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4ee798
mov eax, dword [0x5306d4]
mov eax, dword [eax]
mov edx, 0x4eeb80
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x5306d0]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00416b64
mov eax, dword [0x5306d4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4ee7c2
mov eax, dword [0x5306d4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040305c
mov edx, dword [0x5302bc]
mov dword [edx], eax
jmp 0x4ee7cb
mov eax, dword [0x5302bc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.004480e4
mov eax, dword [0x530464]
call fcn.0040e130
mov eax, 0x530098
call fcn.0040e130
mov eax, dword [0x5302a8]
cmp byte [eax], 0
je 0x4ee82b
push 1
push 0x4eeb94
push 0x4eeb94
lea edx, [ebp - 0x110]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.004486d0
mov eax, dword [ebp - 0x110]
call fcn.00404a0c
push eax
push 0x4eeb98
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5301c4]
cmp byte [eax], 0
je 0x4ee973
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0x11c]
mov eax, 5
call fcn.004a802c
mov ecx, dword [ebp - 0x11c]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x118]
call fcn.00404860
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00404e18
mov eax, dword [ebp - 0x114]
push eax
push ebx
call fcn.0046c714
test al, al
jne 0x4ee96c
mov eax, dword [0x537754]
push eax
mov eax, dword [0x537758]
push eax
mov eax, dword [0x530288]
push dword [eax]
push 0x4eeb6c
push dword [0x53775c]
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [0x537750]
mov edx, dword [0x53774c]
mov eax, ebx
call fcn.004ed088
test al, al
jne 0x4ee925
mov eax, dword [0x537754]
push eax
mov eax, dword [0x537758]
push eax
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x124]
mov ecx, dword [0x53775c]
call fcn.00404860
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [0x537750]
mov edx, dword [0x53774c]
mov eax, ebx
call fcn.004ed088
test al, al
je 0x4ee96c
lea edx, [ebp - 0x130]
mov eax, 5
call fcn.004a802c
mov ecx, dword [ebp - 0x130]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x12c]
call fcn.00404860
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
call fcn.00404e18
mov eax, dword [ebp - 0x128]
push eax
push ebx
call fcn.0046c6a8
mov eax, ebx
call fcn.00403750
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea37
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x128]
call fcn.00404c78
lea eax, [ebp - 0x124]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x114]
call fcn.00404c78
lea eax, [ebp - 0x110]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0xe4]
call fcn.00404c78
lea eax, [ebp - 0xe0]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xc4]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 0xb4]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x9c]
call fcn.00404c78
lea eax, [ebp - 0x98]
mov edx, 0x22
call fcn.00404580
ret