Function at 0x4072ee
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Encode data using base64
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x5d4
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x54], ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xe4], ebx
je 0x407321
lea eax, [ebp + 0x70]
push eax
call fcn.00430961
pop ecx
mov eax, dword [ebp + 0x74]
xor edi, edi
inc edi
and eax, edi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x74]
shr eax, 1
and eax, edi
mov dword [ebp + 4], eax
mov eax, dword [ebp + 0x74]
shr eax, 2
and al, 1
lea ecx, [ebp - 0x104]
mov byte [ebp + 0x2f], bl
mov byte [ebp + 0x2e], bl
mov byte [ebp + 0x53], al
call fcn.00435d62
cmp dword [ebp + 0x68], ebx
je 0x407378
push dword [ebp + 0x68]
lea ecx, [ebp - 0x104]
call fcn.00440487
mov eax, dword [ebp - 0x104]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
pop ecx
lea ecx, [ebp - 0xf4]
call fcn.00435d62
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x40739f
push eax
lea ecx, [ebp - 0xf4]
call fcn.00440487
mov eax, dword [ebp - 0xf4]
mov dword [ebp + 0x70], eax
cmp dword [ebp + 0x78], ebx
jne 0x4073ad
lea ecx, [ebp - 0xe0]
mov dword [ebp + 0x78], ecx
mov ecx, dword [ebp + 0x68]
cmp ecx, ebx
push 0x5e
pop esi
mov dword [ebp + 0x48], ecx
mov dword [ebp - 0x16c], esi
jne 0x4073ee
cmp eax, ebx
mov dword [ebp + 0x68], eax
je 0x4073ee
push 5
push eax
push str._shel
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4073ee
lea eax, [ebp - 0x16c]
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x14], edi
mov dword [ebp + 4], edi
mov byte [ebp + 0x53], 1
lea ecx, [ebp - 0xe8]
mov byte [ebp + 0x77], bl
mov byte [ebp + 0x44], bl
mov byte [ebp + 3], 1
mov byte [ebp - 0x49], bl
mov byte [ebp + 0x3f], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x34], bl
mov byte [ebp + 0x42], bl
mov byte [ebp + 0x51], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x32], bl
call fcn.00435d62
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov byte [ebp - 0x41], bl
mov byte [ebp + 0x46], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0x33], bl
mov byte [ebp + 0xf], 1
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x10], ebx
call fcn.00435d62
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x68], ebx
mov byte [ebp + 0x52], bl
call fcn.00435d62
lea ecx, [ebp - 0xb4]
call fcn.00435d62
lea ecx, [ebp - 0xa8]
call fcn.00435d62
or dword [ebp - 0xd4], 0xffffffff
lea ecx, [ebp - 0x12c]
mov byte [ebp + 0x47], bl
mov byte [ebp + 0x45], bl
mov dword [ebp - 0xfc], ebx
call fcn.00435d62
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x244], 0x44
mov dword [ebp - 0x240], ebx
lea edi, [ebp - 0x23c]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x15c], ebx
pop ecx
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x14c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
cmp eax, ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp + 0x30], ebx
jne 0x4074e6
mov byte [ebp + 0x45], 1
jmp 0x407540
cmp word [eax], 0x23
jne 0x4074fc
cmp eax, dword [ebp + 0x68]
jne 0x4074f5
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
jmp 0x407509
test byte [0x4b0003], 3
je 0x407509
mov byte [ebp + 0x45], 3
cmp eax, ebx
je 0x407540
cmp word [eax], si
jne 0x407524
cmp eax, dword [ebp + 0x68]
jne 0x40751b
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x53], 1
cmp eax, ebx
je 0x407540
cmp word [eax], 0x24
jne 0x407540
cmp eax, dword [ebp + 0x68]
jne 0x407537
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x51], 1
cmp eax, ebx
mov dword [ebp - 0x74], ebx
je 0x407563
cmp word [eax], 0x7c
jne 0x407563
cmp eax, dword [ebp + 0x68]
jne 0x407556
add dword [ebp + 0x68], 2
inc eax
inc eax
xor ecx, ecx
inc ecx
mov dword [ebp + 0x70], eax
mov dword [ebp - 0x74], ecx
jmp 0x407566
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x4075d2
cmp word [eax], 0x2a
jne 0x4075d2
push 2
pop edx
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x77], 0x10
jne 0x40758c
add dword [ebp + 0x68], edx
mov dword [ebp - 0x74], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x40759e
mov byte [ebp + 0x77], 0x11
jmp 0x4075b9
mov esi, eax
or esi, 0x20
cmp si, 0x6e
jne 0x4075af
mov byte [ebp + 0x77], 0x12
jmp 0x4075b9
cmp ax, 0x2d
jne 0x4075bc
mov byte [ebp + 0x77], 0x14
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.0040bc38
test al, al
jne 0x4075d2
mov ebx, ecx
jmp 0x40ae52
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
cmp byte [ebp + 0x77], bl
pop ecx
jne 0x40767b
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
cmp dword [ebp - 0x88], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x4c], eax
je 0x407606
cmp byte [ebp + 0x77], bl
jne 0x407751
push 2
pop esi
cmp word [eax], 0x2d
mov edi, eax
jne 0x40761d
add eax, 2
cmp word [eax], 0x2d
jne 0x40761d
mov dword [ebp + 0x4c], eax
push 1
lea eax, [ebp + 0x4c]
push eax
push 0x495888
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x407751
mov eax, dword [ebp + 0x4c]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40764e
cmp ax, 0x2f
jne 0x407751
add dword [ebp + 0x4c], esi
push 5
lea eax, [ebp + 0x4c]
push eax
push str.catch
call fcn.00437b13
add esp, 0xc
test al, al
je 0x4076f9
mov al, byte [ebp + 0x77]
or byte [ebp + 0x77], 0x10
cmp al, bl
jne 0x4078e2
mov esi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
inc ecx
cmp ax, bx
mov dword [ebp + 0x14], ecx
mov edi, esi
je 0x4075cb
push 2
pop edx
cmp ax, 0x3d
je 0x4076a7
add edi, edx
mov ax, word [edi]
cmp ax, bx
jne 0x407697
cmp edi, esi
je 0x4075cb
cmp word [edi], 0x3d
jne 0x4075cb
sub edi, edx
cmp word [edi], 0x2b
jne 0x4076c8
mov al, byte [edi]
mov byte [ebp - 0x41], al
sub edi, edx
cmp edi, esi
mov ecx, edi
jbe 0x4076e0
mov ax, word [ecx]
call fcn.0040bc38
test al, al
je 0x4076e0
sub ecx, edx
cmp ecx, esi
ja 0x4076ce
mov ax, word [ecx]
call fcn.0040bc38
test al, al
jne 0x407977
mov edx, ecx
inc ecx
inc ecx
jmp 0x407909
push 4
push dword [ebp + 0x4c]
push str.cmd:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407860
add dword [ebp + 0x4c], 8
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x54]
call fcn.00403ac3
add esp, 0x10
mov dword [ebp - 0x88], eax
jmp 0x407743
mov word [edi], 0x20
add edi, esi
cmp edi, dword [ebp + 0x4c]
jb 0x40773c
cmp byte [ebp + 0x77], bl
je 0x4078e2
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
mov eax, dword [ebp - 0x88]
cmp eax, ebx
pop ecx
je 0x407770
cmp word [eax], bx
jne 0x407770
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x74], ebx
jne 0x40777d
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x407781
mov byte [ebp + 0x5b], 1
xor esi, esi
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x24], ebx
call fcn.00435d62
lea ecx, [ebp - 0xd0]
call fcn.00435d62
lea ecx, [ebp - 0x10c]
call fcn.00435d62
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xd8], ebx
mov byte [ebp + 0x43], bl
mov dword [ebp - 0x38], ebx
jne 0x4077f0
cmp dword [ebp + 0x48], ebx
jne 0x4077f0
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp - 0xd8]
push eax
push dword [ebp + 0x68]
call fcn.0043e7f3
mov eax, dword [ebp - 0xd8]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov dword [ebp - 0x7c], eax
jne 0x407808
add eax, 2
cmp word [eax], 0x2d
jne 0x407808
mov dword [ebp + 0x68], eax
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x68]
push eax
push 0x495888
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x4083a4
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40783b
cmp ax, 0x2f
jne 0x4083a4
add dword [ebp + 0x68], 2
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40797f
mov byte [ebp + 0x77], 0x10
jmp 0x4077f0
push 3
push dword [ebp + 0x4c]
push 0x495874
call fcn.004318b1
add esp, 0xc
test al, al
je 0x40788a
add dword [ebp + 0x4c], 6
jmp 0x40787f
add dword [ebp + 0x4c], esi
mov eax, dword [ebp + 0x4c]
cmp word [eax], 0x2a
je 0x40787c
jmp 0x4078c0
push 4
push dword [ebp + 0x4c]
push str.exe:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4078a6
add dword [ebp + 0x4c], 8
jmp 0x4078c0
push 5
push dword [ebp + 0x4c]
push str.logs:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4078e2
add dword [ebp + 0x4c], 0xa
mov eax, dword [ebp + 0x4c]
cmp word [eax], 0x22
jne 0x4078e2
add dword [ebp + 0x4c], esi
jmp 0x4078d7
add dword [ebp + 0x4c], esi
cmp ax, 0x22
je 0x4078e2
mov eax, dword [ebp + 0x4c]
mov ax, word [eax]
cmp ax, bx
jne 0x4078ce
lea eax, [ebp + 0x4c]
push eax
call fcn.0040459d
mov eax, dword [ebp + 0x4c]
pop ecx
jmp 0x407609
lea eax, [edx - 2]
mov dword [ebp - 0x7c], eax
mov ax, word [eax]
call fcn.0040bc38
test al, al
jne 0x40790d
mov edx, dword [ebp - 0x7c]
cmp edx, esi
ja 0x4078f4
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x50]
call fcn.00435e88
mov esi, dword [ebp + 0x54]
push ebx
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.00402c4d
cmp byte [esi + 0x92], bl
jne 0x407938
test byte [esi + 9], 0xf
je 0x40794e
push ebx
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.00402c4d
jmp 0x40794e
cmp ax, 0x3d
je 0x40795c
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407946
cmp ax, 0x3d
jne 0x407977
lea eax, [ebp - 0xfc]
add edi, 2
push eax
mov dword [ebp - 0xfc], edi
call fcn.00430961
pop ecx
jmp 0x4075e5
xor ebx, ebx
inc ebx
jmp 0x40ae52
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.004318b1
add esp, 0xc
test al, al
lea eax, [ebp + 0x68]
je 0x4079c6
add dword [ebp + 0x68], 0xc
mov edi, dword [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x4079b5
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [edi], bx
je 0x408206
mov dword [ebp + 0x30], edi
jmp 0x408206
push 4
push eax
push str.shel
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4079ed
or byte [ebp + 0x53], 2
and byte [ebp + 0x45], 0xfe
mov dword [ebp + 4], edi
mov dword [ebp + 0x14], edi
jmp 0x4077f0
push 5
push dword [ebp + 0x68]
push str.shel:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407a52
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
or byte [ebp + 0x53], 2
and byte [ebp + 0x45], 0xfe
mov dword [ebp - 0x18], eax
push 5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp + 4], edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x1c], ebx
call fcn.00416853
add esp, 0xc
cmp dword [ebp + 0x1c], ebx
mov dword [ebp + 0x68], eax
jle 0x4077f0
push dword [ebp + 0x1c]
lea ecx, [ebp - 0xe4]
push dword [ebp - 0x18]
call fcn.00435e88
jmp 0x4077f0
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407a9b
add dword [ebp + 0x68], 0x12
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xe8]
call fcn.00435e88
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
jmp 0x40839e
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407b4e
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x18], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407ad5
add dword [ebp + 0x68], 2
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
pop ecx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x18]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x31], 1
je 0x407b0b
cmp ax, 0x30
jb 0x407b07
cmp ax, 0x39
jbe 0x407b0b
add dword [ebp + 0x18], 2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00438b8e
mov eax, dword [ebp + 0x18]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x407b38
cmp ax, 0x30
jb 0x407b34
cmp ax, 0x39
jbe 0x407b38
add dword [ebp + 0x18], 2
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00438b8e
pop ecx
jmp 0x40839e
push 4
push dword [ebp + 0x68]
push str.pid:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407b8b
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x408206
lea ecx, [ebp - 0x100]
jmp 0x4081fb
push 4
push dword [ebp + 0x68]
push str.exe:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407ca4
mov eax, dword [ebp + 0x68]
add eax, 8
mov dword [ebp + 0x68], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov edi, eax
mov dword [ebp - 0x24], ebx
jne 0x407bc5
mov dword [ebp - 0x38], 1
cmp cx, 0x22
jne 0x407c3c
lea esi, [eax + 2]
mov edi, eax
mov ecx, esi
jmp 0x407bfa
cmp ax, 0x22
jne 0x407bf8
inc edx
test dl, 1
je 0x407bf8
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x407c05
call fcn.0040bc38
test al, al
jne 0x407c05
or dword [ebp - 0x38], 2
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407bd4
push 0x22
pop edx
cmp word [ecx], dx
jne 0x407c49
or dword [ebp - 0x24], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
cmp word [ecx - 4], dx
mov edi, esi
mov byte [ebp + 0x43], 2
je 0x407c30
mov ax, word [edi]
cmp ax, dx
jne 0x407c49
cmp word [edi + 2], dx
jne 0x407c35
mov byte [ebp + 0x43], bl
jmp 0x407c49
cmp ax, dx
jne 0x407c49
jmp 0x407c30
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
pop ecx
mov ecx, dword [ebp + 0x68]
sub ecx, edi
sar ecx, 1
add dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jle 0x408206
add edi, 0xfffffff6
push edi
lea ecx, [ebp - 0xac]
call fcn.00440487
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x24]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x38], eax
jne 0x408206
cmp word [eax + 2], bx
jne 0x408206
lea eax, [ebp - 0xac]
push eax
call fcn.00403bbc
pop ecx
mov dword [ebp + 0x38], eax
jmp 0x408206
push 3
push dword [ebp + 0x68]
push 0x495874
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407d8f
mov eax, dword [ebp + 0x68]
xor edi, edi
add eax, 6
jmp 0x407ccb
inc edi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x407cc8
cmp edi, 2
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x64], ebx
jge 0x407d55
push 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00416853
add esp, 0xc
cmp dword [ebp - 0x64], ebx
mov dword [ebp + 0x68], eax
jle 0x407d16
push dword [ebp - 0x64]
lea ecx, [ebp - 0x54]
push dword [ebp - 0x128]
call fcn.00435e88
mov eax, dword [ebp - 0x54]
mov dword [ebp + 0x24], eax
cmp edi, 1
jne 0x408206
cmp dword [ebp - 0x64], ebx
jle 0x408206
mov eax, dword [ebp - 0x54]
push edi
lea ecx, [ebp - 0x54]
push ecx
push eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x54], ebx
call fcn.00473899
add esp, 0xc
lea ecx, [ebp - 0xb0]
mov dword [ebp + 0x24], eax
call fcn.0043092f
jmp 0x408206
push 0x105
lea ecx, [ebp - 0x54]
call fcn.00435da9
push 0x104
push dword [ebp - 0x54]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x54]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x407d84
mov word [eax], bx
mov eax, dword [ebp - 0x54]
mov dword [ebp + 0x24], eax
jmp 0x408206
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x407e07
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x18], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x407dc6
add eax, 2
mov dword [ebp - 0x18], eax
mov esi, eax
push 1
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp + 0x34], ebx
call fcn.00416853
add esp, 0xc
cmp dword [ebp + 0x34], ebx
mov dword [ebp + 0x68], eax
jle 0x408206
cmp edi, ebx
je 0x407df9
cmp dword [0x4ace14], ebx
je 0x408206
push dword [ebp + 0x34]
lea ecx, [ebp - 0xf8]
jmp 0x408200
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407e27
mov byte [ebp - 0x32], 1
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.hide
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407e4a
mov dword [ebp - 0x14], 0x10000000
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push 0x495814
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407e69
mov dword [ebp + 0x14], edi
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x495810
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407e89
or byte [ebp + 0x44], 1
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407ea9
or byte [ebp + 0x44], 3
jmp 0x4077f0
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407ec9
mov byte [ebp - 0x34], 1
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4957fc
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407ee9
mov byte [ebp + 0x42], 1
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407f08
mov dword [ebp + 4], edi
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4957f0
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407f2b
mov dword [ebp - 0x14], 6
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4957ec
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407f4e
mov dword [ebp - 0x14], 3
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407f6d
mov dword [ebp - 0x14], edi
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.runs
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407f8d
mov byte [ebp - 0x29], 1
jmp 0x4077f0
push 2
lea eax, [ebp + 0x68]
push eax
push 0x4957d8
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407fad
mov byte [ebp + 3], 1
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407fcc
mov byte [ebp + 3], bl
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4957cc
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x407fec
mov byte [ebp - 0x49], 1
jmp 0x4077f0
push 2
lea eax, [ebp + 0x68]
push eax
push 0x4957c8
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40800c
mov byte [ebp + 0x3f], 1
jmp 0x4077f0
push 5
lea eax, [ebp + 0x68]
push eax
push str.incmd
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40802c
mov byte [ebp - 0x33], 1
jmp 0x4077f0
push 7
lea eax, [ebp + 0x68]
push eax
push str.hidecmd
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40804c
mov byte [ebp + 0xf], 1
jmp 0x4077f0
push 8
lea eax, [ebp + 0x68]
push eax
push str.hidecmd_
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40806b
mov byte [ebp + 0xf], bl
jmp 0x4077f0
push 3
push dword [ebp + 0x68]
push 0x4957a8
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4080bd
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x51], 1
jne 0x408206
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x408206
lea ecx, [ebp - 0xd0]
jmp 0x4081fb
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x408172
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0xc], eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push str.UTF8
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408108
mov byte [ebp + 0x52], 1
mov dword [ebp - 0x68], 0xfde9
jmp 0x408395
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push str.ANSI
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40812b
mov byte [ebp + 0x52], 1
mov dword [ebp - 0x68], ebx
jmp 0x408395
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push 0x49578c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408152
mov byte [ebp + 0x52], 2
mov dword [ebp - 0x68], 0x4b0
jmp 0x408395
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00438b8e
test eax, eax
pop ecx
pop ecx
jle 0x408395
mov byte [ebp + 0x52], 1
jmp 0x408395
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4081a8
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x408206
lea ecx, [ebp - 0xb4]
jmp 0x4081fb
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4081c3
mov byte [ebp + 0x47], bl
jmp 0x4081dd
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.004318b1
add esp, 0xc
test al, al
je 0x408218
mov byte [ebp + 0x47], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x408206
lea ecx, [ebp - 0xa8]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00435e88
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
mov esi, dword [ebp + 0x38]
pop ecx
jmp 0x4077f0
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40823b
mov dword [ebp + 0x10], 0x100
jmp 0x4077f0
push 4
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40825e
mov dword [ebp + 0x10], 0x80
jmp 0x4077f0
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408281
mov dword [ebp + 0x10], 0x8000
jmp 0x4077f0
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4082a4
mov dword [ebp + 0x10], 0x20
jmp 0x4077f0
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4082c7
mov dword [ebp + 0x10], 0x4000
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x49573c
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x408317
mov edi, dword [ebp + 0x68]
push 4
push edi
push 0x495730
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408323
xor ecx, ecx
mov cx, word [edi + 8]
mov eax, ecx
call fcn.0040bc38
test al, al
jne 0x408309
cmp cx, bx
jne 0x408323
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
pop ecx
mov dword [ebp + 0x10], 0x40
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x49572c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408343
mov byte [ebp + 0x46], 1
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x495728
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408369
mov byte [ebp - 0xd], 1
mov byte [ebp + 0x52], bl
mov dword [ebp - 0x68], ebx
jmp 0x4077f0
push 3
lea eax, [ebp + 0x68]
push eax
push 0x495724
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x408389
mov byte [ebp - 0x39], 1
jmp 0x4077f0
mov eax, dword [ebp - 0x7c]
cmp word [eax], 0x2d
mov dword [ebp + 0x68], eax
jne 0x4083a4
lea eax, [ebp + 0x68]
push eax
call fcn.0040459d
pop ecx
jmp 0x4077f0
cmp dword [ebp - 0x68], 0x4b0
jne 0x4083b1
mov byte [ebp + 0x52], 2
mov eax, dword [ebp - 0xfc]
cmp eax, ebx
je 0x4083e4
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x4083e4
cmp dword [ebp + 0x48], ebx
jne 0x4083e4
push 1
push ebx
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0043e7f3
mov eax, dword [ebp - 0xd8]
mov dword [ebp + 0x68], eax
cmp esi, ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x30], ebx
je 0x408408
cmp word [esi], bx
je 0x408408
cmp word [ebp - 0x38], bx
je 0x40840b
mov byte [ebp + 0x46], bl
cmp esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0x124], 0x494e9c
je 0x4084fa
cmp word [esi], 0x2a
jne 0x40843a
inc esi
inc esi
inc dword [ebp - 0x20]
cmp word [esi], 0x2a
je 0x40842c
mov dword [ebp + 0x38], esi
cmp word [esi], 0x3f
jne 0x408466
inc esi
inc esi
mov dword [ebp + 0x38], esi
mov dword [ebp - 0x124], esi
jmp 0x408458
inc esi
inc esi
cmp ax, 0x3a
mov dword [ebp + 0x38], esi
je 0x408462
mov ax, word [esi]
cmp ax, bx
jne 0x40844d
jmp 0x408466
mov word [esi - 2], bx
mov ax, word [esi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x4084a2
mov dx, word [esi + 2]
or dx, cx
cmp dx, 0x61
jne 0x4084a2
mov dx, word [esi + 4]
or dx, cx
cmp dx, 0x62
jne 0x4084a2
cmp word [esi + 6], 0x3a
jne 0x4084a2
mov dword [ebp - 4], 1
add esi, 8
jmp 0x4084c6
cmp ax, 0x65
jne 0x4084c9
mov ax, word [esi + 2]
or ax, cx
cmp ax, 0x78
jne 0x4084c9
cmp word [esi + 4], 0x3a
jne 0x4084c9
mov dword [ebp - 4], 0x100
add esi, 6
mov dword [ebp + 0x38], esi
cmp esi, ebx
je 0x4084fa
mov ax, word [esi]
or ax, cx
cmp ax, 0x75
jne 0x4084fa
mov ax, word [esi + 2]
or ax, cx
cmp ax, 0x64
jne 0x4084fa
cmp word [esi + 4], 0x3a
jne 0x4084fa
add esi, 6
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x38], esi
cmp byte [ebp + 0x46], bl
je 0x408541
cmp esi, ebx
je 0x408541
cmp word [ebp - 4], bx
jne 0x408541
cmp word [ebp + 0x20], bx
jne 0x408541
xor eax, eax
cmp byte [ebp + 0x43], bl
mov ecx, esi
setne al
mov edi, eax
xor eax, eax
mov ax, word [esi]
jmp 0x40853c
cmp ax, 0x22
jne 0x408537
inc edi
cmp edi, 2
jl 0x408537
cmp word [ecx + 2], bx
je 0x408537
mov byte [ebp + 0x46], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x408522
cmp word [ebp - 0x20], bx
jne 0x408553
cmp word [ebp - 4], bx
jne 0x408553
cmp word [ebp + 0x20], bx
je 0x408556
mov byte [ebp + 0x43], bl
cmp byte [ebp + 0x46], bl
je 0x40859b
xor eax, eax
cmp word [ebp + 0x20], bx
sete al
xor ecx, ecx
cmp word [ebp - 4], bx
sete cl
test ecx, eax
je 0x40859b
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x408589
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x13c]
push eax
push esi
call fcn.00410567
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0x11c]
mov dword [ebp - 0x120], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x180], ebx
lea edi, [ebp - 0x17c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x30], ebx
mov dword [ebp - 0x6c], ebx
setne al
cmp byte [ebp + 0x3f], bl
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x168], 0xc
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x108], ebx
je 0x40863c
lea eax, [ebp - 0x244]
or byte [eax + 0x2d], cl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [0x4ab2e4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4ab2e8]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4ab2e0]
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x5b], bl
je 0x408ac8
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp - 0x28], ebx
jne 0x40866a
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x408651
call fcn.0040bc38
test al, al
jne 0x408651
mov dword [ebp + 0x1c], ecx
mov eax, dword [ebp + 0x68]
xor edx, edx
mov dword [ebp + 0x5c], edx
cmp word [eax], bx
je 0x408715
cmp word [eax], 0x7c
jne 0x40869a
cmp word [eax + 2], 0x7c
je 0x408692
mov edx, eax
mov dword [ebp + 0x5c], edx
jmp 0x40869a
inc eax
inc eax
cmp word [eax], 0x7c
je 0x408692
inc eax
inc eax
cmp word [eax], bx
jne 0x40867e
cmp edx, ebx
je 0x408715
lea eax, [ebp + 0x5c]
mov word [edx], bx
add dword [ebp + 0x5c], 2
push eax
call fcn.00430961
mov edx, dword [ebp + 0x5c]
xor eax, eax
mov ax, word [edx]
cmp ax, bx
pop ecx
mov edi, edx
je 0x40866d
cmp ax, 0x7c
jne 0x4086f4
lea esi, [edi + 2]
cmp word [esi], ax
jne 0x4086f4
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push esi
push edi
call fcn.00410296
add esp, 0xc
cmp word [edi], 0x7c
jne 0x4086f1
inc edi
inc edi
jmp 0x4086e7
mov edx, dword [ebp + 0x5c]
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x4086c5
cmp word [edx], bx
je 0x40866d
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov cl, 1
je 0x408717
mov al, cl
jmp 0x408723
xor cl, cl
xor al, al
cmp cl, bl
jne 0x408723
mov edx, dword [ebp + 0x1c]
mov dword [ebp + 0x5c], edx
cmp al, bl
mov dword [ebp + 0x48], edx
je 0x4087f4
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x80]
push eax
xor edi, edi
lea eax, [ebp - 0x84]
inc edi
push eax
mov dword [ebp - 0xc4], 0xc
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], edi
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x408776
mov ecx, dword [ebp + 0x54]
push ebx
push edi
call fcn.0040d358
mov edi, dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x84]
push eax
push esi
push dword [ebp - 0x84]
push esi
call edi
cmp dword [ebp - 0x80], ebx
mov word [ebp + 0x3e], bx
je 0x4087bd
push dword [ebp - 0x80]
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
lea eax, [ebp + 0x3e]
push eax
push ecx
push dword [ebp + 0x1c]
call fcn.004072ee
cmp dword [ebp - 0x80], ebx
je 0x4087bd
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x84]
push eax
push esi
push dword [ebp - 0x84]
mov dword [ebp - 0x80], ebx
push esi
call edi
mov ecx, dword [ebp - 0x84]
cmp ecx, ebx
je 0x4087f4
lea eax, [ebp - 0x244]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x1c], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x408a64
cmp cx, 0x3c
je 0x408822
cmp cx, 0x3e
je 0x408822
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408809
mov cx, word [eax]
cmp cx, bx
je 0x408a64
cmp cx, 0x3c
jne 0x4088fd
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4088fd
mov dword [ebp - 8], eax
jmp 0x40886b
cmp cx, 0x3c
je 0x408873
cmp cx, 0x3e
je 0x408873
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40885a
sub eax, dword [ebp - 8]
lea ecx, [ebp - 0x60]
sar eax, 1
push eax
push dword [ebp - 8]
call fcn.004403e0
lea ecx, [ebp + 0x1c]
call fcn.00435d62
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 8]
call fcn.0043e7f3
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 8], eax
call fcn.0040cd10
lea eax, [ebp - 8]
push eax
call fcn.00430961
cmp dword [ebp - 0x58], ebx
pop ecx
pop ecx
je 0x4088c2
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x168]
push eax
push 7
push 0xc0000000
push dword [ebp - 8]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], ebx
call fcn.004045f9
cmp dword [ebp - 0x58], ebx
jne 0x4088ea
mov dword [ebp - 0x58], ebx
lea ecx, [ebp + 0x1c]
call fcn.0043092f
lea ecx, [ebp - 0x60]
call fcn.0043092f
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4087fd
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x5b], 1
jne 0x408922
mov byte [ebp + 0x5b], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x408935
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x408946
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x5b], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4087fd
mov dword [ebp + 0x28], eax
jmp 0x408972
cmp cx, 0x3c
je 0x40897a
cmp cx, 0x3e
je 0x40897a
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408961
sub eax, dword [ebp + 0x28]
lea ecx, [ebp - 0x18]
sar eax, 1
push eax
push dword [ebp + 0x28]
call fcn.004403e0
lea ecx, [ebp - 0xc]
call fcn.00435d62
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x28]
call fcn.0043e7f3
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp + 0x28], eax
call fcn.0040cd10
lea eax, [ebp + 0x28]
push eax
call fcn.00430961
test byte [ebp + 0x5b], 1
pop ecx
pop ecx
je 0x4089d2
cmp dword [ebp + 0x18], ebx
je 0x4089cf
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp + 0x18], ebx
test byte [ebp + 0x5b], 2
je 0x4089f5
cmp dword [ebp - 0x8c], ebx
je 0x4089ec
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x168]
push eax
push 7
push 0x40000000
push dword [ebp + 0x28]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
call fcn.004045f9
mov edi, eax
cmp edi, ebx
jne 0x408a39
lea ecx, [ebp - 0xc]
call fcn.0043092f
lea ecx, [ebp - 0x18]
call fcn.0043092f
mov eax, dword [ebp + 0x5c]
jmp 0x4087fa
cmp esi, ebx
je 0x408a48
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x408a53
mov dword [ebp + 0x18], edi
jmp 0x408a21
cmp byte [ebp + 0x5b], 3
mov dword [ebp - 0x28], edi
je 0x408a4e
mov dword [ebp - 0x8c], edi
jmp 0x408a21
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
mov edx, 0x100
je 0x408a7f
lea eax, [ebp - 0x244]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
je 0x408a95
lea eax, [ebp - 0x244]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x408aab
lea eax, [ebp - 0x244]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x48]
call fcn.0043e7f3
mov eax, dword [ebp - 0x108]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x408b0a
cmp ax, 0x2a
je 0x408b0a
cmp ax, 0x40
jne 0x408b13
push str.WinSta0WinLogon
lea ecx, [ebp - 0xdc]
call fcn.00440487
mov ecx, dword [ebp - 0xdc]
inc byte [ebp + 0x2f]
lea eax, [ebp - 0x244]
mov dword [eax + 8], ecx
mov dword [ebp - 0x14], esi
add dword [ebp + 0x68], 2
jmp 0x408ad0
cmp ax, 0x3d
jne 0x408b22
mov dword [ebp + 0x14], 1
jmp 0x408b0d
cmp ax, 0x24
jne 0x408b2e
mov byte [ebp + 0x51], 1
jmp 0x408b0d
cmp ax, 0x26
jne 0x408b3d
mov dword [ebp - 0x14], 3
jmp 0x408b0d
cmp ax, 0x5e
jne 0x408b48
mov dword [ebp - 0x14], edi
jmp 0x408b0d
cmp ax, 0x5f
je 0x408b43
cmp dword [ebp - 0x14], esi
je 0x408b77
cmp byte [ebp + 0x45], bl
je 0x408b77
push str.WinSta0Default
lea ecx, [ebp - 0xdc]
call fcn.00440487
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0x244]
mov dword [eax + 8], ecx
lea edi, [ebp - 0x244]
cmp dword [edi + 8], ebx
je 0x408b95
test byte [ebp + 0x2f], 1
je 0x408b95
call fcn.00403a2a
cmp eax, 1
jge 0x408b95
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x408bb0
or byte [edi + 0x2d], 1
mov dword [ebp + 0x14], ebx
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x1c], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x51], bl
je 0x408bd0
mov eax, dword [ebp - 0xd0]
cmp word [eax], bx
jne 0x408bd0
push str.open
lea ecx, [ebp - 0xd0]
call fcn.0044042b
cmp byte [ebp - 0x29], bl
je 0x408c21
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x408bea
inc edi
inc edi
jmp 0x408bed
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp + 0x14], ebx
push 1
setne al
push edi
push 0x495678
add eax, 0x80000001
push eax
call fcn.00431794
add esp, 0x18
mov ebx, eax
jmp 0x40ad9c
lea eax, [ebp + 0x68]
push eax
call fcn.00430961
cmp dword [ebp + 0x30], ebx
pop ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xec], ebx
je 0x408cd4
lea ecx, [ebp - 0xc]
mov byte [ebp + 0x51], bl
call fcn.00435d62
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x30]
call fcn.0041083d
cmp eax, ebx
je 0x408cc2
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x408cc2
push eax
lea ecx, [ebp - 0xc]
call fcn.00440459
push dword [ebp + 0x68]
lea ecx, [ebp - 0xec]
call fcn.00440487
push dword [ebp - 0xf8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0xc]
call fcn.004070a2
mov edi, eax
mov eax, dword [ebp - 0xac]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0xec]
add esp, 0x14
lea ecx, [ebp - 0xc]
mov dword [ebp + 0x68], eax
call fcn.0043092f
cmp edi, ebx
je 0x408cd4
mov ebx, edi
jmp 0x40ad89
lea ecx, [ebp - 0xc]
call fcn.0043092f
mov ebx, 0x80070057
jmp 0x40ad89
mov eax, dword [ebp - 0xe8]
cmp word [eax], bx
je 0x408d25
push dword [ebp + 0x68]
call fcn.0040eec0
pop ecx
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x68], eax
call fcn.004403c3
push 0x495674
lea ecx, [ebp + 0x7c]
call fcn.00435dd0
push dword [ebp - 0xe8]
lea ecx, [ebp + 0x7c]
call fcn.00435dd0
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x7c]
call fcn.00447be6
mov ebx, eax
lea ecx, [ebp + 0x7c]
jmp 0x40ad84
cmp byte [ebp - 0x31], bl
je 0x408e70
lea ecx, [ebp + 0x74]
call fcn.00435d62
push dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
call fcn.0040eec0
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.00435d62
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x34], ebx
call fcn.00473899
mov eax, dword [ebp + 0x34]
add esp, 0xc
cmp eax, ebx
jne 0x408d7a
lea ecx, [ebp + 0x78]
call fcn.0043092f
lea ecx, [ebp + 0x74]
jmp 0x408cc5
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp + 0x30]
mov edi, eax
call fcn.004403c3
push dword [ebp + 0x34]
mov esi, dword [ebp + 0x30]
lea ecx, [ebp - 0x64]
call fcn.004403c3
push edi
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp - 0x64]
push esi
call fcn.00405c21
add esp, 0x14
cmp dword [ebp + 0x7c], ebx
jle 0x408df4
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x28]
xor esi, esi
cmp eax, ebx
je 0x408dc8
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x7c], ebx
jle 0x408e50
mov esi, dword [ebp + 0x74]
lea eax, [ebp + 0x7c]
mov dword [ebp + 0x7c], esi
call fcn.00435a49
mov eax, dword [ebp + 0x7c]
mov word [eax], bx
cmp word [esi], bx
je 0x408e50
push dword [ebp + 0x68]
lea ecx, [ebp + 0x6c]
call fcn.004403c3
push 0x495674
lea ecx, [ebp + 0x6c]
call fcn.00435dd0
push esi
lea ecx, [ebp + 0x6c]
call fcn.00435dd0
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x6c]
call fcn.00447be6
lea ecx, [ebp + 0x6c]
mov ebx, eax
call fcn.0043092f
lea ecx, [ebp - 0x64]
call fcn.0043092f
lea ecx, [ebp + 0x30]
call fcn.0043092f
lea ecx, [ebp + 0x78]
call fcn.0043092f
lea ecx, [ebp + 0x74]
jmp 0x40ad84
push dword [ebp + 0x68]
lea ecx, [ebp - 0xcc]
call fcn.004403c3
cmp byte [ebp - 0x33], bl
je 0x408f33
push 0x495008
lea ecx, [ebp - 0xcc]
call fcn.00440487
push 1
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00416853
add esp, 0xc
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp + 0x68], eax
call fcn.00435dd0
lea eax, [ebp - 0xac]
push eax
call fcn.00403bbc
pop ecx
mov dword [ebp + 0x38], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0xcc]
mov dword [ebp + 0x68], eax
je 0x408ede
cmp byte [ebp - 0x39], bl
je 0x408ee8
lea eax, [ebp - 0x244]
or byte [eax + 0x2c], 0x80
xor edi, edi
inc edi
cmp ecx, ebx
je 0x408efc
lea eax, [ebp - 0x244]
or dword [eax + 0x2c], edi
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x2f]
and al, 3
cmp al, 3
je 0x408f0a
cmp byte [ebp - 0x32], bl
je 0x408f14
lea eax, [ebp - 0x244]
or byte [eax + 0x2f], 8
lea eax, [ebp - 0x244]
cmp dword [eax + 8], ebx
je 0x4091e0
cmp byte [ebp + 0x2f], bl
jle 0x4091e0
mov eax, edi
jmp 0x4091e2
cmp byte [ebp + 0xf], bl
je 0x408ec5
cmp dword [ebp - 0x14], esi
je 0x408ec5
mov eax, dword [ebp - 0xcc]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
mov dword [ebp - 0x40], ebx
call fcn.00416853
mov esi, eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x40], eax
push 3
lea eax, [ebp - 0x40]
push eax
push 0x495670
call fcn.00437ad0
add esp, 0x18
test al, al
jne 0x409037
push 7
lea eax, [ebp - 0x40]
push eax
push str.cmd.exe
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x409037
cmp dword [0x4acbc8], ebx
jne 0x408fe3
push ebx
push 0x24
lea eax, [ebp - 0x574]
push eax
push ebx
mov word [ebp - 0x574], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x574]
mov edi, 0x4acbc8
push eax
mov ecx, edi
call fcn.00440487
push str.System32cmd.exe
mov ecx, edi
call fcn.00435dd0
push dword [0x4acbc8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov word [0x4acbac], ax
movsx eax, word [0x4acbac]
push eax
push dword [ebp - 0x40]
mov dword [ebp + 0x48], ebx
push dword [0x4acbc8]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4090ac
movsx eax, word [0x4acbac]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x40902a
call fcn.0040bc38
test al, al
je 0x4090ac
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], ecx
call fcn.0040459d
pop ecx
push 2
lea eax, [ebp - 0x40]
push eax
push 0x495640
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4090ac
mov eax, dword [ebp - 0x40]
cmp word [eax], 0x22
jne 0x409092
add eax, 2
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
pop ecx
je 0x409087
push 4
lea eax, [ebp + 0x7c]
push eax
push str.call
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x40908f
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x40], eax
jmp 0x409092
mov eax, dword [ebp - 0x40]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00416853
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x48], 1
mov eax, esi
sub eax, dword [ebp + 0x68]
and eax, 0xfffffffe
cmp eax, 8
jle 0x408ec5
push 4
push str..cmd
lea edi, [esi - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x4090e8
push 4
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408ec5
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0x60], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x500]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x68]
stosb byte es:[edi], al
lea ecx, [ebp + 0x1c]
lea edi, [ebp - 0x500]
mov byte [ebp + 0x7f], bl
mov dword [ebp + 0x1c], ebx
call fcn.004045f9
push ebx
lea eax, [ebp - 0xe0]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x409186
mov al, byte [ebp - 0x500]
mov dword [ebp - 0x14], 0x10000000
jmp 0x40916e
cmp al, 0xd
je 0x409175
cmp al, 0xa
je 0x409175
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x409163
jmp 0x409175
inc edi
movsx ax, byte [edi]
push eax
call fcn.00402ba5
add esp, 4
test al, al
jne 0x409174
cmp dword [ebp + 0x48], ebx
jne 0x4091b6
cmp byte [edi], 0x3a
jne 0x40919b
cmp byte [edi + 1], 0x3a
jne 0x40919b
inc edi
inc edi
jmp 0x40919b
inc edi
cmp byte [edi], 0x40
je 0x40919a
push 7
push edi
push str._pecmd
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x4091b6
mov byte [ebp + 0x7f], 1
lea ecx, [ebp + 0x1c]
call fcn.00402b27
cmp byte [ebp + 0x7f], bl
mov ax, word [ebp - 0x60]
mov word [esi], ax
je 0x408ec5
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x54]
call fcn.00428650
mov ebx, eax
jmp 0x40ad7e
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp - 0xa0], ebx
je 0x4091fc
mov dword [ebp - 0xa0], edi
mov dword [ebp + 0x5c], 4
push eax
lea ecx, [ebp - 0x60]
call fcn.00410482
cmp byte [0x4acd64], bl
mov esi, dword [ebp + 0x6c]
mov dword [ebp + 0x48], 0x4acf10
jne 0x409232
cmp esi, ebx
je 0x409220
cmp byte [esi + 8], bl
jne 0x409232
cmp byte [ebp - 0x49], bl
mov byte [ebp + 0x7f], bl
je 0x409236
cmp esi, ebx
je 0x409236
mov eax, dword [esi + 0x24]
mov dword [ebp + 0x48], eax
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004403c3
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x28], ebx
je 0x4094c4
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x340]
call fcn.00410742
cmp esi, ebx
je 0x409275
push dword [ebp + 0x48]
lea ecx, [ebp - 0x340]
push esi
call fcn.00432cce
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xb8], edi
call fcn.00435d80
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 0x6c], eax
jmp 0x409310
mov dword [ebp + 0x7c], edi
jmp 0x4092a3
cmp ax, 0x3d
je 0x4092ad
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40929d
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x40930e
cmp word [edi + 2], bx
je 0x409309
cmp esi, 0x104
jg 0x409309
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00404561
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x340]
mov word [eax + esi*2], bx
call fcn.0040cb92
test eax, eax
jne 0x409309
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x340]
call fcn.004107a0
jmp 0x409309
inc edi
inc edi
cmp word [edi], bx
jne 0x409307
inc edi
inc edi
cmp word [edi], bx
jne 0x409298
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x33c]
xor eax, eax
cmp ecx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x6c], eax
jle 0x4093cd
jmp 0x40933f
mov eax, dword [ebp + 0x6c]
lea edi, [eax + 1]
cmp edi, dword [ebp + 0x7c]
mov dword [ebp + 0x34], eax
mov dword [ebp - 0x90], edi
jge 0x4093bb
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov dword [ebp - 0xb8], eax
mov dword [ebp + 0x48], eax
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp + 0x48]
mov ecx, dword [ecx + eax]
mov ecx, dword [ecx]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
jge 0x409389
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x48], esi
inc edi
cmp edi, dword [ebp + 0x7c]
jl 0x40935f
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp + 0x6c]
je 0x4093bb
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp + 0x34]
add eax, edx
mov esi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x340]
mov dword [ecx + eax], esi
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
jl 0x40933c
xor edi, edi
cmp dword [ebp + 0x7c], ebx
jle 0x40940b
mov eax, dword [ebp - 0x340]
mov eax, dword [eax + edi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [ebp - 0x78]
lea esi, [ecx + eax + 1]
mov eax, dword [ebp - 0x340]
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc edi
cmp edi, dword [ebp + 0x7c]
lea eax, [esi + eax + 3]
mov dword [ebp - 0x78], eax
jl 0x4093d4
mov eax, dword [ebp - 0x78]
add eax, 4
push eax
lea ecx, [ebp + 0x1c]
call fcn.00435da9
mov edi, dword [ebp + 0x1c]
xor esi, esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x28], edi
jle 0x409490
mov eax, dword [ebp - 0x340]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
push edi
call fcn.00404561
mov eax, dword [ebp + 0x34]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x340]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
push edi
call fcn.00404561
mov eax, dword [ebp + 0x34]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x409427
mov word [edi], bx
lea ecx, [ebp - 0x5c]
mov word [edi + 2], bx
call fcn.0043092f
push ebx
lea ecx, [ebp - 0x340]
call fcn.004282f1
lea ecx, [ebp - 0x300]
call fcn.0043092f
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x50]
xor al, al
cmp word [ecx], 0x40
jne 0x4094d3
inc al
jmp 0x4094dd
cmp dword [ebp - 0x88], ebx
je 0x4094dd
mov al, 2
cmp byte [ebp + 0x77], bl
je 0x4095d3
or byte [ebp + 0x77], 8
neg al
mov dword [ebp + 0x14], edi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.00432a01
push eax
lea eax, [ebp - 0x1a0]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x409578
cmp eax, 0xffffffff
je 0x409578
push 0xffffffffffffffff
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp + 0x7c]
call fcn.004403f9
push ebx
push ebx
push 3
lea ecx, [ebp - 0x168]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x38]
call fcn.004045f9
lea ecx, [ebp + 0x7c]
call fcn.0043092f
jmp 0x40957f
push edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [ebp - 0x38]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push esi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.DLL_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x244]
or byte [eax + 0x2d], 1
test byte [ebp + 0x44], 2
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x1c], edi
jne 0x4095c7
cmp byte [ebp + 0x44], bl
jne 0x4095ca
mov dword [eax + 0x3c], esi
test byte [ebp + 0x44], 1
je 0x4095e9
mov dword [eax + 0x40], esi
cmp dword [ebp + 0x14], ebx
jne 0x4095e9
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessWorkingSetSize]
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 0x28]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
or dword [ebp + 0x5c], eax
cmp byte [ebp + 0x42], bl
mov dword [ebp + 8], ebx
mov dword [ebp - 0x28], ebx
je 0x409618
or dword [ebp + 0x5c], 4
cmp byte [ebp + 3], bl
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x90], ebx
je 0x40963c
lea eax, [ebp - 0xb8]
push eax
call fcn.00403127
pop ecx
mov dword [ebp - 0x90], eax
cmp byte [ebp + 0x51], bl
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, dword [ebp + 0x38]
je 0x409652
cmp edi, ebx
je 0x40a222
cmp byte [ebp - 0x34], bl
je 0x4096c3
cmp word [ebp - 4], bx
jne 0x4096c3
cmp word [ebp + 0x20], bx
jne 0x4096c3
call fcn.00407011
push dword [ebp + 0x68]
mov dword [ebp - 0x110], eax
push edi
push dword [ebp + 0x24]
lea eax, [ebp - 8]
push eax
call fcn.00403956
mov esi, eax
push esi
call fcn.00403be0
add esp, 0x14
test eax, eax
jne 0x409885
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x48], eax
jmp 0x40a053
mov eax, dword [ebp - 0xb4]
cmp word [eax], bx
je 0x409857
cmp word [ebp - 4], bx
jne 0x409857
cmp word [ebp + 0x20], bx
jne 0x409857
cmp byte [ebp + 0x47], bl
mov dword [ebp - 0x48], ebx
je 0x409799
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00402b8a
lea ecx, [ebp + 0x7c]
call fcn.00435c39
mov edi, dword [ebp - 0xa8]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.0047fd70
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
call fcn.0043b3cf
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0xa8]
neg edi
call fcn.00435e1f
mov eax, dword [ebp + 0x6c]
push eax
mov dword [ebp - 0xb0], eax
call esi
push eax
push ebx
push dword [ebp - 0xb0]
call fcn.0047fd70
mov eax, dword [ebp + 0x7c]
add esp, 0xc
push eax
mov dword [ebp - 0xb0], eax
call esi
push eax
push ebx
push dword [ebp - 0xb0]
call fcn.0047fd70
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.0043092f
lea ecx, [ebp + 0x6c]
call fcn.0043092f
cmp edi, ebx
je 0x409820
mov edi, dword [ebp - 0xb4]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x4097b7
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x4097c5
mov word [eax], bx
mov esi, dword [ebp - 0xb4]
lea edi, [eax + 2]
jmp 0x4097ca
mov esi, 0x4955f0
push dword [ebp + 0x68]
lea eax, [ebp - 8]
push dword [ebp + 0x38]
push dword [ebp + 0x24]
push eax
call fcn.00403956
push eax
mov dword [ebp + 0x24], eax
call fcn.00403be0
add esp, 0x14
test eax, eax
jne 0x409885
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
push dword [ebp + 0x38]
push 1
push dword [ebp - 0xa8]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp - 0x48], eax
mov edi, dword [ebp - 0xa8]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0047fd70
mov edi, dword [ebp - 0xb4]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0047fd70
add esp, 0xc
jmp 0x40a053
cmp byte [ebp + 0x46], bl
je 0x4098d4
cmp edi, ebx
je 0x409866
cmp word [edi], 0x26
je 0x4098d4
cmp word [ebp - 0x20], bx
jne 0x4098d4
cmp word [ebp - 4], bx
jne 0x4098d4
cmp word [ebp + 0x20], bx
jne 0x4098d4
push dword [ebp + 0x24]
call fcn.00403be0
test eax, eax
pop ecx
je 0x409891
mov dword [ebp + 0x7c], 3
jmp 0x40a301
push dword [ebp - 0x30]
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp - 0x1c]
push dword [ebp + 0x68]
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
call fcn.00476e93
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp - 0x48], ecx
jmp 0x40a053
lea ecx, [ebp - 0x9c]
mov dword [ebp + 0x6c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.00435c39
cmp word [ebp + 0x20], bx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp + 0x30], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x34], eax
je 0x4099b7
cmp word [edi], 0x22
jne 0x409928
add edi, 2
mov dword [ebp + 0x7c], edi
mov edi, dword [ebp + 0x7c]
push 0x3a
lea eax, [ebp + 0x7c]
call fcn.004754d0
mov eax, dword [ebp + 0x7c]
cmp eax, edi
pop ecx
je 0x409948
cmp word [eax - 2], 0x22
jne 0x409948
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x409950
inc eax
inc eax
cmp word [eax], 0x22
mov esi, eax
jne 0x40996b
lea esi, [eax + 2]
inc eax
inc eax
cmp word [eax], 0x22
jne 0x409966
mov word [eax], bx
cmp word [eax], bx
jne 0x40995b
cmp word [ebp - 4], bx
je 0x409989
push 0x3a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x409989
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
push ebx
push ebx
push 0x10000
push esi
lea eax, [ebp - 0x9c]
push eax
push edi
call fcn.0042eced
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x94]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x30], ecx
jmp 0x409ba6
cmp edi, ebx
je 0x409a8a
cmp word [edi], 0x26
jne 0x409a71
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040cb92
mov esi, eax
cmp esi, ebx
jne 0x409a33
lea ecx, [ebp + 0x3c]
call fcn.0043092f
lea ecx, [ebp - 0x9c]
call fcn.0043092f
lea ecx, [ebp + 0x10]
call fcn.0043092f
lea ecx, [ebp - 0x28]
call fcn.0043092f
lea ecx, [ebp + 8]
call fcn.0043092f
lea ecx, [ebp - 8]
call fcn.0043092f
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp + 0x1c]
call fcn.0043092f
lea ecx, [ebp - 0x60]
call fcn.004104b6
mov ebx, 0x80070057
jmp 0x40ad7e
mov eax, dword [esi + 0xc]
and eax, 0x3fffffff
mov dword [ebp - 0x98], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0x9c]
call fcn.00435c7d
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x98]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0x9c]
call fcn.004102e0
add esp, 0xc
jmp 0x409ba6
mov al, byte [ebp + 0x43]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0043d37b
pop ecx
pop ecx
mov dword [ebp + 0x38], eax
cmp dword [ebp + 0x38], ebx
mov dword [ebp - 0x130], ebx
jne 0x409aff
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x409aa5
cmp word [eax], 0x2a
jne 0x409aa5
inc dword [ebp - 0x20]
cmp byte [ebp + 0x46], bl
je 0x409aad
mov dword [ebp - 0x20], ebx
cmp word [ebp - 4], bx
je 0x40a06c
push 0x3a
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x6c], esi
je 0x409af6
mov word [esi], bx
inc esi
inc esi
mov dword [ebp + 0x6c], esi
je 0x409af6
push dword [ebp - 0x78]
lea ecx, [ebp + 0x3c]
mov dword [ebp - 0xf0], 2
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x34], ebx
call fcn.0044042b
jmp 0x409bd8
cmp dword [ebp + 0x38], ebx
je 0x40a06c
cmp word [ebp - 4], bx
mov edi, dword [ebp + 0x38]
je 0x409b21
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x409b21
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
add dword [ebp + 0x38], 2
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0043d2c9
mov si, word [edi]
pop ecx
mov dword [ebp - 0xa4], eax
mov eax, dword [0x4ace04]
mov word [edi], bx
pop ecx
mov ecx, dword [ebp - 0x78]
mov dword [ebp + 0x48], 0x20
cmp word [ecx], bx
mov dword [ebp + 0x7c], ebx
je 0x409b67
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
mov word [edi], si
je 0x409b98
lea ecx, [ebp + 0x48]
push ecx
lea ecx, [ebp - 0x9c]
push ecx
push dword [ebp - 0xa4]
mov dword [ebp + 0x48], 0x20
push dword [ebp - 0x130]
push eax
call fcn.00410a1a
add esp, 0x14
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x7c], ebx
je 0x409ba6
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0x98], ebx
je 0x40a038
cmp dword [ebp + 0x30], ebx
je 0x40a038
cmp word [ebp - 0x20], bx
mov dword [ebp - 0xf0], 1
ja 0x409bd5
cmp word [ebp - 4], bx
je 0x409f61
mov esi, dword [ebp + 0x6c]
cmp dword [ebp + 0x34], ebx
mov eax, dword [ebp - 0x124]
jne 0x409be8
mov eax, 0x494e9c
push eax
push str.exedat
push dword [ebp - 0x30]
lea eax, [ebp - 0x6c]
push dword [ebp + 0x34]
push eax
call fcn.004046c0
add esp, 0x14
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 8]
call fcn.00440459
mov edi, dword [ebp - 0x5c]
lea eax, [ebp + 0x3c]
mov dword [ebp + 0x34], eax
lea eax, [ebp - 0x5c]
cmp edi, ebx
mov dword [ebp - 0x30], eax
setne al
cmp al, bl
mov dword [ebp - 0xe0], ebx
je 0x409c52
push ebx
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x98]
push dword [ebp + 0x30]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call fcn.00434051
pop ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x409c5f
cmp dword [ebp - 0xf0], 1
jle 0x40a038
cmp esi, ebx
push dword [ebp - 0x6c]
mov byte [ebp + 0x7f], bl
je 0x409db9
mov eax, dword [ebp + 0x3c]
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x3c], ebx
call fcn.00440487
push str..ex
lea ecx, [ebp + 0x3c]
call fcn.00435dd0
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp + 8]
call fcn.00440459
cmp word [esi], 0x5c
je 0x409ca5
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
cmp word [ebp - 4], 1
jne 0x409cfe
push 0x4955c0
lea ecx, [ebp + 0x20]
call fcn.004403c3
push dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
call fcn.00435dd0
push 0x4955b8
lea ecx, [ebp + 0x20]
call fcn.00435dd0
push dword [ebp + 0x3c]
lea ecx, [ebp + 0x20]
call fcn.00435dd0
push dword [ebp + 0x20]
mov ecx, dword [ebp + 0x54]
call fcn.004239ad
lea ecx, [ebp + 0x20]
call fcn.0043092f
jmp 0x409d9a
cmp word [ebp - 4], 0x100
jne 0x409d9a
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x2a4], 0x44
mov dword [ebp - 0x2a0], ebx
lea edi, [ebp - 0x29c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc8], ebx
lea edi, [ebp - 0xc4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x278], 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4955b0
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [ebp - 0xc8], ebx
je 0x409d86
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xc4], ebx
je 0x409d9a
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
lea ecx, [ebp + 0x3c]
call fcn.00435dd0
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 8]
call fcn.00440459
lea ecx, [ebp + 0x48]
call fcn.0043092f
jmp 0x409dc1
lea ecx, [ebp + 8]
call fcn.00440487
mov edx, dword [ebp + 0x68]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x409dd2
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x409e5f
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x409df0
mov edi, dword [ebp + 0x3c]
lea esi, [eax + 4]
jmp 0x409e34
cmp cx, 0x5c
jne 0x409e5f
cmp di, 0x22
je 0x409e31
mov eax, dword [ebp + 8]
mov edi, 0x104
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 0x48], eax
mov dword [ebp + 8], ebx
call fcn.00435da9
mov eax, dword [ebp + 8]
push edi
mov word [eax], bx
push dword [ebp + 8]
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
lea ecx, [ebp + 0x48]
call fcn.0043092f
mov edx, dword [ebp + 0x68]
mov edi, dword [ebp + 8]
cmp word [edx], 0x22
jne 0x409e47
push 0x4953b4
lea ecx, [ebp - 0x28]
call fcn.00440487
push edi
lea ecx, [ebp - 0x28]
call fcn.00435dd0
push esi
lea ecx, [ebp - 0x28]
call fcn.00435dd0
mov edx, dword [ebp - 0x28]
mov dword [ebp + 0x68], edx
cmp dword [ebp + 0x6c], ebx
je 0x409eb6
cmp word [ebp - 0x20], bx
ja 0x409e8f
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x6c], ebx
call fcn.00410567
cmp dword [ebp - 0x98], ebx
pop ecx
pop ecx
je 0x409eb3
mov byte [ebp + 0x7f], 1
jmp 0x409f32
cmp byte [ebp + 0x51], bl
je 0x409eb6
cmp dword [ebp + 0x24], ebx
jne 0x409e9f
mov eax, dword [ebp + 8]
mov dword [ebp + 0x24], eax
cmp word [ebp - 0x20], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x7f], 2
jb 0x40a207
jmp 0x409f32
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov esi, dword [ebp + 0x3c]
je 0x409ec7
cmp word [eax], bx
jne 0x409ec7
xor esi, esi
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x409ed1
mov eax, dword [ebp + 8]
push edx
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00403956
push eax
mov dword [ebp + 0x24], eax
call fcn.00403be0
add esp, 0x14
test eax, eax
jne 0x40a08c
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.0047f78b
add esp, 0x28
cmp byte [ebp - 0x20], 2
mov dword [ebp - 0x48], eax
jl 0x40a038
cmp word [ebp - 4], bx
jne 0x40a038
cmp byte [ebp + 0x7f], 1
jne 0x409f3d
or eax, 0xffffffff
jmp 0x409f46
lea eax, [ebp - 0x15c]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x6c]
call fcn.00402cb1
cmp byte [ebp + 0x7f], 1
mov eax, dword [ebp - 0x6c]
pop ecx
pop ecx
mov word [eax], bx
jne 0x40a063
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x22
mov edi, eax
jne 0x409f6f
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x48], ebx
jne 0x409f96
cmp word [eax + 2], 0x5c
jne 0x409f96
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x409f96
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x48], ax
mov word [edi], 0x22
push dword [ebp + 0x24]
call fcn.00403be0
test eax, eax
pop ecx
jne 0x40a08c
push ebx
lea esi, [ebp - 0x15c]
push esi
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp - 0x1c]
push edi
push dword [ebp - 0x98]
push dword [ebp + 0x30]
call fcn.00476e93
add esp, 0x28
cmp word [ebp + 0x48], bx
mov dword [ebp - 0xa4], eax
je 0x409fe7
mov ax, word [ebp + 0x48]
mov word [edi], ax
cmp dword [ebp - 0xa4], ebx
jl 0x409bd5
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x409bd5
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
je 0x409bd5
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [ebp - 0xa4], ebx
setg al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
je 0x40a038
cmp word [eax], bx
jne 0x409f32
lea ecx, [ebp + 0x3c]
call fcn.0043092f
lea ecx, [ebp - 0x9c]
call fcn.0043092f
lea ecx, [ebp + 0x10]
call fcn.0043092f
cmp dword [ebp - 0x48], ebx
je 0x40a2f3
xor eax, eax
jmp 0x40a2f9
cmp byte [ebp + 0x7f], 2
jmp 0x40a201
push dword [ebp + 0x68]
lea eax, [ebp - 8]
push edi
push dword [ebp + 0x24]
push eax
call fcn.00403956
push eax
mov dword [ebp + 0x24], eax
call fcn.00403be0
add esp, 0x14
test eax, eax
je 0x40a0b3
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x7c], 3
call fcn.0043092f
lea ecx, [ebp - 0x9c]
call fcn.0043092f
lea ecx, [ebp + 0x10]
call fcn.0043092f
jmp 0x40a301
cmp byte [ebp + 0x77], bl
jne 0x40a135
push 0x5c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x40a0ce
inc esi
inc esi
jmp 0x40a0d1
mov esi, dword [ebp + 0x68]
push 8
push esi
push str.winpeshl
call fcn.004318b1
add esp, 0xc
test al, al
je 0x40a103
xor eax, eax
mov ax, word [esi + 0x10]
cmp ax, bx
je 0x40a0ff
cmp ax, 0x2e
je 0x40a0ff
call fcn.0040bc38
test al, al
je 0x40a103
mov byte [ebp + 0x2e], 1
push 8
push esi
push str.wpeinit
call fcn.004318b1
add esp, 0xc
test al, al
je 0x40a135
xor eax, eax
mov ax, word [esi + 0xe]
cmp ax, bx
je 0x40a131
cmp ax, 0x2e
je 0x40a131
call fcn.0040bc38
test al, al
je 0x40a135
mov byte [ebp + 0x2e], 1
test byte [ebp + 0x53], 1
jne 0x40a140
cmp dword [ebp + 4], ebx
je 0x40a168
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
push 1
push str.Shell.x
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.00431794
add esp, 0x18
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
call fcn.0047f78b
mov esi, eax
add esp, 0x28
cmp esi, ebx
mov dword [ebp - 0x48], esi
jne 0x40a19c
mov byte [ebp + 0x2e], bl
cmp byte [ebp + 0x2e], bl
je 0x40a1c4
call fcn.00473a1b
test eax, eax
jg 0x40a1b1
mov dword [ebp + 0x14], 1
cmp dword [ebp + 0x14], ebx
jne 0x40a1c4
push str.waitpeinit.pecmd
call fcn.0047f7b4
pop ecx
mov dword [ebp + 0x14], eax
cmp esi, ebx
jne 0x40a038
push dword [ebp + 4]
push esi
push dword [ebp + 0x68]
push str._CreateProcess__s__d___d__r_n
push 0x4acf10
call fcn.0040cde2
add esp, 0x14
cmp byte [ebp + 0x51], bl
jne 0x40a038
cmp edi, ebx
jne 0x40a038
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xc1
jne 0x40a038
lea ecx, [ebp + 0x3c]
call fcn.0043092f
lea ecx, [ebp - 0x9c]
call fcn.0043092f
lea ecx, [ebp + 0x10]
call fcn.0043092f
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b4]
mov dword [ebp - 0x1bc], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x1b8], 0x4540
jne 0x40a24d
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x40a268
cmp word [eax], bx
je 0x40a268
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x1ac], eax
cmp word [eax], 0x22
jne 0x40a2c0
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.00416853
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x10c]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.00435e88
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], esi
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x184]
lea esi, [ebp - 0x15c]
push eax
mov dword [esi], eax
mov dword [ebp - 0x184], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessId]
mov dword [esi + 8], eax
jmp 0x40a053
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0x18]
call fcn.00402b27
cmp dword [ebp - 0x90], ebx
je 0x40a31d
push dword [ebp - 0xb8]
call fcn.00403138
pop ecx
lea esi, [ebp - 0x80]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a32d
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x100]
mov dword [esi], ebx
cmp word [eax], bx
je 0x40a34f
push eax
lea eax, [ebp - 0x15c]
push dword [eax + 8]
push dword [ebp + 0x54]
call fcn.004380a5
add esp, 0xc
cmp byte [ebp + 0x42], bl
je 0x40a372
lea esi, [ebp - 0x15c]
cmp dword [esi], ebx
je 0x40a372
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x74], eax
push eax
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
push str.__LastPID
lea esi, [ebp - 0x15c]
push dword [esi + 8]
push dword [ebp + 0x54]
call fcn.004380a5
push str.__LastTID
push dword [esi + 0xc]
push dword [ebp + 0x54]
call fcn.004380a5
add esp, 0x18
cmp dword [ebp - 0xa0], ebx
je 0x40a3b4
push dword [esi]
push 4
push str.SeDebugPrivilege
call fcn.0040f29f
add esp, 0xc
test byte [ebp + 0x5c], 4
je 0x40a3c8
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40a3c8
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea ecx, [ebp - 0x28]
call fcn.0043092f
lea ecx, [ebp + 8]
call fcn.0043092f
lea ecx, [ebp - 8]
call fcn.0043092f
mov eax, 0x4ad684
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp + 0x1c]
call fcn.0043092f
lea ecx, [ebp - 0x60]
call fcn.004104b6
lea edi, [ebp - 0x38]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a40c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x84]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a421
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x58]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a433
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp + 0x18]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a445
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x8c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a45a
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [ebp + 0x53], bl
mov dword [edi], ebx
je 0x40a49a
mov eax, dword [esi]
cmp eax, ebx
je 0x40a473
push 0x1388
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test byte [ebp + 0x53], 1
je 0x40a481
push 1
call fcn.0040e3e1
pop ecx
cmp dword [ebp - 0xe4], ebx
je 0x40a49a
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp - 0xe4]
call fcn.00426546
cmp dword [ebp - 0x48], ebx
je 0x40ac32
mov eax, dword [esi]
cmp eax, ebx
jne 0x40a4ac
mov dword [ebp + 0x14], ebx
mov ecx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dword [ebp + ecx*4 - 0x120], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40a4c7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 4], ebx
mov dword [esi + 4], ebx
je 0x40a4e5
mov ecx, dword [ebp + 0x54]
push ebx
push 0x3e8
call fcn.0040d358
push dword [esi]
call fcn.0040e1a4
pop ecx
cmp dword [ebp + 0x14], ebx
je 0x40ac48
mov al, byte [0x4ab290]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 4], edi
xor esi, esi
call fcn.00435c56
mov eax, dword [ebp - 0x50]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x20], eax
mov dword [ebp - 0xa4], ecx
mov byte [ebp + 0x7f], bl
jne 0x40a5cc
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x20], ecx
cmp byte [ebp - 0x41], bl
je 0x40a58b
mov ecx, dword [ebp + 0x54]
push ebx
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x20]
mov dword [ebp + 0x48], ebx
call fcn.0043dd01
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x48]
lea ecx, [ebp + 0x5c]
call fcn.00435cea
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
lea edi, [esi + 0x3ff]
and edi, 0xfffffc00
add edi, 0x100000
lea eax, [edi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 4], edi
call fcn.00435c7d
lea ecx, [ebp + 0x48]
call fcn.0043092f
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessWorkingSetSize]
test byte [ebp + 0x77], 8
je 0x40a8ee
mov eax, dword [ebp - 0x50]
mov ax, word [eax]
cmp ax, 0x40
je 0x40a5e1
cmp byte [ebp - 0xd], bl
je 0x40a5e1
cmp ax, 0x26
je 0x40a5c6
mov eax, dword [ebp + 0x54]
test byte [eax + 9], 0xf
je 0x40a5e1
mov byte [ebp + 0x42], 1
jmp 0x40a5e4
cmp dword [ebp - 0x88], ebx
je 0x40a530
mov byte [ebp + 0x7f], 2
jmp 0x40a530
mov byte [ebp + 0x42], bl
push ebx
mov dword [ebp - 0xe0], ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea eax, [ebp - 0x24]
mov edi, dword [eax]
lea eax, [ebp - 0x180]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xf0], esi
je 0x40a619
mov eax, dword [ebp + 4]
sub eax, esi
mov dword [ebp + 0x28], eax
jmp 0x40a620
mov dword [ebp + 0x28], 0x100000
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 0x28]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [ebp - 0xd4], ebx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x34], ebx
jg 0x40a662
mov dword [ebp - 0xd4], 0x3e8
lea ecx, [ebp - 0x5c]
mov byte [ebp + 0x47], bl
call fcn.00435d62
mov al, byte [0x4ab290]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x40a8e1
mov ecx, dword [ebp + 0x54]
push 0x4ff
push dword [ebp - 0xd4]
lea eax, [ebp - 0x120]
push ebx
push eax
push dword [ebp - 0x70]
call fcn.0040ee25
cmp eax, ebx
mov dword [ebp - 0xb0], eax
jne 0x40a72f
lea eax, [ebp - 0x24]
mov edi, dword [eax]
push ebx
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x180]
push eax
push edi
mov dword [ebp + 0x30], ebx
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
cmp dword [ebp + 0x30], ebx
jle 0x40a6dd
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x30], eax
jle 0x40a6d4
mov dword [ebp + 0x30], eax
add esi, dword [ebp + 0x30]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 4]
jl 0x40a6fe
add dword [ebp + 4], 0x100000
mov eax, dword [ebp + 4]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.00435c7d
cmp byte [ebp + 0x7f], bl
je 0x40a70d
mov eax, dword [ebp + 4]
sub eax, esi
mov dword [ebp + 0x28], eax
jmp 0x40a714
mov dword [ebp + 0x28], 0x100000
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp + 0x30]
push eax
push dword [ebp + 0x28]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x40a766
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x60], eax
sub eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xd4]
jge 0x40a820
cmp esi, dword [ebp + 0x34]
je 0x40a8d8
cmp eax, 0x14
jl 0x40a8d8
jmp 0x40a820
mov eax, dword [ebp - 0x70]
cmp eax, 1
jle 0x40a792
dec eax
cmp eax, dword [ebp - 0xb0]
jne 0x40a792
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x47], 1
je 0x40a8e1
cmp esi, dword [ebp + 0x34]
je 0x40a8e1
jmp 0x40a820
test byte [ebp + 0x77], 1
je 0x40a7b2
mov eax, dword [ebp - 0xf0]
jmp 0x40a7ae
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x40a8e1
inc eax
cmp eax, esi
jl 0x40a7a0
push 5
pop edi
dec edi
js 0x40a66d
cmp byte [0x4ab290], bl
jle 0x40a66d
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a66d
cmp dword [ebp - 0x25c], 0x12
je 0x40a807
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a7b5
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x47], 1
je 0x40a66d
cmp esi, dword [ebp + 0x34]
je 0x40a66d
cmp byte [ebp + 0x42], bl
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x34], esi
mov dword [ebp - 0xa0], ecx
jne 0x40a85c
cmp dword [ebp - 0x68], 0x4b0
je 0x40a84f
push dword [ebp - 0x68]
lea ecx, [ebp - 0x5c]
push esi
push eax
call fcn.00435e1f
mov eax, dword [ebp - 0x5c]
jmp 0x40a85c
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x40a879
mov ecx, dword [ebp + 0x54]
push eax
push eax
push 0x4949a4
push dword [ebp + 0x20]
push dword [ebp + 0x20]
call fcn.004331b7
jmp 0x40a8a3
cmp byte [ebp + 0x42], bl
je 0x40a897
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x50]
push dword [ebp + 0x54]
call fcn.00445562
add esp, 0x18
jmp 0x40a8a3
mov ecx, dword [ebp + 0x54]
push eax
push dword [ebp + 0x20]
call fcn.00435749
cmp dword [ebp - 0x88], ebx
je 0x40a8d8
push dword [ebp - 0x88]
lea ecx, [ebp - 0x90]
call fcn.004403c3
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp - 0x90]
call fcn.00426546
lea ecx, [ebp - 0x90]
call fcn.0043092f
cmp byte [ebp + 0x47], bl
je 0x40a766
lea ecx, [ebp - 0x5c]
call fcn.0043092f
jmp 0x40a9d4
cmp dword [ebp + 0x14], 0xffffff9c
je 0x40a9d4
jmp 0x40a9c4
mov ecx, dword [ebp + 0x54]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x70]
call fcn.0040ee25
mov ecx, dword [ebp - 0x70]
dec ecx
cmp ecx, eax
je 0x40a9d4
cmp dword [ebp - 0x70], 1
jle 0x40a9bc
cmp eax, ebx
jne 0x40a9bc
lea eax, [esi + 0x100000]
cmp eax, edi
jl 0x40a954
add edi, 0x100000
lea eax, [edi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00435c7d
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
lea eax, [ebp - 0x24]
push dword [eax]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40a9bc
cmp dword [ebp + 0x7c], ebx
jbe 0x40a9bc
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x40a9bc
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a9c4
cmp dword [ebp - 0x198], 0x12
je 0x40a9c4
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4ab290], bl
jg 0x40a983
mov al, byte [0x4ab290]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x40a8fd
cmp dword [ebp + 0x14], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp - 0x30], ebx
je 0x40aa05
cmp byte [ebp + 0x6f], bl
jle 0x40aa05
push ebx
lea eax, [ebp - 0x15c]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x15c]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
cmp byte [ebp + 0x77], bl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x40abe4
mov eax, dword [ebp - 0x50]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x40aa50
cmp byte [ebp - 0xd], bl
je 0x40aa50
cmp ax, 0x26
je 0x40aa4a
mov eax, dword [ebp + 0x54]
test byte [eax + 9], 0xf
je 0x40aa50
mov byte [ebp + 0x7b], 1
jmp 0x40aa53
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0xc4]
call fcn.00435c39
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
jne 0x40ab7a
cmp byte [ebp + 0x52], 2
jne 0x40aa85
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x40aae7
cmp byte [ebp + 0x52], 1
lea ecx, [ebp - 0xc4]
jne 0x40aa9f
push dword [ebp - 0x68]
push esi
push dword [ebp + 0x5c]
call fcn.00435e1f
jmp 0x40aaeb
lea eax, [esi + 0x18]
push eax
call fcn.00435da9
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0xbc], esi
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], esi
call fcn.004102e0
mov eax, dword [ebp - 0xc4]
push 0x10
add eax, esi
push ebx
push eax
call fcn.0047fd70
lea eax, [ebp - 0xc4]
push ebx
push eax
call fcn.004774cc
add esp, 0x20
cmp edi, ebx
jne 0x40aaf1
mov edi, dword [ebp - 0xc4]
test byte [ebp + 0x77], 4
je 0x40ab22
push edi
mov dword [ebp + 0x74], edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x40ab1b
mov ax, word [edi]
cmp ax, 0xd
je 0x40ab16
cmp ax, 0xa
jne 0x40ab7a
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x74]
jae 0x40ab07
jmp 0x40ab7a
test byte [ebp + 0x77], 1
jne 0x40ab41
test byte [ebp + 0x77], 2
je 0x40ab7a
jmp 0x40ab72
mov ax, word [edi]
cmp ax, 0xd
je 0x40ab46
cmp ax, 0xa
je 0x40ab46
inc edi
inc edi
cmp word [edi], bx
jne 0x40ab30
mov word [edi], bx
jmp 0x40ab7a
cmp ax, 0xd
je 0x40ab5b
cmp ax, 0xa
je 0x40ab5b
inc edi
inc edi
jmp 0x40ab72
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.00410296
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x40ab4b
mov eax, dword [ebp - 0x50]
cmp word [eax], 0x40
jne 0x40abaa
push dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x54]
push dword [ebp - 0xc4]
push 0x4949a4
push dword [ebp - 0xa4]
push dword [ebp - 0xa4]
call fcn.004331b7
jmp 0x40abd6
cmp byte [ebp + 0x7b], bl
je 0x40abc7
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x54]
call fcn.00445562
add esp, 0x18
jmp 0x40abd6
push dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.00435749
lea ecx, [ebp - 0xc4]
call fcn.0043092f
mov eax, dword [ebp - 0x30]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x2a0]
push 0x4954d0
push eax
mov word [ebp - 0x2a0], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x2a0]
push eax
push str.ERRORLEVEL
call fcn.00435749
cmp dword [ebp - 0x74], ebx
je 0x40ac28
push 1
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.DLL_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.0043092f
jmp 0x40ac48
mov eax, dword [ebp - 0x50]
cmp word [eax], bx
je 0x40ac48
mov ecx, dword [ebp + 0x54]
push 0x4949a4
push eax
call fcn.00435749
lea esi, [ebp - 0x15c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40ac5b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [ebp + 0x2e], bl
mov dword [esi], ebx
je 0x40acdd
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40acdd
cmp byte [0x4acc01], bl
jne 0x40acdd
cmp dword [ebp + 0x14], ebx
mov byte [0x4acc01], 1
je 0x40aca4
push str.SysStartuped
call fcn.0040eb21
test eax, eax
pop ecx
jne 0x40ac9b
push str.exec
push dword [ebp + 0x54]
call fcn.0040ec17
pop ecx
pop ecx
push ebx
call fcn.0040d5a0
pop ecx
jmp 0x40acdd
push eax
lea eax, [ebp - 0x36c]
push str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x36c]
push eax
push str.DELAY_bwinpeshl____s__r_n
push dword [ebp + 0x54]
call fcn.0040cde2
mov ecx, dword [ebp + 0x54]
add esp, 0x18
lea eax, [ebp - 0x36c]
push eax
call fcn.00402c2f
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
je 0x40acf4
cmp word [eax], bx
je 0x40acf4
push dword [esi + 8]
push eax
call fcn.00402cb1
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edi, [ebp - 0x58]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ad06
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x18]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ad14
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x8c]
cmp dword [edi], ebx
je 0x40ad23
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x38]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ad31
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x24]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ad3f
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x7c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40ad4d
push eax
call esi
cmp dword [ebp - 0x170], ebx
mov dword [edi], ebx
je 0x40ad5f
push dword [ebp - 0x170]
call esi
lea edi, [ebp - 0x15c]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40ad6f
push eax
call esi
mov ecx, dword [ebp + 0x54]
push ebx
mov dword [edi + 4], ebx
call fcn.00447ee8
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0xcc]
call fcn.0043092f
lea ecx, [ebp - 0xec]
call fcn.0043092f
lea ecx, [ebp - 0x18]
call fcn.00402b27
lea ecx, [ebp - 0x108]
call fcn.0043092f
lea ecx, [ebp - 0x80]
call fcn.00402b27
lea ecx, [ebp - 0x84]
call fcn.00402b27
lea ecx, [ebp - 0x8c]
call fcn.00402b27
lea ecx, [ebp + 0x18]
call fcn.00402b27
lea ecx, [ebp - 0x58]
call fcn.00402b27
lea ecx, [ebp - 0x7c]
call fcn.00402b27
lea ecx, [ebp - 0x38]
call fcn.00402b27
lea ecx, [ebp - 0x24]
call fcn.00402b27
lea ecx, [ebp - 0x6c]
call fcn.0043092f
lea ecx, [ebp - 0x13c]
call fcn.0043092f
lea ecx, [ebp - 0xd8]
call fcn.0043092f
lea ecx, [ebp - 0x54]
call fcn.0043092f
lea ecx, [ebp - 0x10c]
call fcn.0043092f
lea ecx, [ebp - 0xd0]
call fcn.0043092f
lea ecx, [ebp - 0x100]
call fcn.0043092f
lea ecx, [ebp - 0xac]
call fcn.0043092f
lea ecx, [ebp - 0x74]
call fcn.00402b27
lea ecx, [ebp - 0x110]
call fcn.00402b27
lea ecx, [ebp - 0x12c]
call fcn.0043092f
lea ecx, [ebp - 0xa8]
call fcn.0043092f
lea ecx, [ebp - 0xb4]
call fcn.0043092f
lea ecx, [ebp - 0x50]
call fcn.0043092f
lea ecx, [ebp - 0xf8]
call fcn.0043092f
lea ecx, [ebp - 0xe8]
call fcn.0043092f
lea ecx, [ebp - 0xf4]
call fcn.0043092f
lea ecx, [ebp - 0x104]
call fcn.0043092f
lea ecx, [ebp - 0xe4]
call fcn.0043092f
lea ecx, [ebp - 0xdc]
call fcn.0043092f
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18