Function at 0x401d68
Capabilities:
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Delete file
Get common file path
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50b8
call fcn.004070c0
push ebx
push esi
mov esi, 0x400
push edi
push esi
call fcn.00405d3b
xor edi, edi
mov ebx, eax
push esi
push edi
push ebx
mov dword [ebp - 0x20], ebx
call fcn.00406ac0
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.LogFiles_
push ebx
call fcn.004067c0
pop ecx
mov eax, 0x80000000
pop ecx
push edi
push dword [ebp + 8]
push edi
push edi
push eax
push eax
push eax
push eax
mov eax, str.NSUpdater
push 0x80000
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.ntdll
mov dword [0x415f70], eax
mov dword [0x415f60], edi
mov dword [0x415f64], edi
mov dword [0x415f58], edi
mov dword [0x415f5c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQuerySystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54d
mov dword [0x415f68], eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadIconA]
and byte [ebp + 0xb], 0
and byte [ebp - 5], 0
push str.AutoUpdate_error
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401e42
mov byte [ebp - 5], 1
push 0x401cf0
push edi
call fcn.004037f0
pop ecx
mov dword [ebp - 0x24], eax
pop ecx
lea eax, [ebp - 0x9ec]
mov ebx, 0x419938
push eax
mov ecx, ebx
call fcn.00403345
lea eax, [ebp - 0x9ec]
push str.neo.exe
push eax
lea eax, [ebp - 0x10f8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
pop ecx
push 0x3e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40313a
cmp byte [ebp - 5], 1
mov eax, str.NoNo_Player
jne 0x401ee1
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401ee1
push 1
lea eax, [ebp - 0x10f8]
push dword [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00403143
cmp dword [ebp - 4], edi
je 0x40313a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40313a
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x9ec]
push str.Setup.ini
push eax
lea eax, [ebp - 0x44b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
mov esi, str.update.tmp
pop ecx
lea eax, [ebp - 0x9ec]
push esi
push eax
lea eax, [ebp - 0x34b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x9ec]
pop ecx
push str.update.xml
push eax
lea eax, [ebp - 0x1e38]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x9ec]
pop ecx
push esi
push eax
lea eax, [ebp - 0x2378]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x9ec]
pop ecx
push str.neo.cfg
push eax
lea eax, [ebp - 0x50b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x38b8]
push eax
call fcn.004067b0
lea eax, [ebp - 0x38b8]
push str.NSUpdater.exe.tmp
push eax
call fcn.004067c0
lea eax, [ebp - 0x38b8]
push eax
call fcn.00401abd
add esp, 0x1c
test eax, eax
je 0x4020a5
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067b0
mov esi, str.NSUpdate.bat
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push 0x4143f4
push eax
call fcn.00406403
add esp, 0x18
mov ebx, eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push 0x4143f0
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.00407064
push ebx
push str._n_copy_NSUpdater.exe.tmp_NSUpdater.exe_n
call fcn.00407064
push ebx
push str.del_NSUpdater.exe.tmp_n
call fcn.00407064
push ebx
push str.del_NSUpdate.bat_n
call fcn.00407064
push ebx
call fcn.00406185
add esp, 0x2c
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067b0
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004067c0
add esp, 0x10
lea eax, [ebp - 0x5ec]
push edi
push edi
push edi
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
call fcn.00406f71
cmp dword [ebp - 0x24], edi
jne 0x401eb7
push 0x50c
call fcn.00405d3b
cmp eax, edi
pop ecx
je 0x4020c6
mov ecx, eax
call fcn.00404a10
jmp 0x4020c8
xor eax, eax
cmp eax, edi
mov dword [0x415f6c], eax
je 0x401eb7
lea eax, [ebp - 0x44b8]
mov ecx, ebx
push eax
call fcn.00403266
test al, al
je 0x402103
lea eax, [ebp - 0x34b8]
mov ecx, ebx
push eax
push 0x419b74
call fcn.004031ba
cmp byte [0x414040], 0
jne 0x40212d
push 1
lea eax, [ebp - 0x10f8]
push dword [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00403143
cmp dword [ebp - 4], edi
je 0x40280c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40280c
push 0x417c60
lea eax, [ebp - 0x9ec]
push esi
push eax
mov ecx, ebx
call fcn.0040354b
lea eax, [ebp - 0x1f78]
push eax
lea eax, [ebp - 0x1e38]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402163
and byte [0x419ca4], 0
jmp 0x402171
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [0x419ca4], 1
mov eax, str.NoNo_Player
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
mov dword [0x419cb0], eax
je 0x40218e
mov byte [0x419c9a], 1
cmp byte [0x419ca4], 0
je 0x40258c
mov edi, dword [0x419c94]
push 0x415f88
lea eax, [ebp - 0x9ec]
push str.update.xml
push eax
mov ecx, ebx
call fcn.0040354b
mov eax, dword [0x419c94]
test edi, edi
mov dword [ebp - 0x18], eax
jle 0x4026e9
mov esi, 0x417d93
mov dword [ebp - 0x1c], edi
and byte [ebp - 5], 0
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0
jle 0x4023ec
mov dword [ebp - 0xc], 0x4160d9
mov edi, str.Setup.ini
mov eax, dword [ebp - 0xc]
add eax, 0xffffffe2
push eax
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x4022ce
push dword [ebp - 0xc]
lea eax, [esi + 0x1e]
mov byte [ebp - 5], 1
push eax
call fcn.00406ec0
pop ecx
test eax, eax
pop ecx
jle 0x402578
mov eax, dword [0x419ca0]
test eax, eax
jne 0x402241
push 1
push 0x414394
push 0x414368
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x419ca0], eax
cmp eax, 1
jne 0x4022bd
cmp byte [0x419c9a], 0
je 0x40226f
push 0
push 0
push 0x10
push dword [0x419cb0]
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [0x419cb0], 0
and byte [0x419c9a], 0
push str.neo.cfg
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
je 0x4022e9
push 0x41435c
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
je 0x402317
push edi
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
je 0x402330
push str.neo.exe
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
je 0x40236c
jmp 0x4022ce
and byte [ebp + 0xb], 0
lea eax, [ebp - 0x2378]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x171
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jl 0x4021ef
jmp 0x4023e2
lea eax, [ebp - 0x9ec]
push str.neo.cfg
push eax
lea eax, [ebp - 0x4cb8]
push eax
mov byte [ebp + 0xb], 1
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x4cb8]
pop ecx
jmp 0x402358
lea eax, [esi - 0x115]
mov byte [0x419c9b], 1
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], eax
jmp 0x402578
lea eax, [ebp - 0x9ec]
push edi
push eax
lea eax, [ebp - 0x40b8]
push eax
mov byte [ebp + 0xb], 1
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x40b8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
jmp 0x402578
lea eax, [ebp - 0x9ec]
push esi
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x5ec]
pop ecx
push str..tmp
push eax
lea eax, [ebp - 0x3cb8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x3cb8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
test eax, eax
jne 0x402578
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x3cb8]
push eax
call fcn.00403785
pop ecx
mov byte [ebp + 0xb], 1
pop ecx
cmp byte [ebp - 5], 0
jne 0x402578
mov eax, dword [0x419ca0]
xor edi, edi
cmp eax, edi
jne 0x40240f
push 1
push 0x414394
push 0x414368
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x419ca0], eax
cmp eax, 1
jne 0x402578
cmp byte [0x419c9a], 0
je 0x40243e
push edi
push edi
push 0x10
push dword [0x419cb0]
call dword [sym.imp.USER32.dll_SendMessageA]
and byte [0x419c9a], 0
mov dword [0x419cb0], edi
mov edi, str.neo.cfg
push edi
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x402487
lea eax, [ebp - 0x9ec]
push edi
push eax
lea eax, [ebp - 0x2cb8]
push eax
mov byte [ebp + 0xb], 1
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x2cb8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
push 0x41435c
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x4024ac
lea eax, [esi - 0x115]
mov byte [0x419c9b], 1
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], eax
mov edi, str.Setup.ini
push edi
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x4024f5
lea eax, [ebp - 0x9ec]
push edi
push eax
lea eax, [ebp - 0x28b8]
push eax
mov byte [ebp + 0xb], 1
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x28b8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
push str.neo.exe
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x402578
lea eax, [ebp - 0x9ec]
push esi
push eax
lea eax, [ebp - 0x1638]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x1638]
pop ecx
push str..tmp
push eax
lea eax, [ebp - 0x1a38]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x1a38]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
test eax, eax
jne 0x402578
lea eax, [ebp - 0x1638]
push eax
lea eax, [ebp - 0x1a38]
push eax
call fcn.00403785
pop ecx
mov byte [ebp + 0xb], 1
pop ecx
add esi, 0x171
dec dword [ebp - 0x1c]
jne 0x4021d1
jmp 0x4026e9
cmp dword [0x419c94], edi
mov dword [ebp + 8], edi
jle 0x4026e5
mov esi, 0x417d93
mov edi, str.neo.cfg
push edi
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x4025e5
lea eax, [ebp - 0x9ec]
push edi
push eax
lea eax, [ebp - 0x28b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x28b8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
push 0x41435c
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x402606
lea eax, [esi - 0x115]
mov byte [0x419c9b], 1
mov dword [ebp - 0x14], eax
push str.Setup.ini
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x40264e
lea eax, [ebp - 0x9ec]
push str.Setup.ini
push eax
lea eax, [ebp - 0x2cb8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x2cb8]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
push str.neo.exe
push esi
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x4026cd
lea eax, [ebp - 0x9ec]
push esi
push eax
lea eax, [ebp - 0x1a38]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x1a38]
pop ecx
push str..tmp
push eax
lea eax, [ebp - 0x1638]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x1638]
pop ecx
push eax
lea eax, [esi - 0x115]
push eax
mov ecx, ebx
call fcn.004031ba
test eax, eax
jne 0x4026cd
lea eax, [ebp - 0x1a38]
push eax
lea eax, [ebp - 0x1638]
push eax
call fcn.00403785
pop ecx
pop ecx
inc dword [ebp + 8]
add esi, 0x171
mov eax, dword [ebp + 8]
cmp eax, dword [0x419c94]
jl 0x4025a5
mov byte [ebp + 0xb], 1
lea eax, [ebp - 0x9ec]
push str.NSUpdater.exe.t
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
pop ecx
lea eax, [ebp - 0x9ec]
pop ecx
push str.NSUpdater.exe.tmp
push eax
lea eax, [ebp - 0x48b8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
cmp byte [0x419c9b], 0
pop ecx
pop ecx
je 0x402764
lea eax, [ebp - 0x30b8]
mov ecx, ebx
push eax
push dword [ebp - 0x14]
call fcn.004031ba
test eax, eax
jne 0x402764
lea eax, [ebp - 0x48b8]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.00403785
pop ecx
mov byte [ebp + 0xb], 1
pop ecx
and dword [ebp - 0xc], 0
push 1
lea eax, [ebp - 0x10f8]
push dword [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00403143
test eax, eax
jne 0x40278d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x402768
jmp 0x40313a
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov esi, str.NoNo_Player
push esi
push esi
call edi
test eax, eax
jne 0x4027b5
inc dword [ebp - 0xc]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xc], 2
jge 0x4027b5
push esi
push esi
jmp 0x40279a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x10f8]
push dword [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00403143
cmp byte [ebp + 0xb], 0
je 0x4027fd
lea eax, [ebp - 0x1e38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1e38]
push eax
lea eax, [ebp - 0x2378]
push eax
call fcn.00406440
pop ecx
pop ecx
jmp 0x40280a
lea eax, [ebp - 0x2378]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
lea eax, [ebp - 0x9ec]
push eax
call fcn.00401ba3
pop ecx
call fcn.00401cef
cmp dword [ebp - 4], edi
je 0x40282c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
mov dword [ebp - 0x28], edi
pop eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
push dword [0x415f78]
call esi
cmp eax, 0x102
jne 0x402a88
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x34]
cmp ecx, 0x5265c00
jb 0x402879
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x34], eax
xor esi, esi
cmp dword [ebp - 0x2c], esi
je 0x4029aa
lea eax, [ebp - 0x34b8]
mov ecx, ebx
push eax
push 0x419b74
mov dword [ebp - 0x2c], esi
call fcn.004031ba
cmp byte [0x414040], 0
je 0x40283e
push 0x417c60
lea eax, [ebp - 0x9ec]
push str.update.tmp
push eax
mov ecx, ebx
call fcn.0040354b
lea eax, [ebp - 0x24b8]
push eax
lea eax, [ebp - 0x1e38]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x402998
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [0x419c94]
push 0x415f88
lea eax, [ebp - 0x9ec]
push str.update.xml
push eax
mov ecx, ebx
call fcn.0040354b
mov eax, dword [0x419c94]
cmp edi, esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], esi
jle 0x4029aa
mov dword [ebp - 0xc], 0x417db1
mov esi, 0x171
and byte [ebp + 0x13], 0
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x38], 0
jle 0x402982
mov dword [ebp + 8], 0x4160d9
mov eax, dword [ebp + 8]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0xc]
add eax, 0xffffffe2
push eax
call fcn.0040e3a0
pop ecx
test eax, eax
pop ecx
jne 0x40295f
push dword [ebp + 8]
mov byte [ebp + 0x13], 1
push dword [ebp - 0xc]
call fcn.00406ec0
pop ecx
test eax, eax
pop ecx
jg 0x402982
inc dword [ebp - 0x30]
add dword [ebp + 8], esi
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
jl 0x402931
cmp byte [ebp + 0x13], 0
je 0x402982
inc dword [ebp - 0x1c]
add dword [ebp - 0xc], esi
cmp dword [ebp - 0x1c], edi
jl 0x40291c
xor esi, esi
jmp 0x4029aa
push 0
push 0x414394
push 0x414304
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40297e
push esi
push 0x414394
push 0x414304
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004012c3
test eax, eax
push 0x415f58
push 0x415f60
je 0x4029c4
call fcn.004010db
jmp 0x4029c9
call fcn.004011db
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x40283e
cmp eax, 0x19
jg 0x4029f2
inc dword [0x419cc0]
cmp dword [0x419cc0], 0x12c
jl 0x4029f8
mov dword [ebp - 0x28], 1
mov dword [0x419cc0], esi
push 2
push 0x419cbc
push 0x419cb8
call section..text
add esp, 0xc
cmp eax, 0xffffffff
je 0x40283e
inc dword [0x419cc4]
cmp eax, 0x7800
jg 0x402a3d
cmp dword [0x419cc4], 0x1e
jl 0x402a43
inc dword [ebp - 0x14]
mov dword [ebp - 0x10], 1
mov dword [0x419cc4], esi
jmp 0x402a43
mov dword [0x419cc0], esi
cmp dword [ebp - 0x28], 1
jne 0x402a67
cmp dword [ebp - 0x10], 1
jne 0x402a5f
push 3
call fcn.00401309
pop ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], esi
jmp 0x402a77
mov dword [ebp - 0x28], esi
jmp 0x40283e
cmp dword [ebp - 0x14], 5
jl 0x40283e
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [0x419cc0], esi
mov dword [0x419cc4], esi
jmp 0x40283e
push 0xffffffffffffffff
push dword [ebp - 4]
call esi
push dword [0x415f78]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x415f7c]
call esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x5ec]
push str._sNT_
push eax
call fcn.00406920
lea eax, [ebp - 0x44]
push 0xa
push eax
push dword [0x415f80]
call fcn.0040f7f3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push str._.log
push eax
call fcn.004067c0
add esp, 0x28
lea eax, [ebp - 0x1238]
push eax
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402c57
mov esi, str.BaseFileXXXXXX
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x54]
push eax
movsb byte es:[edi], byte [esi]
call fcn.00406ded
push 0xf
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00406470
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0xcf8]
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
lea eax, [ebp - 0xcf8]
push 0x180
push eax
call fcn.00406dd7
push eax
call fcn.00405dbf
lea eax, [ebp - 0xcf8]
push 0x4143f4
push eax
call fcn.00406403
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x402ffa
push esi
push 0x11
push 1
push 0x4142d0
call fcn.00406c9e
push esi
call fcn.00406185
push 0xc
mov esi, str.http:__www.neotasks.com_userexceptions_uplog.jsp
pop ecx
lea edi, [ebp - 0xbf4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x34
xor eax, eax
pop ecx
lea edi, [ebp - 0xbc3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xbf4]
push 0x4140c4
push eax
call fcn.004067c0
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xbf4]
push eax
call fcn.004067c0
mov ecx, dword [0x415f6c]
add esp, 0x24
test ecx, ecx
je 0x402c09
lea eax, [ebp - 0xbf4]
push eax
call fcn.00404ab0
test eax, eax
jne 0x402c09
mov ecx, dword [0x415f6c]
call fcn.00404d50
lea eax, [ebp - 0xcf8]
push eax
call fcn.00406416
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x419cac]
cmp eax, 0x493e0
jb 0x402ffa
push 1
lea eax, [ebp - 0x10f8]
push 0
push eax
mov ecx, ebx
call fcn.00403143
cmp dword [ebp - 4], 0
je 0x40283e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40283e
push dword [ebp - 0x20]
call fcn.00406b20
inc eax
push eax
lea eax, [ebp - 0x5ec]
push dword [ebp - 0x20]
push eax
call fcn.00406ba0
lea eax, [ebp - 0x120c]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push eax
call fcn.004012d3
add esp, 0x1c
cmp eax, 0x500000
jle 0x402d38
and byte [ebp - 0xaf0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0xaef]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str..log
lea eax, [ebp - 0x5ec]
push edi
push eax
call fcn.004068a0
lea ecx, [ebp - 0x5ec]
sub eax, ecx
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0xaf0]
push eax
call fcn.00406470
lea eax, [ebp - 0xaf0]
push 0x414108
push eax
call fcn.004067c0
lea eax, [ebp - 0xaf0]
push edi
push eax
call fcn.004067c0
lea eax, [ebp - 0xaf0]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.00406440
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0xaf0]
push 0x414100
push eax
call fcn.00406403
and dword [ebp - 0x18], 0
pop ecx
pop ecx
mov edi, eax
jmp 0x402dae
test eax, eax
jg 0x402d92
lea eax, [ebp - 0x5ec]
push eax
call fcn.00406416
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x419cac]
cmp eax, 0x493e0
jb 0x402ffa
push 1
lea eax, [ebp - 0x10f8]
pop esi
mov ecx, ebx
push esi
push 0
push eax
call fcn.00403143
cmp dword [ebp - 4], 0
je 0x402d8a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebp - 0x18], esi
jmp 0x40283e
lea eax, [ebp - 0x5ec]
push 0x414100
push eax
call fcn.00406403
pop ecx
mov edi, eax
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x402d50
push 2
push 0xffffffffffffffe0
push edi
call fcn.00406319
push edi
push 0x20
lea eax, [ebp - 0xe8]
push 1
push eax
call fcn.00406202
push edi
call fcn.00406185
lea eax, [ebp - 0xe8]
push str.normally
push eax
call fcn.004068a0
add esp, 0x28
test eax, eax
jne 0x402ee5
push 0xc
mov esi, str.http:__www.neotasks.com_userexceptions_uplog.jsp
pop ecx
lea edi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xc
lea edi, [ebp - 0x97]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc8]
push 0x4140c4
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004067c0
mov ecx, dword [0x415f6c]
add esp, 0x10
test ecx, ecx
je 0x402c16
lea eax, [ebp - 0xc8]
push eax
call fcn.00404ab0
test eax, eax
jne 0x402c16
mov ecx, dword [0x415f6c]
call fcn.00404d50
test eax, eax
jne 0x402c16
and byte [ebp - 0x1ec], al
push 0x40
pop ecx
lea edi, [ebp - 0x1eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str..log
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004068a0
lea ecx, [ebp - 0x5ec]
sub eax, ecx
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.00406470
lea eax, [ebp - 0x1ec]
push 0x414108
push eax
call fcn.004067c0
lea eax, [ebp - 0x1ec]
push esi
push eax
call fcn.004067c0
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.00406440
add esp, 0x2c
jmp 0x402c16
cmp dword [ebp - 0x18], 0
je 0x402ffa
cmp dword [ebp - 4], 0
je 0x402f07
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa
mov esi, str.http:__www.neotasks.com_userlogs_uplog.jsp
pop ecx
lea edi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x9d]
rep stosd dword es:[edi], eax
and dword [ebp - 0x24], 0
push 0x4140c4
stosb byte es:[edi], al
lea eax, [ebp - 0xc8]
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004067c0
mov ecx, dword [0x415f6c]
add esp, 0x10
test ecx, ecx
je 0x402ffa
lea eax, [ebp - 0xc8]
push eax
call fcn.00404ab0
test eax, eax
jne 0x402ffa
mov ecx, dword [0x415f6c]
call fcn.00404d50
test eax, eax
jne 0x402ffa
and byte [ebp - 0x1ec], al
push 0x40
pop ecx
lea edi, [ebp - 0x1eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str..log
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004068a0
lea ecx, [ebp - 0x5ec]
sub eax, ecx
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.00406470
lea eax, [ebp - 0x1ec]
push 0x414108
push eax
call fcn.004067c0
lea eax, [ebp - 0x1ec]
push esi
push eax
call fcn.004067c0
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.00406440
add esp, 0x2c
call fcn.00401759
mov ecx, dword [0x415f6c]
xor ebx, ebx
cmp ecx, ebx
je 0x403011
mov eax, dword [ecx]
push 1
call dword [eax]
cmp byte [0x419c9b], 0
je 0x403114
mov esi, str.NSUpdater.exe.tmp
push esi
call fcn.00401abd
cmp eax, 1
pop ecx
jne 0x403114
push esi
call fcn.004012d3
test eax, eax
pop ecx
je 0x403114
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067b0
mov esi, str.NSUpdate.bat
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push 0x4143f4
push eax
call fcn.00406403
add esp, 0x18
mov edi, eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push 0x4143f0
push eax
call fcn.004067b0
pop ecx
pop ecx
push eax
call fcn.004067c0
lea eax, [ebp - 0x5ec]
push edi
push eax
call fcn.00407064
push edi
push str._n_copy_NSUpdater.exe.tmp_NSUpdater.exe_n
call fcn.00407064
push edi
push str.del_NSUpdater.exe.tmp_n
call fcn.00407064
push edi
push str.del_NSUpdate.bat_n
call fcn.00407064
push edi
call fcn.00406185
add esp, 0x2c
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.004067b0
lea eax, [ebp - 0x5ec]
push esi
push eax
call fcn.004067c0
add esp, 0x10
lea eax, [ebp - 0x5ec]
push ebx
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 0x24], 1
jne 0x403131
cmp dword [ebp - 4], ebx
je 0x403131
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call fcn.00405d30
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10