Function at 0x4a9220
Capabilities:
Access peb ldr_data
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x52a9e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x400
push ebx
push ebp
push esi
mov esi, dword [esp + 0x41c]
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
lea edi, [esi + 0xc]
mov dword [esp + 0x14], ecx
lea eax, [edi + 8]
push eax
call ebp
mov edx, dword [edi]
mov ebx, dword [esi + 0x21c]
mov ecx, edi
call dword [edx + 0x14]
mov eax, ebx
xor ecx, ecx
shr eax, 0x10
cmp eax, 1
sete cl
and ebx, 0xfff
xor edx, edx
cmp ebx, 0x16
mov dword [esp + 0x3c], ecx
sete dl
xor ecx, ecx
mov dword [esp + 0x30], edx
cmp eax, 8
lea edx, [edi + 8]
sete cl
mov dword [esp + 0x2c], ebx
push edx
mov dword [esp + 0x24], ecx
mov ebx, 0x10001
call ebp
mov eax, dword [esi + 0xac]
mov edx, dword [edi]
mov ecx, edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x418], 0xffffffff
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c83c0
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c7fd0
test eax, eax
jne 0x4a92fa
mov eax, dword [esp + 0x424]
push 1
push 2
push 0x1420
mov ecx, esi
mov dword [eax], 0x10004
call fcn.004d2030
jmp 0x4aa7c2
lea ecx, [edi + 8]
push ecx
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4a9326
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4a9326
cmp eax, 0x10002
mov dword [esp + 0x10], 0
jne 0x4a932e
mov dword [esp + 0x10], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a937e
mov eax, dword [esp + 0x424]
push 1
mov ecx, esi
push 1
mov dword [eax], 0x10002
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4a935f
push 0x154c
jmp 0x4a9364
push 0x13fd
call fcn.004d2030
push 1
push 0
push 0x56e1f4
mov ecx, esi
call fcn.004d2190
jmp 0x4aa7c2
lea ecx, [edi + 8]
push ecx
call ebp
mov eax, dword [esi + 0x3a4]
mov ecx, edi
or al, 8
mov dword [esi + 0x3a4], eax
mov edx, dword [edi]
call dword [edx + 0x14]
push 0
mov ecx, esi
call fcn.004d3bd0
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4a93ce
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4a93ce
cmp eax, 0x10002
mov dword [esp + 0x10], 0
jne 0x4a93d6
mov dword [esp + 0x10], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4a9400
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a9400
mov ecx, dword [esp + 0x14]
push 0
push esi
call fcn.004c9bf0
mov ebx, eax
jmp 0x4a9c60
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4a942c
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4a942c
cmp eax, 0x10002
mov dword [esp + 0x10], 0
jne 0x4a9434
mov dword [esp + 0x10], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4a9c60
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4a9c60
mov eax, dword [esp + 0x2c]
dec eax
cmp eax, 0x1b
ja case.0x4a9461.10
jmp dword [eax*4 + 0x4aa7e0]
mov ecx, dword [esp + 0x424]
mov dword [ecx], 0x10003
jmp 0x4aa7c2
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push esi
mov dword [esp + 0x20], 0
call fcn.004ae770
mov ebx, eax
and eax, 0xffff0000
cmp eax, 0x10000
jne 0x4a9c60
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004e2710
mov edx, dword [eax]
mov eax, edi
mov dword [esp + 0x34], eax
add eax, 8
push eax
mov dword [esp + 0x41c], 1
mov dword [esp + 0x30], edx
call ebp
mov eax, dword [esp + 0x2c]
lea ecx, [esi + 0x210]
push eax
mov byte [esp + 0x41c], 2
call fcn.00507ec3
mov ecx, edi
mov byte [esp + 0x418], 1
mov edx, dword [ecx]
call dword [edx + 0x14]
lea ecx, [esp + 0x58]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
push 0
push 0
push 4
mov ecx, esi
call fcn.004d1c70
jmp 0x4a9c60
lea ecx, [esp + 0x88]
call fcn.0040d100
lea eax, [edi + 8]
mov dword [esp + 0x418], 3
push eax
mov dword [esp + 0x4c], edi
call ebp
lea ecx, [esi + 0x30]
push 0xffffffffffffffff
mov byte [esp + 0x41c], 4
call fcn.00405390
mov edx, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 3
call dword [edx + 0x14]
lea eax, [edi + 8]
push eax
call ebp
or eax, 0xffffffff
mov ecx, edi
mov dword [esi + 0x250], eax
mov dword [esi + 0x254], eax
mov edx, dword [edi]
call dword [edx + 0x14]
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x21c]
and eax, 0xfff
cmp eax, 0x1a
je 0x4a9598
cmp eax, 0x1b
jne 0x4a95a9
mov edx, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 3
call dword [edx + 0x14]
jmp 0x4a95c2
mov dword [esi + 0x274], 0
mov eax, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 3
call dword [eax + 0x14]
push 1
lea ecx, [esp + 0x8c]
push 1
push ecx
mov ecx, dword [esp + 0x20]
push esi
call fcn.004b9f30
mov ebx, eax
mov edx, ebx
and edx, 0xffff0000
cmp edx, 0x10000
jne 0x4a96d4
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, edi
mov dword [esp + 0x34], eax
add eax, 8
push eax
call ebp
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x418], 6
push ecx
lea ecx, [esi + 0x30]
call fcn.00405390
mov ecx, edi
mov byte [esp + 0x418], 3
mov edx, dword [ecx]
call dword [edx + 0x14]
push ecx
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00507aaf
call fcn.00499f70
add esp, 4
lea ecx, [edi + 8]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
push ecx
call ebp
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x250], edx
mov dword [esi + 0x254], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
lea ecx, [esp + 0x88]
call fcn.0040d760
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x8c]
call fcn.0040d740
mov eax, edi
mov dword [esp + 0x34], eax
add eax, 8
push eax
call ebp
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x60]
push ecx
mov byte [esp + 0x41c], 7
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.00417da0
lea ecx, [esi + 0x30]
call fcn.00405490
mov ecx, edi
mov byte [esp + 0x418], 3
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x4a96e1
cmp ebx, 0x30007
jne 0x4a96e1
mov ebx, 0x10001
lea ecx, [esp + 0x88]
mov dword [esp + 0x418], 0xffffffff
call fcn.0040d280
jmp 0x4a9c60
lea ecx, [esp + 0x60]
call fcn.00421ac0
lea ecx, [esp + 0x20]
mov dword [esp + 0x418], 8
push ecx
mov ecx, esi
call fcn.004a01d0
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x40]
push edx
push eax
mov byte [esp + 0x420], 9
call fcn.00424560
mov eax, dword [eax]
mov byte [esp + 0x420], 0xa
push eax
call fcn.00422ab0
add esp, 0xc
lea ecx, [esp + 0x40]
mov byte [esp + 0x418], 9
call fcn.00507d3a
mov ecx, dword [esp + 0x20]
push 0x8302
push ecx
lea ecx, [esp + 0x68]
call fcn.00421b60
test eax, eax
je 0x4a97c7
lea ecx, [esp + 0xcc]
call fcn.00457b30
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0xd0]
push 1
lea edx, [esp + 0x68]
push eax
push esi
mov byte [esp + 0x428], 0xb
mov dword [esp + 0x15c], edx
call fcn.004af370
lea ecx, [esp + 0xcc]
mov ebx, eax
mov dword [esp + 0x14c], 0
mov byte [esp + 0x418], 9
call fcn.00457b70
jmp 0x4a9816
mov ecx, dword [0x569c90]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push edx
push 0x1456
push eax
mov byte [esp + 0x424], 0xc
call fcn.005054ef
mov ecx, dword [esp + 0x30]
add esp, 0xc
push 1
push 2
push ecx
mov ecx, esi
call fcn.004d2190
lea ecx, [esp + 0x24]
mov ebx, 0x30003
mov byte [esp + 0x418], 9
call fcn.00507d3a
lea ecx, [esp + 0x20]
mov byte [esp + 0x418], 8
call fcn.00507d3a
lea ecx, [esp + 0x60]
mov dword [esp + 0x418], 0xffffffff
call fcn.00421b10
lea ecx, [esp + 0xcc]
call fcn.00457b30
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xcc]
push edx
push esi
mov dword [esp + 0x420], 0xd
call fcn.004cad90
test eax, eax
jne 0x4a9971
lea ecx, [esp + 0x60]
call fcn.00421ac0
mov ecx, 0x571fb8
mov byte [esp + 0x418], 0xe
call fcn.00481cb0
test al, 2
je 0x4a993d
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.004a5480
mov ecx, esi
mov byte [esp + 0x41c], 0xf
call fcn.004aa880
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push ecx
mov ecx, esi
call fcn.004a0920
lea edx, [esp + 0x2c]
mov byte [esp + 0x424], 0xe
push edx
call fcn.00499710
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x2c]
mov bl, 0x10
push eax
push ecx
mov byte [esp + 0x430], bl
call fcn.00424560
mov eax, dword [eax]
mov byte [esp + 0x430], 0x11
push eax
call fcn.00422ab0
add esp, 0x1c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x418], bl
call fcn.00507d3a
mov edx, dword [esp + 0x20]
push 0x8302
push edx
lea ecx, [esp + 0x68]
call fcn.00421b60
test eax, eax
je 0x4a992c
lea eax, [esp + 0x60]
mov dword [esp + 0x14c], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x418], 0xe
call fcn.00507d3a
push 1
lea ecx, [esp + 0xd0]
push 1
push ecx
mov ecx, dword [esp + 0x20]
push esi
call fcn.004af370
lea ecx, [esp + 0x60]
mov ebx, eax
mov dword [esp + 0x14c], 0
mov byte [esp + 0x418], 0xd
call fcn.00421b10
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a9b25
mov edx, ebx
and edx, 0xffff0000
cmp edx, 0x10000
jne 0x4a9b25
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4a99bd
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4a99bd
cmp eax, 0x10002
mov dword [esp + 0x10], 0
jne 0x4a99c5
mov dword [esp + 0x10], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4a9b25
lea ecx, [esp + 0xcc]
call fcn.0040cb60
cmp eax, 0x3e8
jge 0x4a9b25
lea ecx, [esp + 0x150]
call fcn.004068f0
lea eax, [esp + 0x150]
mov ecx, esi
push eax
mov byte [esp + 0x41c], 0x12
call fcn.004d19b0
push 0x1000
lea ecx, [esp + 0x64]
call fcn.00511eb1
push 0
push 0x1000
lea ecx, [esp + 0x68]
push 0
push ecx
lea ecx, [esp + 0x98]
mov byte [esp + 0x428], 0x13
call fcn.0050ed7b
lea edx, [esp + 0x88]
lea ecx, [esp + 0x150]
push edx
mov byte [esp + 0x41c], 0x14
call fcn.00406cb0
lea eax, [esp + 0x88]
lea ecx, [esp + 0xcc]
push eax
call fcn.0040cf20
lea ecx, [esp + 0x88]
call fcn.0050eedf
lea ecx, [esp + 0x60]
call fcn.0050cb3a
lea ecx, [esp + 0x60]
mov dword [esp + 0x2c], eax
call fcn.00511f64
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x50], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x48], 0x357
test eax, eax
mov dword [esp + 0x4c], ecx
je 0x4a9adb
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a9adb
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ecx
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a9aec
push eax
call fcn.004f2cd7
add esp, 4
lea ecx, [esp + 0x88]
mov byte [esp + 0x418], 0x13
call fcn.0050ee57
lea ecx, [esp + 0x60]
mov byte [esp + 0x418], 0x12
call fcn.00511f76
lea ecx, [esp + 0x150]
mov byte [esp + 0x418], 0xd
call fcn.00406a90
lea ecx, [esp + 0xcc]
mov dword [esp + 0x418], 0xffffffff
call fcn.00457b70
jmp 0x4a9c60
lea ecx, [edi + 8]
push ecx
call ebp
xor eax, eax
mov ecx, edi
mov dword [esi + 0x278], eax
mov dword [esi + 0x27c], eax
mov dword [esi + 0x280], eax
mov dword [esi + 0x284], eax
mov dword [esi + 0x288], eax
mov edx, dword [edi]
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
push esi
call fcn.004bf580
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b3200
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004bfe40
mov ebx, eax
and eax, 0xffff0000
cmp eax, 0x30000
jne 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c57b0
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b49c0
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b4ea0
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c5830
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b0470
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c5e50
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004c6260
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004cbfb0
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004cce90
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b3c30
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b3a30
mov ebx, eax
jmp 0x4a9c60
mov ecx, dword [esp + 0x14]
push esi
call fcn.004b3630
mov ebx, eax
jmp 0x4a9c60
mov ebx, 0x30006
mov ecx, esi
call fcn.004d46e0
test eax, eax
je 0x4a9e3d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.004d4700
mov edx, dword [eax]
mov ecx, dword [edx - 8]
test ecx, ecx
lea ecx, [esp + 0x1c]
setne byte [esp + 0x3b]
call fcn.00507d3a
mov al, byte [esp + 0x3b]
test al, al
je 0x4a9e3d
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.004d4700
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x1c]
call fcn.00507d3a
push 0x56e1f4
lea ecx, [esp + 0x14]
call fcn.00507da8
lea ecx, [esp + 0x10]
mov dword [esp + 0x418], 0x15
push ecx
mov ecx, esi
call fcn.004d46f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
mov edx, ebx
and edx, 0xffff0000
cmp edx, 0x10000
je 0x4a9e3d
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.004070f0
mov ecx, dword [eax]
lea edx, [edi + 8]
push edx
mov dword [esp + 0x41c], 0x16
mov dword [esp + 0x20], ecx
mov dword [esp + 0x5c], edi
call ebp
mov eax, dword [esp + 0x1c]
lea ecx, [esi + 0x20c]
push eax
mov byte [esp + 0x41c], 0x17
call fcn.00507ec3
mov edx, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 0x16
call dword [edx + 0x14]
lea ecx, [esp + 0x40]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
push 0x56e1f4
lea ecx, [esp + 0x14]
call fcn.00507da8
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov dword [esp + 0x41c], 0x18
call fcn.004d4730
lea ecx, [esp + 0x10]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
call fcn.004d4750
mov edx, dword [eax]
lea eax, [edi + 8]
push eax
mov dword [esp + 0x41c], 0x19
mov dword [esp + 0x20], edx
mov dword [esp + 0x5c], edi
call ebp
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x418], 0x1a
push ecx
lea ecx, [esi + 0x210]
call fcn.00507ec3
mov edx, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 0x19
call dword [edx + 0x14]
lea ecx, [esp + 0x40]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
push 0x56e1f4
lea ecx, [esp + 0x14]
call fcn.00507da8
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov dword [esp + 0x41c], 0x1b
call fcn.004d4740
lea ecx, [esp + 0x10]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
mov ecx, dword [0x569c90]
mov dword [esp + 0x44], ecx
mov edx, ebx
xor eax, eax
and edx, 0x1000
mov dword [esp + 0x418], 0x1c
cmp edx, 0x1000
mov dword [esp + 0x18], 0
sete al
and bh, 0xef
xor edx, edx
mov ecx, ebx
and ecx, 0x2000
cmp ecx, 0x2000
sete dl
and bh, 0xdf
mov dword [esp + 0x2c], edx
test eax, eax
jne 0x4a9e9a
cmp ebx, 0x30008
mov dword [esp + 0x20], eax
jne 0x4a9ea2
mov dword [esp + 0x20], 1
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4a9ed8
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4a9ed8
cmp eax, 0x10002
mov dword [esp + 0x10], 0
jne 0x4a9ee0
mov dword [esp + 0x10], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4a9f2e
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x10000
jne 0x4aa096
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4a9f2e
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x18]
push 0
push esi
call fcn.004bae10
test eax, eax
je 0x4a9f2e
mov edx, dword [esp + 0x44]
push 1
push 1
push edx
mov ecx, esi
call fcn.004d2190
lea eax, [edi + 8]
push eax
call ebp
mov ecx, dword [esi + 0x37c]
mov edx, dword [edi]
mov dword [esp + 0x1c], ecx
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, 0x572a70
push eax
call fcn.004e4260
test eax, eax
mov dword [esp + 0x10], eax
je 0x4a9f7c
mov ecx, eax
call fcn.004e03c0
test eax, eax
je 0x4a9f74
mov ecx, dword [esp + 0x10]
call fcn.004e0360
test eax, eax
je 0x4a9f7c
mov dword [esp + 0x24], 1
lea ecx, [edi + 8]
push ecx
call ebp
mov edx, dword [esi + 0x380]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x1c], edx
call dword [eax + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, 0x572a70
call fcn.004e4260
test eax, eax
mov dword [esp + 0x10], eax
je 0x4a9fca
mov ecx, eax
call fcn.004e03c0
test eax, eax
je 0x4a9fc2
mov ecx, dword [esp + 0x10]
call fcn.004e0360
test eax, eax
je 0x4a9fca
mov dword [esp + 0x28], 1
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
test eax, eax
je 0x4aa006
lea eax, [edi + 8]
push eax
call ebp
mov ecx, dword [esi + 0x308]
mov edx, dword [edi]
mov dword [esp + 0x1c], ecx
mov ecx, edi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push 0
push eax
mov edx, dword [ecx + 0xc]
push 0x60a
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
call fcn.00402250
mov ecx, dword [esp + 0x428]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4aa0c0
lea edx, [edi + 8]
push edx
call ebp
mov eax, dword [esi + 0x384]
mov edx, dword [edi]
mov ecx, edi
mov dword [esp + 0x1c], eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x4aa1f3
cmp ebx, 0x30008
je 0x4aa05f
cmp ebx, 0x30002
je 0x4aa05f
cmp ebx, 0x30005
jne 0x4aa067
mov dword [esp + 0x18], 1
cmp ebx, 0x30001
je 0x4aa07b
cmp ebx, 0x30007
jne 0x4aa1eb
mov eax, dword [esi + 0x258]
test eax, eax
je 0x4aa1eb
mov dword [esp + 0x18], 1
jmp 0x4aa206
cmp ebx, 0x30003
jne 0x4a9f2e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a9f2e
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
jmp 0x4a9fca
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4aa118
cmp ebx, 0x30001
je 0x4aa0dc
cmp ebx, 0x30005
jne 0x4aa1f3
lea eax, [edi + 8]
push eax
call ebp
mov ecx, dword [esi + 0xac]
mov edx, dword [edi]
mov dword [esp + 0x1c], ecx
mov ecx, edi
mov byte [esp + 0x418], 0x1c
call dword [edx + 0x14]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
je 0x4aa1f3
mov dword [esp + 0x18], 0xfffffffe
jmp 0x4aa206
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4aa16c
lea ecx, [edi + 8]
push ecx
call ebp
mov edx, dword [esi + 0x384]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x30], edx
call dword [eax + 0x14]
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x4aa1f3
cmp ebx, 0x30001
je 0x4aa15f
cmp ebx, 0x30002
je 0x4aa15f
cmp ebx, 0x30005
jne 0x4aa1f3
mov dword [esp + 0x18], 1
jmp 0x4aa206
cmp ebx, 0x30001
je 0x4aa17c
cmp ebx, 0x30005
jne 0x4aa184
mov dword [esp + 0x18], 0xffffffff
cmp ebx, 0x30002
jne 0x4aa1eb
mov eax, edi
mov dword [esp + 0x30], eax
add eax, 8
push eax
call ebp
lea ecx, [esi + 0x30]
mov byte [esp + 0x418], 0x1e
call fcn.00405370
mov ecx, edi
mov dword [esp + 0x54], eax
mov byte [esp + 0x418], 0x1c
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp dword [esp + 0x54], 3
jne 0x4aa1eb
lea eax, [edi + 8]
push eax
call ebp
mov ecx, dword [esi + 0x384]
mov edx, dword [edi]
mov dword [esp + 0x30], ecx
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x4aa1eb
mov dword [esp + 0x18], 1
jmp 0x4aa206
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4aa206
mov ecx, esi
call fcn.004d3cd0
test eax, eax
mov dword [esp + 0x10], 1
jne 0x4aa20e
mov dword [esp + 0x10], 0
lea eax, [edi + 8]
push eax
call ebp
mov eax, dword [esi + 0x394]
test eax, eax
jne 0x4aa23a
mov eax, dword [esi + 0x248]
cmp eax, 0x20003
je 0x4aa23a
cmp eax, 0x10002
mov dword [esp + 0x34], 0
jne 0x4aa242
mov dword [esp + 0x34], 1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x424]
je 0x4aa297
mov dword [eax], 0x10002
cmp ebx, 0x20001
jne 0x4aa35a
push 1
push 2
push 0x146e
mov ecx, esi
call fcn.004d2030
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x424]
neg eax
sbb eax, eax
and al, 0xfd
add eax, 0x10009
mov dword [edx], eax
jmp 0x4aa3db
cmp dword [eax], 0x10002
je 0x4aa25e
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4aa31f
cmp ecx, 0xffffffff
mov dword [eax], 0x10001
jne 0x4aa2c0
mov ecx, 0x571fb8
call fcn.00480af0
mov ebx, eax
jmp 0x4aa2eb
lea ecx, [edi + 8]
push ecx
call ebp
mov edx, dword [edi]
mov ebx, dword [esi + 0xc0]
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffe
jne 0x4aa2e0
xor ebx, ebx
jmp 0x4aa2eb
test eax, eax
jle 0x4aa2eb
mov ecx, esi
call fcn.004d3b40
push ebx
mov ecx, esi
call fcn.004d3bd0
push ebx
lea eax, [esp + 0x48]
push 0xe208
push eax
call fcn.005054ef
mov ecx, dword [esp + 0x50]
add esp, 0xc
push 1
push 1
push ecx
mov ecx, esi
call fcn.004d2190
mov eax, dword [esp + 0x424]
jmp 0x4aa32d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4aa32d
mov dword [eax], 0x10006
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4aa340
mov dword [eax], 0x10008
jmp 0x4aa3db
cmp dword [eax], 0x10003
jne 0x4aa3db
push 3
mov ecx, esi
call fcn.004d3bd0
jmp 0x4aa3db
lea eax, [edi + 8]
push eax
call ebp
mov edx, dword [edi]
mov ebx, dword [esi + 0x37c]
mov ecx, edi
call dword [edx + 0x14]
push ebx
mov ecx, 0x572a70
call fcn.004e4260
mov ebx, eax
test ebx, ebx
je 0x4aa39e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x80]
test eax, eax
je 0x4aa39e
push 1
push 1
push 0x13fd
mov ecx, esi
call fcn.004d2030
jmp 0x4aa3cd
mov eax, dword [esp + 0x3c]
push 1
test eax, eax
mov ecx, esi
push 1
je 0x4aa3b3
push 0x154c
jmp 0x4aa3b8
push 0x13fd
call fcn.004d2030
push 1
push 0
push 0x56e1f4
mov ecx, esi
call fcn.004d2190
test ebx, ebx
je 0x4aa3db
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x84]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4aa416
mov eax, dword [esp + 0x424]
mov eax, dword [eax]
cmp eax, 0x10001
jne 0x4aa401
mov ebx, dword [esp + 0x14]
push esi
mov ecx, ebx
call fcn.004a6c40
jmp 0x4aa437
cmp eax, 0x10004
jne 0x4aa433
mov ebx, dword [esp + 0x14]
push esi
mov ecx, ebx
call fcn.004a6800
jmp 0x4aa437
mov ecx, dword [esp + 0x424]
cmp dword [ecx], 0x10001
jne 0x4aa433
mov ebx, dword [esp + 0x14]
push esi
mov ecx, ebx
call fcn.004a6c40
jmp 0x4aa437
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
push 1
push esi
push edx
mov ecx, ebx
call fcn.004aa8b0
mov eax, dword [esp + 0x28]
push 0
push esi
push eax
mov ecx, ebx
call fcn.004aa8b0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4aa469
push 1
push esi
mov ecx, ebx
call fcn.004c54f0
jmp 0x4aa47b
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4aa47b
push 1
push esi
mov ecx, ebx
call fcn.004c5650
mov eax, dword [esp + 0x28]
push 0
test eax, eax
mov ecx, ebx
push esi
je 0x4aa48f
call fcn.004c54f0
jmp 0x4aa494
call fcn.004c5650
lea ecx, [edi + 8]
push ecx
call ebp
mov edx, dword [esi + 0x394]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x30], edx
call dword [eax + 0x14]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4aa4c8
mov ecx, 0x571fb8
call fcn.004829d0
test eax, eax
je 0x4aa4c8
mov ecx, esi
call fcn.004d23a0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4aa7ae
mov ecx, dword [esp + 0x424]
cmp dword [ecx], 0x10003
jne 0x4aa4fa
mov ecx, 0x571fb8
call fcn.00482a90
test eax, eax
je 0x4aa4fa
mov ecx, esi
call fcn.004d23a0
jmp 0x4aa535
lea edx, [edi + 8]
mov dword [esp + 0x48], edi
push edx
call ebp
lea ecx, [esi + 0x340]
mov byte [esp + 0x418], 0x1f
call fcn.00458890
mov ebx, eax
mov eax, dword [edi]
mov ecx, edi
mov byte [esp + 0x418], 0x1c
call dword [eax + 0x14]
push ebx
call fcn.00459fb0
mov ebx, dword [esp + 0x18]
add esp, 4
lea ecx, [edi + 8]
push ecx
call ebp
mov edx, dword [esi + 0x394]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x30], edx
call dword [eax + 0x14]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4aa7ae
mov ecx, dword [esp + 0x424]
mov eax, dword [ecx]
cmp eax, 0x10003
jne 0x4aa773
lea edx, [edi + 8]
push edx
call ebp
mov eax, dword [edi]
mov ebp, dword [esi + 0x21c]
mov ecx, edi
call dword [eax + 0x14]
mov eax, ebp
sub eax, 0x20002
je 0x4aa5a2
dec eax
je 0x4aa59b
sub eax, 0x13
jne 0x4aa7ae
push 0x1f
jmp 0x4aa7a7
push 0x15
jmp 0x4aa7a7
push 0xb
mov ecx, ebx
call fcn.004c83a0
mov eax, dword [0x57250c]
test eax, eax
je 0x4aa7ae
mov ecx, dword [0x569c90]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x18]
mov ecx, 0x571fb8
push edx
mov byte [esp + 0x41c], 0x20
call fcn.004aa850
mov bl, 0x21
lea ecx, [esp + 0x18]
mov byte [esp + 0x418], bl
call fcn.005056c4
lea ecx, [esp + 0x18]
call fcn.005055cd
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4aa74f
mov al, byte [eax]
lea ecx, [esp + 0x18]
cmp al, 0x22
jne 0x4aa651
push 1
push 0
call fcn.00504bda
push 0x22
lea ecx, [esp + 0x1c]
call fcn.00508201
mov edi, eax
test edi, edi
jl 0x4aa6a6
lea eax, [edi + 1]
lea ecx, [esp + 0x5c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00504f5c
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x41c], 0x22
call fcn.00507e73
lea ecx, [esp + 0x5c]
jmp 0x4aa686
push 0x20
call fcn.00508201
mov edi, eax
test edi, edi
jl 0x4aa6a6
lea eax, [edi + 1]
lea ecx, [esp + 0x48]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00504f5c
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x41c], 0x23
call fcn.00507e73
lea ecx, [esp + 0x48]
mov byte [esp + 0x418], bl
call fcn.00507d3a
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
mov eax, dword [edx - 8]
sub eax, edi
push eax
push edi
call fcn.00504bda
lea ecx, [esp + 0x28]
call fcn.005056c4
push 0x566534
lea ecx, [esp + 0x2c]
call fcn.00505156
test eax, eax
jge 0x4aa6cf
push 0x566530
lea ecx, [esp + 0x2c]
call fcn.00508116
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.004a01d0
push 0x20
lea ecx, [esp + 0x28]
mov byte [esp + 0x41c], 0x24
call fcn.00508201
test eax, eax
jle 0x4aa70a
push 0x22
push 0
lea ecx, [esp + 0x2c]
call fcn.00504c32
push 0x22
lea ecx, [esp + 0x28]
call fcn.0050813d
mov ecx, dword [esp + 0x24]
push ecx
push 0x566530
lea ecx, [esp + 0x30]
call fcn.00504da8
lea ecx, [esp + 0x24]
mov byte [esp + 0x418], bl
call fcn.00507d3a
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4aa74f
mov edx, dword [esp + 0x28]
push 1
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x418], 0x20
call fcn.00507d3a
lea ecx, [esp + 0x28]
mov byte [esp + 0x418], 0x1c
call fcn.00507d3a
jmp 0x4aa7ae
cmp eax, 0x10004
jne 0x4aa7ae
lea eax, [edi + 8]
push eax
call ebp
mov edx, dword [edi]
mov esi, dword [esi + 0x21c]
mov ecx, edi
call dword [edx + 0x14]
cmp esi, 0x20002
jl 0x4aa7ae
cmp esi, 0x20003
jle 0x4aa7a5
cmp esi, 0x20016
jne 0x4aa7ae
push 4
mov ecx, ebx
call fcn.004c83a0
lea ecx, [esp + 0x44]
mov dword [esp + 0x418], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40c
ret 8