Function at 0x4195a0
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov eax, 0x4e4948
call fcn.004afe60
sub esp, 0x320
push ebx
push esi
mov dword [ebp - 0x18], ecx
push edi
lea ecx, [ebp - 0x100]
call fcn.00446250
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x4195ec
push dword [ebp + 8]
lea ecx, [ebp - 0x100]
call fcn.004575a0
mov eax, dword [ebp - 0x100]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
pop ecx
lea ecx, [ebp - 0x10c]
call fcn.00446250
mov esi, dword [ebp + 0x10]
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x419614
push esi
lea ecx, [ebp - 0x10c]
call fcn.004575a0
mov esi, dword [ebp - 0x10c]
cmp dword [ebp + 0x18], ebx
jne 0x41961f
lea eax, [ebp - 0x5c]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 0x4c], eax
jne 0x41962c
mov dword [ebp + 8], esi
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x35], bl
mov byte [ebp + 0x13], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x71], 1
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x7b], bl
mov byte [ebp - 0x82], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x7a], bl
mov byte [ebp - 0x79], bl
call fcn.00446250
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 2
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov byte [ebp - 0x72], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x52], bl
mov byte [ebp - 0x83], bl
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x44], ebx
call fcn.00446250
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa0], ebx
mov byte [ebp + 0x17], bl
call fcn.00446250
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 4
call fcn.00446250
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.00446250
or dword [ebp - 0xd4], 0xffffffff
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 6
mov byte [ebp - 0x51], bl
mov dword [ebp - 0xf4], ebx
call fcn.00446250
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x258], 0x44
mov dword [ebp - 0x254], ebx
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x148], ebx
pop ecx
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x138]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xe8], ebx
cmp esi, ebx
mov byte [ebp - 4], 8
je 0x419750
test byte [0x51e003], 3
je 0x41976c
push 0x4efd0c
lea ecx, [ebp - 0xe8]
call fcn.004575a0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x250], eax
cmp esi, ebx
je 0x419781
cmp word [esi], 0x24
jne 0x419781
mov dword [ebp - 0x64], 1
mov byte [ebp - 0x1a], 1
cmp esi, ebx
mov dword [ebp - 0xbc], ebx
je 0x419813
xor ecx, ecx
cmp word [esi], 0x7c
jne 0x4197a6
add dword [ebp + 8], 2
inc esi
inc esi
inc ecx
mov dword [ebp - 0xbc], ecx
jmp 0x4197a7
inc ecx
cmp esi, ebx
je 0x419813
cmp word [esi], 0x2a
jne 0x419813
push 2
pop edx
add dword [ebp + 8], edx
mov eax, dword [ebp + 8]
cmp word [eax], 0x7c
mov byte [ebp + 0x13], 0x10
jne 0x4197cd
add dword [ebp + 8], edx
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp + 8]
mov ax, word [eax]
cmp ax, 0x31
jne 0x4197df
mov byte [ebp + 0x13], 0x11
jmp 0x4197fa
mov esi, eax
or esi, 0x20
cmp si, 0x6e
jne 0x4197f0
mov byte [ebp + 0x13], 0x12
jmp 0x4197fa
cmp ax, 0x2d
jne 0x4197fd
mov byte [ebp + 0x13], 0x14
add dword [ebp + 8], edx
mov eax, dword [ebp + 8]
mov ax, word [eax]
call fcn.0041d35d
test al, al
jne 0x419813
mov esi, ecx
jmp 0x41c2e4
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
cmp byte [ebp + 0x13], bl
pop ecx
jne 0x4198bc
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
cmp dword [ebp - 0xac], ebx
mov eax, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x14], eax
je 0x419847
cmp byte [ebp + 0x13], bl
jne 0x419992
push 2
pop edi
cmp word [eax], 0x2d
mov esi, eax
jne 0x41985e
add eax, 2
cmp word [eax], 0x2d
jne 0x41985e
mov dword [ebp - 0x14], eax
push 1
lea eax, [ebp - 0x14]
push eax
push 0x4efd08
call fcn.00448570
add esp, 0xc
test al, al
jne 0x419992
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
cmp ax, 0x2d
je 0x41988f
cmp ax, 0x2f
jne 0x419992
add dword [ebp - 0x14], edi
push 5
lea eax, [ebp - 0x14]
push eax
push str.catch
call fcn.004485c0
add esp, 0xc
test al, al
je 0x41993a
mov al, byte [ebp + 0x13]
or byte [ebp + 0x13], 0x10
cmp al, bl
jne 0x419b3a
mov edi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp - 0x64], ecx
mov esi, edi
je 0x41980c
push 2
pop edx
cmp ax, 0x3d
je 0x4198e8
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x4198d8
cmp esi, edi
je 0x41980c
cmp word [esi], 0x3d
jne 0x41980c
sub esi, edx
cmp word [esi], 0x2b
jne 0x419909
mov al, byte [esi]
mov byte [ebp - 0x72], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x419921
mov ax, word [ecx]
call fcn.0041d35d
test al, al
je 0x419921
sub ecx, edx
cmp ecx, edi
ja 0x41990f
mov ax, word [ecx]
call fcn.0041d35d
test al, al
jne 0x419bde
mov edx, ecx
inc ecx
inc ecx
jmp 0x419b67
push 4
push dword [ebp - 0x14]
push str.cmd:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419ab8
add dword [ebp - 0x14], 8
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call fcn.00416126
add esp, 0x10
mov dword [ebp - 0xac], eax
jmp 0x419984
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp - 0x14]
jb 0x41997d
cmp byte [ebp + 0x13], bl
je 0x419b3a
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
cmp dword [ebp - 0xac], ebx
pop ecx
je 0x4199b5
mov eax, dword [ebp - 0xac]
cmp word [eax], bx
jne 0x4199b5
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0xbc], ebx
jne 0x4199c5
cmp dword [ebp + 0x1c], ebx
mov byte [ebp - 0x31], bl
je 0x4199c9
mov byte [ebp - 0x31], 1
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xd8], ebx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x88], ebx
call fcn.00446250
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xc
call fcn.00446250
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xd
call fcn.00446250
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xe4], ebx
cmp byte [ebp - 0x31], bl
mov byte [ebp - 4], 0x10
jne 0x419a49
cmp dword [ebp - 0x4c], ebx
jne 0x419a49
mov ecx, dword [ebp - 0x18]
push 1
push ebx
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 8]
call fcn.00453300
mov eax, dword [ebp - 0xe4]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp word [eax], 0x2d
mov edi, eax
jne 0x419a60
add eax, 2
cmp word [eax], 0x2d
jne 0x419a60
mov dword [ebp + 8], eax
push 1
lea eax, [ebp + 8]
push eax
push 0x4efd08
call fcn.00448570
add esp, 0xc
test al, al
jne 0x41a462
mov eax, dword [ebp + 8]
mov ax, word [eax]
cmp ax, 0x2d
je 0x419a91
cmp ax, 0x2f
jne 0x41a462
push 2
pop esi
add dword [ebp + 8], esi
push 5
lea eax, [ebp + 8]
push eax
push str.catch
call fcn.00448570
add esp, 0xc
test al, al
je 0x419be6
mov byte [ebp + 0x13], 0x10
jmp 0x419a49
push 3
push dword [ebp - 0x14]
push 0x4efcf4
call fcn.00440450
add esp, 0xc
test al, al
je 0x419ae2
add dword [ebp - 0x14], 6
jmp 0x419ad7
add dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x2a
je 0x419ad4
jmp 0x419b18
push 4
push dword [ebp - 0x14]
push str.exe:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419afe
add dword [ebp - 0x14], 8
jmp 0x419b18
push 5
push dword [ebp - 0x14]
push str.logs:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419b3a
add dword [ebp - 0x14], 0xa
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x22
jne 0x419b3a
add dword [ebp - 0x14], edi
jmp 0x419b2f
add dword [ebp - 0x14], edi
cmp ax, 0x22
je 0x419b3a
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
cmp ax, bx
jne 0x419b26
lea eax, [ebp - 0x14]
push eax
call fcn.00416791
mov eax, dword [ebp - 0x14]
pop ecx
jmp 0x41984a
lea eax, [edx - 2]
mov dword [ebp - 0xd0], eax
mov ax, word [eax]
call fcn.0041d35d
test al, al
jne 0x419b6b
mov edx, dword [ebp - 0xd0]
cmp edx, edi
ja 0x419b4c
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x98]
call fcn.004463d0
mov edi, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x98]
push eax
mov ecx, edi
call fcn.004152c8
cmp byte [edi + 0x8a], bl
jne 0x419b9c
test byte [edi + 0xb], 0xf
je 0x419bb5
push ebx
lea eax, [ebp - 0x98]
push eax
mov ecx, edi
call fcn.004152c8
jmp 0x419bb5
cmp ax, 0x3d
je 0x419bc3
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x419bad
cmp ax, 0x3d
jne 0x419bde
lea eax, [ebp - 0xf4]
add esi, 2
push eax
mov dword [ebp - 0xf4], esi
call fcn.0043f2e0
pop ecx
jmp 0x419826
xor esi, esi
inc esi
jmp 0x41c2e4
push 6
push dword [ebp + 8]
push str.clone:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419c26
add dword [ebp + 8], 0xc
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp word [eax], bx
pop ecx
je 0x419c1c
mov word [eax], bx
add dword [ebp + 8], 2
cmp word [esi], bx
je 0x419c61
mov dword [ebp - 0x20], esi
jmp 0x419c61
push 9
push dword [ebp + 8]
push str.runrmenu:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419c6f
add dword [ebp + 8], 0x12
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0xec]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.004463d0
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
jmp 0x41a45c
push 8
push dword [ebp + 8]
push str.poprmenu
call fcn.00440450
add esp, 0xc
test al, al
je 0x419d1f
add dword [ebp + 8], 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp word [eax], bx
pop ecx
je 0x419ca8
add dword [ebp + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
pop ecx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x7a], 1
je 0x419cdd
cmp ax, 0x30
jb 0x419cda
cmp ax, 0x39
jbe 0x419cdd
add dword [ebp - 0x3c], esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00449a90
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x419d09
cmp ax, 0x30
jb 0x419d06
cmp ax, 0x39
jbe 0x419d09
add dword [ebp - 0x3c], esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00449a90
pop ecx
jmp 0x41a45c
push 4
push dword [ebp + 8]
push str.pid:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419d5c
add dword [ebp + 8], 8
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp esi, eax
pop ecx
je 0x419c61
lea ecx, [ebp - 0xfc]
jmp 0x419c56
push 4
push dword [ebp + 8]
push str.exe:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419dc8
add dword [ebp + 8], 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
push 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0xc4], ebx
call fcn.0042723f
add esp, 0xc
cmp dword [ebp - 0xc4], ebx
mov dword [ebp + 8], eax
jle 0x419c61
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xd8]
push dword [ebp - 0x68]
call fcn.004463d0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x58], eax
jmp 0x419c61
push 3
pop esi
push esi
push dword [ebp + 8]
push 0x4efcf4
call fcn.00440450
add esp, 0xc
test al, al
je 0x419ee5
mov eax, dword [ebp + 8]
xor esi, esi
add eax, 6
jmp 0x419df1
inc esi
inc eax
inc eax
mov dword [ebp + 8], eax
cmp word [eax], 0x2a
je 0x419dee
cmp esi, 2
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x28], ebx
jge 0x419e9c
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0042723f
add esp, 0xc
cmp dword [ebp - 0x28], ebx
mov dword [ebp + 8], eax
jle 0x419e49
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8c]
push dword [ebp - 0xa4]
call fcn.004463d0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x88], eax
cmp esi, 1
jne 0x419c61
cmp dword [ebp - 0x28], ebx
jle 0x419c61
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x8c], ebx
push esi
lea ecx, [ebp - 0x8c]
push ecx
push eax
mov byte [ebp - 4], 0x11
call fcn.00454f50
add esp, 0xc
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0x10
call fcn.0043f290
jmp 0x419c61
push 0x105
lea ecx, [ebp - 0x8c]
call fcn.004462b0
push 0x104
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x8c]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x419ed4
mov word [eax], bx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x88], eax
jmp 0x419c61
push 5
push dword [ebp + 8]
push str.logs:
call fcn.00440450
add esp, 0xc
test al, al
je 0x419f5e
mov eax, dword [ebp + 8]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x60], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x419f1c
add eax, 2
mov dword [ebp - 0x60], eax
mov edi, eax
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x48], ebx
call fcn.0042723f
add esp, 0xc
cmp dword [ebp - 0x48], ebx
mov dword [ebp + 8], eax
jle 0x419c61
cmp esi, ebx
je 0x419f4f
cmp dword [0x51908c], ebx
je 0x419c61
push dword [ebp - 0x48]
lea ecx, [ebp - 0x108]
push edi
jmp 0x419c5c
push 5
lea eax, [ebp + 8]
push eax
push str.nowin
call fcn.00448570
add esp, 0xc
test al, al
je 0x419f7e
mov byte [ebp - 0x79], 1
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.hide
call fcn.00448570
add esp, 0xc
test al, al
je 0x419fa1
mov dword [ebp - 0x78], 0x10000000
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push 0x4efca4
call fcn.00448570
add esp, 0xc
test al, al
je 0x419fc4
mov dword [ebp - 0x64], 1
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efca0
call fcn.00448570
add esp, 0xc
test al, al
je 0x419fe3
or byte [ebp - 0x1b], 1
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.err
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a003
or byte [ebp - 0x1b], 3
jmp 0x419a49
push 5
lea eax, [ebp + 8]
push eax
push str.limit
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a026
mov byte [ebp - 0x82], 1
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efc8c
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a045
mov byte [ebp - 0x19], 1
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.hook
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a065
mov byte [ebp - 0x1a], 1
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efc80
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a087
mov dword [ebp - 0x78], 6
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efc7c
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a0a5
mov dword [ebp - 0x78], esi
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.show
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a0c8
mov dword [ebp - 0x78], 1
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.runs
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a0e8
mov byte [ebp - 0x7b], 1
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.no64
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a107
mov byte [ebp - 0x71], bl
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efc60
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a129
mov byte [ebp - 0x81], 1
jmp 0x419a49
push esi
push dword [ebp + 8]
push 0x4efc5c
call fcn.00440450
add esp, 0xc
test al, al
je 0x41a17a
add dword [ebp + 8], 6
mov eax, dword [ebp + 8]
cmp word [eax], 0x3a
mov byte [ebp - 0x2d], 1
jne 0x419c61
add dword [ebp + 8], 2
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp esi, eax
pop ecx
je 0x419c61
lea ecx, [ebp - 0xe0]
jmp 0x419c56
push 5
push dword [ebp + 8]
push str.code:
call fcn.00440450
add esp, 0xc
test al, al
je 0x41a23b
add dword [ebp + 8], 0xa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
push str.UTF8
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a1c8
mov byte [ebp + 0x17], 1
mov dword [ebp - 0xa0], 0xfde9
jmp 0x41a453
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
push str.ANSI
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a1ee
mov byte [ebp + 0x17], 1
mov dword [ebp - 0xa0], ebx
jmp 0x41a453
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
push 0x4efc40
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a218
mov byte [ebp + 0x17], 2
mov dword [ebp - 0xa0], 0x4b0
jmp 0x41a453
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00449a90
test eax, eax
pop ecx
pop ecx
jle 0x41a453
mov byte [ebp + 0x17], 1
jmp 0x41a453
push 5
push dword [ebp + 8]
push str.user:
call fcn.00440450
add esp, 0xc
test al, al
je 0x41a278
add dword [ebp + 8], 0xa
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp esi, eax
pop ecx
je 0x419c61
lea ecx, [ebp - 0xcc]
jmp 0x419c56
push 7
push dword [ebp + 8]
push str.passwd:
call fcn.00440450
add esp, 0xc
test al, al
je 0x41a293
mov byte [ebp - 0x51], bl
jmp 0x41a2ad
push 7
push dword [ebp + 8]
push str.passwd
call fcn.00440450
add esp, 0xc
test al, al
je 0x41a2d4
mov byte [ebp - 0x51], 1
add dword [ebp + 8], 0xe
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0041676d
mov eax, dword [ebp + 8]
cmp esi, eax
pop ecx
je 0x419c61
lea ecx, [ebp - 0xc0]
jmp 0x419c56
push 8
lea eax, [ebp + 8]
push eax
push str.REALTIME
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a2f7
mov dword [ebp - 0x44], 0x100
jmp 0x419a49
push 4
lea eax, [ebp + 8]
push eax
push str.HIGH
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a31a
mov dword [ebp - 0x44], 0x80
jmp 0x419a49
push 0xb
lea eax, [ebp + 8]
push eax
push str.ABOVENORMAL
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a33d
mov dword [ebp - 0x44], 0x8000
jmp 0x419a49
push 6
lea eax, [ebp + 8]
push eax
push str.NORMAL
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a360
mov dword [ebp - 0x44], 0x20
jmp 0x419a49
push 0xb
lea eax, [ebp + 8]
push eax
push str.BELOWNORMAL
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a383
mov dword [ebp - 0x44], 0x4000
jmp 0x419a49
push esi
lea eax, [ebp + 8]
push eax
push 0x4efbf0
call fcn.00448570
add esp, 0xc
test al, al
jne 0x41a3d2
mov esi, dword [ebp + 8]
push 4
push esi
push 0x4efbe4
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x41a3de
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.0041d35d
test al, al
jne 0x41a3c4
cmp cx, bx
jne 0x41a3de
add dword [ebp + 8], 8
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
pop ecx
mov dword [ebp - 0x44], 0x40
jmp 0x419a49
push 3
lea eax, [ebp + 8]
push eax
push 0x4efbe0
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a3fe
mov byte [ebp - 0x36], 1
jmp 0x419a49
push 3
lea eax, [ebp + 8]
push eax
push 0x4efbdc
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a427
mov byte [ebp - 0x52], 1
mov byte [ebp + 0x17], bl
mov dword [ebp - 0xa0], ebx
jmp 0x419a49
push 3
lea eax, [ebp + 8]
push eax
push 0x4efbd8
call fcn.00448570
add esp, 0xc
test al, al
je 0x41a44a
mov byte [ebp - 0x83], 1
jmp 0x419a49
cmp word [edi], 0x2d
mov dword [ebp + 8], edi
jne 0x41a462
lea eax, [ebp + 8]
push eax
call fcn.00416791
pop ecx
jmp 0x419a49
cmp dword [ebp - 0xa0], 0x4b0
jne 0x41a472
mov byte [ebp + 0x17], 2
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
je 0x41a4a5
cmp byte [ebp - 0x31], bl
mov dword [ebp + 8], eax
jne 0x41a4a5
cmp dword [ebp - 0x4c], ebx
jne 0x41a4a5
push 1
push ebx
lea ecx, [ebp - 0xe4]
push ecx
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00453300
mov eax, dword [ebp - 0xe4]
mov dword [ebp + 8], eax
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov esi, dword [ebp - 0x58]
cmp esi, ebx
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x4c], ebx
je 0x41a4ca
cmp word [esi], bx
jne 0x41a4cd
mov byte [ebp - 0x36], bl
cmp byte [ebp - 0x36], bl
je 0x41a4f9
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x4c], eax
je 0x41a4ea
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x154]
push eax
push esi
call fcn.004228d7
pop ecx
pop ecx
mov dword [ebp - 0xdc], ebx
mov eax, dword [ebp + 0x18]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], ebx
xor eax, eax
lea edi, [ebp - 0x11c]
mov dword [ebp - 0x120], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x174], ebx
lea edi, [ebp - 0x170]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x160], 0xc
setne al
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 0x31], bl
mov byte [ebp - 4], 0x1c
je 0x41a9cd
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x7c
mov dword [ebp - 0x48], ebx
jne 0x41a5ac
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 8], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x41a593
call fcn.0041d35d
test al, al
jne 0x41a593
mov dword [ebp - 0x40], ecx
push 0x7c
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x41a5e9
mov word [eax], bx
add dword [ebp - 0x10], 2
lea eax, [ebp - 0x10]
push eax
call fcn.0043f2e0
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
pop ecx
je 0x41a5af
mov ecx, dword [ebp - 0x40]
cmp word [ecx], bx
mov dl, 1
je 0x41a5eb
mov cl, dl
jmp 0x41a5f7
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x41a5f7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
cmp cl, bl
mov dword [ebp - 0x60], eax
je 0x41a6d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x94]
push eax
xor edi, edi
lea eax, [ebp - 0x90]
inc edi
push eax
mov dword [ebp - 0xb8], 0xc
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, ebx
jne 0x41a64c
mov ecx, dword [ebp - 0x18]
push edi
call fcn.0041ecf1
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x90]
push eax
push esi
push dword [ebp - 0x90]
push esi
call edi
cmp dword [ebp - 0x94], ebx
mov word [ebp - 0x32], bx
je 0x41a69f
push dword [ebp - 0x94]
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
lea eax, [ebp - 0x32]
push eax
push ecx
push dword [ebp - 0x40]
call fcn.004195a0
cmp dword [ebp - 0x94], ebx
je 0x41a69f
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x90]
push eax
push esi
push dword [ebp - 0x90]
mov dword [ebp - 0x94], ebx
push esi
call edi
mov ecx, dword [ebp - 0x90]
cmp ecx, ebx
je 0x41a6d9
lea eax, [ebp - 0x258]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x2c], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x41a969
cmp cx, 0x3c
je 0x41a707
cmp cx, 0x3e
je 0x41a707
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov cx, word [eax]
cmp cx, bx
jne 0x41a6ee
mov cx, word [eax]
cmp cx, bx
je 0x41a969
cmp cx, 0x3c
jne 0x41a7f2
mov word [eax], bx
add dword [ebp - 0x10], 2
lea eax, [ebp - 0x10]
push eax
call fcn.0043f2e0
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
pop ecx
je 0x41a7f2
mov dword [ebp - 0x50], eax
jmp 0x41a750
cmp cx, 0x3c
je 0x41a758
cmp cx, 0x3e
je 0x41a758
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov cx, word [eax]
cmp cx, bx
jne 0x41a73f
sub eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x70]
sar eax, 1
push eax
push dword [ebp - 0x50]
call fcn.00457450
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1d
call fcn.00446250
mov ecx, dword [ebp - 0x18]
push edi
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x50]
mov byte [ebp - 4], 0x1e
call fcn.00453300
mov eax, dword [ebp - 0x24]
push eax
mov dword [ebp - 0x50], eax
call fcn.0041e7c0
lea eax, [ebp - 0x50]
push eax
call fcn.0043f2e0
cmp dword [ebp - 0x6c], ebx
pop ecx
pop ecx
je 0x41a7af
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x160]
push eax
push 7
push 0xc0000000
push dword [ebp - 0x50]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], ebx
call fcn.004167bc
cmp dword [ebp - 0x6c], ebx
jne 0x41a7d7
mov dword [ebp - 0x6c], ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1d
call fcn.0043f290
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1c
call fcn.0043f290
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x3e
jne 0x41a6e2
mov word [eax], bx
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp - 0x31], 1
jne 0x41a817
mov byte [ebp - 0x31], 2
mov word [eax - 2], bx
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x3e
jne 0x41a82a
add dword [ebp - 0x10], 2
mov esi, edi
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x26
jne 0x41a83b
add dword [ebp - 0x10], 2
mov byte [ebp - 0x31], 3
lea eax, [ebp - 0x10]
push eax
call fcn.0043f2e0
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
pop ecx
je 0x41a6e2
mov dword [ebp - 0x28], eax
jmp 0x41a867
cmp cx, 0x3c
je 0x41a86f
cmp cx, 0x3e
je 0x41a86f
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov cx, word [eax]
cmp cx, bx
jne 0x41a856
sub eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa4]
sar eax, 1
push eax
push dword [ebp - 0x28]
call fcn.00457450
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1f
call fcn.00446250
mov ecx, dword [ebp - 0x18]
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x28]
mov byte [ebp - 4], 0x20
call fcn.00453300
mov eax, dword [ebp - 0x40]
push eax
mov dword [ebp - 0x28], eax
call fcn.0041e7c0
lea eax, [ebp - 0x28]
push eax
call fcn.0043f2e0
test byte [ebp - 0x31], 1
pop ecx
pop ecx
je 0x41a8d2
cmp dword [ebp - 0x80], ebx
je 0x41a8cf
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x80], ebx
test byte [ebp - 0x31], 2
je 0x41a8f5
cmp dword [ebp - 0x9c], ebx
je 0x41a8ec
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x48], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x160]
push eax
push 7
push 0x40000000
push dword [ebp - 0x28]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], ebx
call fcn.004167bc
mov edi, eax
cmp edi, ebx
jne 0x41a93e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1f
call fcn.0043f290
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1c
call fcn.0043f290
mov eax, dword [ebp - 0x10]
jmp 0x41a6df
cmp esi, ebx
je 0x41a94d
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp - 0x31], 1
jne 0x41a958
mov dword [ebp - 0x80], edi
jmp 0x41a91b
cmp byte [ebp - 0x31], 3
mov dword [ebp - 0x48], edi
je 0x41a953
mov dword [ebp - 0x9c], edi
jmp 0x41a91b
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
mov edx, 0x100
je 0x41a984
lea eax, [ebp - 0x258]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x2c], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
je 0x41a99a
lea eax, [ebp - 0x258]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x2c], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp - 0x48]
cmp ecx, ebx
je 0x41a9b0
lea eax, [ebp - 0x258]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x2c], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp - 0x18]
push edi
push ebx
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x60]
call fcn.00453300
mov eax, dword [ebp - 0x110]
mov dword [ebp + 8], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 8]
mov ax, word [eax]
cmp ax, 0x21
je 0x41aa0f
cmp ax, 0x2a
je 0x41aa0f
cmp ax, 0x40
jne 0x41aa18
push str.WinSta0WinLogon
lea ecx, [ebp - 0xe8]
call fcn.004575a0
mov ecx, dword [ebp - 0xe8]
inc byte [ebp - 0x35]
lea eax, [ebp - 0x258]
mov dword [eax + 8], ecx
mov dword [ebp - 0x78], esi
add dword [ebp + 8], 2
jmp 0x41a9d5
cmp ax, 0x3d
jne 0x41aa27
mov dword [ebp - 0x64], 1
jmp 0x41aa12
cmp ax, 0x24
jne 0x41aa33
mov byte [ebp - 0x2d], 1
jmp 0x41aa12
cmp ax, 0x26
jne 0x41aa42
mov dword [ebp - 0x78], 3
jmp 0x41aa12
cmp ax, 0x5e
jne 0x41aa4d
mov dword [ebp - 0x78], edi
jmp 0x41aa12
cmp ax, 0x5f
je 0x41aa48
lea edi, [ebp - 0x258]
cmp dword [edi + 8], ebx
je 0x41aa71
test byte [ebp - 0x35], 1
je 0x41aa71
call fcn.004160ac
cmp eax, 1
jge 0x41aa71
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x41aa8c
or byte [edi + 0x2d], 1
mov dword [ebp - 0x64], ebx
mov byte [ebp + 0x13], bl
mov dword [ebp - 0x2c], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp - 0x2d], bl
je 0x41aaac
mov eax, dword [ebp - 0xe0]
cmp word [eax], bx
jne 0x41aaac
push str.open
lea ecx, [ebp - 0xe0]
call fcn.004574e0
mov eax, dword [ebp - 0x78]
cmp eax, esi
je 0x41aabb
cmp byte [ebp - 0x83], bl
je 0x41aabf
or byte [edi + 0x2c], 0x80
cmp eax, ebx
je 0x41aacb
or dword [edi + 0x2c], 1
mov word [edi + 0x30], ax
mov al, byte [ebp - 0x35]
and al, 3
cmp al, 3
je 0x41aad9
cmp byte [ebp - 0x79], bl
je 0x41aadd
or byte [edi + 0x2f], 8
cmp byte [ebp - 0x7b], bl
je 0x41ab30
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x41aaf7
inc esi
inc esi
jmp 0x41aafa
mov esi, dword [ebp + 8]
push dword [ebp + 8]
xor eax, eax
cmp dword [ebp - 0x64], ebx
setne al
add eax, 0x80000001
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push 0x4efb58
push edi
call fcn.004402a0
add esp, 0x18
mov esi, eax
jmp 0x41c1f8
lea eax, [ebp + 8]
push eax
call fcn.0043f2e0
pop ecx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xf0], ebx
cmp dword [ebp - 0x20], ebx
mov byte [ebp - 4], 0x22
je 0x41abe8
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x2d], bl
call fcn.00446250
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x20]
mov byte [ebp - 4], 0x23
call fcn.00422a90
cmp eax, ebx
je 0x41ac46
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x41ac46
push eax
lea ecx, [ebp - 0x50]
call fcn.00457540
push dword [ebp + 8]
lea ecx, [ebp - 0xf0]
call fcn.004575a0
push dword [ebp - 0x108]
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xf0]
push eax
push dword [ebp - 0x50]
call fcn.00419310
mov esi, eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xf0]
add esp, 0x14
lea ecx, [ebp - 0x50]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0x22
call fcn.0043f290
cmp esi, ebx
jne 0x41c1de
mov eax, dword [ebp - 0xec]
cmp word [eax], bx
je 0x41ac5c
push dword [ebp + 8]
call fcn.0042063d
pop ecx
push eax
lea ecx, [ebp + 0x10]
mov dword [ebp + 8], eax
call fcn.00457400
push 0x4efb54
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x24
call fcn.004462e0
push dword [ebp - 0xec]
lea ecx, [ebp + 0x10]
call fcn.004462e0
mov ecx, dword [ebp - 0x18]
push ebx
push dword [ebp + 0x10]
call fcn.00460850
mov esi, eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x22
call fcn.0043f290
jmp 0x41c1de
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x22
call fcn.0043f290
mov esi, 0x80070057
jmp 0x41c1de
cmp byte [ebp - 0x7a], bl
je 0x41ae07
lea ecx, [ebp + 0x1c]
call fcn.00446250
push dword [ebp + 8]
mov byte [ebp - 4], 0x25
mov dword [ebp + 0x10], ebx
call fcn.0042063d
pop ecx
lea ecx, [ebp + 0x18]
mov dword [ebp + 8], eax
call fcn.00446250
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x24], ebx
call fcn.00454f50
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp eax, ebx
jne 0x41acba
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x25
call fcn.0043f290
lea ecx, [ebp + 0x1c]
jmp 0x41ac49
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.00457400
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x27
call fcn.00457400
push edi
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x28
push esi
call fcn.00417dae
add esp, 0x14
cmp dword [ebp + 0x10], ebx
jle 0x41ad3c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x41ad10
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x10], ebx
jle 0x41add0
mov esi, dword [ebp + 0x1c]
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], esi
call fcn.004226e8
mov eax, dword [ebp + 0x10]
mov word [eax], bx
cmp word [esi], bx
je 0x41add0
push dword [ebp + 8]
lea ecx, [ebp + 0x14]
call fcn.00457400
push 0x4efb54
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x29
call fcn.004462e0
push esi
lea ecx, [ebp + 0x14]
call fcn.004462e0
mov ecx, dword [ebp - 0x18]
push ebx
push dword [ebp + 0x14]
call fcn.00460850
lea ecx, [ebp + 0x14]
mov esi, eax
mov byte [ebp - 4], 0x28
call fcn.0043f290
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x27
call fcn.0043f290
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x26
call fcn.0043f290
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x25
call fcn.0043f290
lea ecx, [ebp + 0x1c]
jmp 0x41ac38
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x27
call fcn.0043f290
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x26
call fcn.0043f290
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x25
call fcn.0043f290
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x22
call fcn.0043f290
xor esi, esi
jmp 0x41c1de
push dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.00457400
cmp byte [0x519000], bl
mov eax, dword [ebp - 0x128]
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 0x2a
mov dword [ebp + 8], eax
mov dword [ebp - 0x24], 0x519150
jne 0x41ae52
cmp edi, ebx
je 0x41ae3d
cmp byte [edi + 0xa], bl
jne 0x41ae52
cmp byte [ebp - 0x81], bl
mov byte [ebp + 0x1f], bl
je 0x41ae56
cmp edi, ebx
je 0x41ae56
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp + 0x1f], 1
push ebx
lea ecx, [ebp - 0x60]
call fcn.00457400
cmp byte [ebp + 0x1f], bl
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x10], ebx
mov esi, 0x5194ec
je 0x41b0e9
push esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x2c
call fcn.00422a49
cmp edi, ebx
mov byte [ebp - 4], 0x2d
je 0x41aea5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2ec]
push edi
call fcn.00441b60
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x70], edi
call fcn.00446280
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x2e
mov dword [ebp + 0xc], eax
jmp 0x41af41
mov dword [ebp + 0x1c], edi
jmp 0x41aed4
cmp ax, 0x3d
je 0x41aede
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x41aece
mov esi, edi
sub esi, dword [ebp + 0x1c]
sar esi, 1
cmp word [edi], bx
je 0x41af3f
cmp word [edi + 2], bx
je 0x41af3a
cmp esi, 0x104
jg 0x41af3a
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call fcn.004acbce
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2ec]
mov word [eax + esi*2], bx
call fcn.0041e533
test eax, eax
jne 0x41af3a
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x2ec]
call fcn.0041e465
jmp 0x41af3a
inc edi
inc edi
cmp word [edi], bx
jne 0x41af38
inc edi
inc edi
cmp word [edi], bx
jne 0x41aec9
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x2e8]
xor eax, eax
cmp ecx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0xc], eax
jle 0x41afef
jmp 0x41af6d
mov eax, dword [ebp + 0xc]
lea esi, [eax + 1]
cmp esi, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x5c], esi
jge 0x41afe0
mov eax, dword [ebp + 0xc]
shl eax, 2
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [eax + ecx]
mov ecx, dword [ecx]
mov edi, esi
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x41afb1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x48], edi
inc esi
cmp esi, dword [ebp + 0x1c]
jl 0x41af87
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp + 0xc]
je 0x41afe0
mov edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x24]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x2ec]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jl 0x41af6a
xor esi, esi
cmp dword [ebp + 0x1c], ebx
jle 0x41b02d
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x20]
lea edi, [ecx + eax + 1]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + esi*4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
cmp esi, dword [ebp + 0x1c]
lea eax, [edi + eax + 3]
mov dword [ebp - 0x20], eax
jl 0x41aff6
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
lea ecx, [ebp - 0x60]
call fcn.004462b0
mov edi, dword [ebp - 0x60]
xor esi, esi
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x10], edi
jle 0x41b0b2
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push edi
call fcn.004acbce
mov eax, dword [ebp - 0x24]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push edi
call fcn.004acbce
mov eax, dword [ebp - 0x24]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x1c]
jl 0x41b049
mov word [edi], bx
inc edi
inc edi
lea ecx, [ebp - 0x40]
mov word [edi], bx
mov byte [ebp - 4], 0x2d
call fcn.0043f290
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x2c
call fcn.00415293
push 0x5194ec
mov byte [ebp - 4], 0x2b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0x5194ec
mov ecx, dword [ebp - 0x98]
xor al, al
cmp word [ecx], 0x40
jne 0x41b0fb
inc al
jmp 0x41b105
cmp dword [ebp - 0xac], ebx
je 0x41b105
mov al, 2
cmp byte [ebp + 0x13], bl
je 0x41b21a
or byte [ebp + 0x13], 8
neg al
mov dword [ebp - 0x64], 1
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.00441790
push eax
lea eax, [ebp - 0x194]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push 1
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0xc8], eax
je 0x41b1b4
cmp eax, 0xffffffff
je 0x41b1b4
push 0xffffffffffffffff
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00457470
mov eax, dword [eax]
push ebx
push ebx
push 3
lea ecx, [ebp - 0x160]
push ecx
push 7
push 0xc0000000
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x2f
call fcn.004167bc
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x2b
call fcn.0043f290
xor edi, edi
inc edi
jmp 0x41b1be
xor edi, edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x3c]
mov dword [ebp + 0xc], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x258]
or byte [eax + 0x2d], 1
test byte [ebp - 0x1b], 2
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x2c], edi
jne 0x41b208
cmp byte [ebp - 0x1b], bl
jne 0x41b20e
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0x3c], ecx
test byte [ebp - 0x1b], 1
je 0x41b230
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0x40], ecx
cmp dword [ebp - 0x64], ebx
jne 0x41b230
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push esi
mov dword [ebp - 0x1b4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x34], ebx
mov edi, dword [ebp - 0x10]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp - 0x44]
cmp byte [ebp - 0x19], bl
mov byte [ebp - 4], 0x31
mov dword [ebp + 0xc], eax
je 0x41b261
or dword [ebp + 0xc], 4
cmp byte [ebp - 0x71], bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x5c], ebx
je 0x41b279
lea eax, [ebp - 0x70]
push eax
call fcn.00415774
pop ecx
mov dword [ebp - 0x5c], eax
cmp byte [ebp - 0x2d], bl
je 0x41b34c
push 0xd
xor eax, eax
mov dword [ebp - 0x1ac], ebx
pop ecx
lea edi, [ebp - 0x1a8]
mov dword [ebp - 0x1b0], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x78]
or word [ebp - 0x1ac], 0x4540
cmp eax, ebx
jne 0x41b2b2
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1a0], eax
cmp word [eax], 0x22
jne 0x41b313
push 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0042723f
add esp, 0xc
push dword [ebp - 0x68]
lea ecx, [ebp - 0xf8]
push dword [ebp - 0x4c]
mov esi, eax
call fcn.004463d0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], esi
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x178]
lea edi, [ebp - 0x148]
push eax
mov dword [edi], eax
mov dword [ebp - 0x178], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [edi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41b7e5
cmp byte [ebp - 0x82], bl
je 0x41b3a6
call fcn.0041927f
push dword [ebp + 8]
mov dword [ebp - 0x104], eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x34]
push dword [ebp - 0x88]
push eax
call fcn.00415fb5
add esp, 0x10
lea ecx, [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x58]
push dword [ebp - 0x104]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x1c], eax
jmp 0x41b341
mov eax, dword [ebp - 0xcc]
cmp word [eax], bx
je 0x41b514
cmp byte [ebp - 0x51], bl
mov dword [ebp + 0x1c], ebx
je 0x41b466
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041520a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x32
call fcn.00446060
mov edi, dword [ebp - 0xc0]
push edi
mov byte [ebp - 4], 0x33
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.004afe00
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call fcn.0044f0d0
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp - 0x20]
sbb edi, edi
lea ecx, [ebp - 0xc0]
neg edi
call fcn.00446330
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push esi
call fcn.004afe00
mov esi, dword [ebp - 0x20]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push esi
call fcn.004afe00
add esp, 0xc
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x32
call fcn.0043f290
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x31
call fcn.0043f290
cmp edi, ebx
je 0x41b4dd
mov esi, dword [ebp - 0xcc]
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push esi
call edi
cmp eax, ebx
jne 0x41b484
push 0x5c
push esi
call edi
cmp eax, ebx
je 0x41b492
mov word [eax], bx
mov edi, dword [ebp - 0xcc]
lea esi, [eax + 2]
jmp 0x41b497
mov edi, 0x4efb38
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push dword [ebp - 0x58]
push dword [ebp - 0x88]
push eax
call fcn.00415fb5
add esp, 0x10
lea ecx, [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x58]
push 1
push dword [ebp - 0xc0]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x1c], eax
mov edi, dword [ebp - 0xc0]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.004afe00
mov edi, dword [ebp - 0xcc]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.004afe00
add esp, 0xc
jmp 0x41b341
cmp byte [ebp - 0x36], bl
je 0x41b55d
push dword [ebp - 0x4c]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x88]
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push dword [ebp + 8]
push dword [ebp - 0x150]
push dword [ebp - 0x154]
call fcn.00455640
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x1c], ecx
jmp 0x41b341
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x58]
cmp esi, ebx
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x40], ebx
mov eax, esi
je 0x41b5a0
cmp word [esi], 0x2a
jne 0x41b587
inc eax
inc eax
inc dword [ebp - 0x40]
cmp word [eax], 0x2a
je 0x41b57c
cmp word [eax], 0x23
jne 0x41b5a0
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x41b5a0
cmp cx, 0x39
ja 0x41b5a0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
mov dword [ebp - 0x4c], ebx
je 0x41b799
add dword [ebp - 0x28], 2
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00451840
pop ecx
pop ecx
push 0x20
pop edi
lea ecx, [ebp - 0xb8]
mov esi, eax
mov dword [ebp - 0x20], edi
call fcn.00446060
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xb8]
push eax
push esi
push dword [ebp - 0x4c]
mov byte [ebp - 4], 0x35
push ebx
mov dword [ebp - 0x20], edi
call fcn.00422b90
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x41b635
push dword [ebp - 0x4c]
push 0x4efb30
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41b635
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xb8]
push eax
push str.INDATA
push 2
push ebx
mov dword [ebp - 0x20], edi
call fcn.00422b90
add esp, 0x14
mov esi, eax
cmp dword [ebp - 0xb4], ebx
jle 0x41b782
cmp esi, ebx
je 0x41b782
cmp dword [ebp - 0x40], ebx
jg 0x41b6b6
push ebx
lea edi, [ebp - 0x148]
push edi
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x88]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push dword [ebp + 8]
push dword [ebp - 0xb4]
push esi
call fcn.00455640
add esp, 0x28
cmp eax, ebx
mov dword [ebp - 0x68], eax
jl 0x41b6b6
mov edi, dword [edi + 8]
cmp edi, ebx
je 0x41b6b6
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x41b6b6
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x68], ebx
setg al
mov dword [ebp + 0x1c], eax
jmp 0x41b788
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
push 0x4ef5c8
push str.exedat
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 0x36
call fcn.004168b5
add esp, 0x14
cmp dword [ebp - 0x48], ebx
je 0x41b76e
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0xb4]
mov dword [ebp - 0x68], ebx
push esi
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push dword [ebp - 0x44]
push dword [ebp - 0x88]
push eax
call fcn.00415fb5
lea edi, [ebp - 0x148]
push edi
lea ecx, [ebp - 0x258]
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x44]
call fcn.004abe80
add esp, 0x38
cmp dword [ebp - 0x40], 2
mov dword [ebp + 0x1c], eax
jl 0x41b774
push dword [edi + 8]
push dword [ebp - 0xdc]
call fcn.00415344
mov eax, dword [ebp - 0xdc]
pop ecx
pop ecx
mov word [eax], bx
jmp 0x41b774
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x35
call fcn.0043f290
jmp 0x41b788
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x34
call fcn.0043f290
jmp 0x41b7d9
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push esi
push dword [ebp - 0x88]
push eax
call fcn.00415fb5
lea ecx, [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push ebx
push ebx
push dword [ebp + 8]
push esi
call fcn.004abe80
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x38
mov dword [ebp + 0x1c], eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x31
call fcn.0043f290
cmp dword [ebp - 0x5c], ebx
je 0x41b7f3
push dword [ebp - 0x70]
call fcn.00415785
pop ecx
cmp dword [ebp - 0x94], ebx
je 0x41b803
push dword [ebp - 0x94]
call esi
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x94], ebx
je 0x41b812
xor eax, eax
jmp 0x41b818
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x5c], eax
call fcn.004151b3
mov eax, dword [ebp - 0xfc]
cmp word [eax], bx
je 0x41b84b
push eax
lea eax, [ebp - 0x148]
push dword [eax + 8]
push dword [ebp - 0x18]
call fcn.00448b20
add esp, 0xc
cmp byte [ebp - 0x19], bl
je 0x41b871
lea edi, [ebp - 0x148]
cmp dword [edi], ebx
je 0x41b871
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [edi]
mov dword [ebp - 0xbc], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x148]
push dword [edi + 8]
push dword [ebp - 0x18]
call fcn.00448b20
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp - 0x18]
call fcn.00448b20
add esp, 0x18
test byte [ebp + 0xc], 4
je 0x41b8ae
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41b8ae
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x30
call fcn.0043f290
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x2a
call fcn.0043f290
cmp dword [ebp - 0x3c], ebx
je 0x41b8db
push dword [ebp - 0x3c]
call esi
cmp dword [ebp - 0x90], ebx
mov dword [ebp - 0x3c], ebx
je 0x41b8ee
push dword [ebp - 0x90]
call esi
cmp dword [ebp - 0x6c], ebx
mov dword [ebp - 0x90], ebx
je 0x41b8fe
push dword [ebp - 0x6c]
call esi
cmp dword [ebp - 0x80], ebx
mov dword [ebp - 0x6c], ebx
je 0x41b90b
push dword [ebp - 0x80]
call esi
cmp dword [ebp - 0x9c], ebx
mov dword [ebp - 0x80], ebx
je 0x41b91e
push dword [ebp - 0x9c]
call esi
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x9c], ebx
je 0x41c108
mov eax, dword [edi]
cmp eax, ebx
jne 0x41b936
mov dword [ebp - 0x64], ebx
mov ecx, dword [ebp - 0xa8]
inc dword [ebp - 0xa8]
mov dword [ebp + ecx*4 - 0x120], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41b953
push eax
call esi
cmp byte [ebp - 0x1a], bl
mov dword [edi + 4], ebx
je 0x41b970
mov ecx, dword [ebp - 0x18]
push 0x3e8
call fcn.0041ecf1
push dword [edi]
call fcn.0041f486
pop ecx
cmp dword [ebp - 0x64], ebx
je 0x41c108
mov al, byte [0x5152e8]
push 0x100004
lea ecx, [ebp - 0x10]
mov byte [ebp + 0xf], al
mov dword [ebp - 0x2c], 0x100000
xor edi, edi
call fcn.00446080
mov eax, dword [ebp - 0x98]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], ecx
mov byte [ebp + 0x1f], bl
jne 0x41ba63
mov byte [ebp + 0x1f], 1
mov dword [ebp - 0x58], ecx
cmp byte [ebp - 0x72], bl
je 0x41ba1f
mov dword [ebp - 0x60], ebx
mov ecx, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x58]
mov byte [ebp - 4], 0x38
call fcn.004524d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x60]
lea ecx, [ebp - 0x10]
call fcn.004461b0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [edi + 0x3ff]
and eax, 0xfffffc00
add eax, 0x100000
mov dword [ebp - 0x2c], eax
add eax, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.004460b0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x37
call fcn.0043f290
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x13], 8
je 0x41bd90
mov eax, dword [ebp - 0x98]
mov ax, word [eax]
cmp ax, 0x40
je 0x41ba78
cmp byte [ebp - 0x52], bl
je 0x41ba78
cmp ax, 0x26
je 0x41ba5d
mov eax, dword [ebp - 0x18]
test byte [eax + 0xb], 0xf
je 0x41ba78
mov byte [ebp - 0x1a], 1
jmp 0x41ba7b
cmp dword [ebp - 0xac], ebx
je 0x41b9be
mov byte [ebp + 0x1f], 2
jmp 0x41b9be
mov byte [ebp - 0x1a], bl
push ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x1f], bl
mov dword [ebp - 0x88], edi
je 0x41baaa
mov eax, dword [ebp - 0x2c]
sub eax, edi
jmp 0x41baaf
mov eax, 0x100000
lea ecx, [ebp - 0x174]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
add eax, edi
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0xd4], ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x20], ebx
jg 0x41baf1
mov dword [ebp - 0xd4], 0x3e8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x19], bl
call fcn.00446250
mov byte [ebp - 4], 0x39
mov al, byte [0x5152e8]
cmp al, bl
mov byte [ebp + 0xf], al
jle 0x41bd79
mov ecx, dword [ebp - 0x18]
push 0x4ff
push dword [ebp - 0xd4]
lea eax, [ebp - 0x120]
push ebx
push eax
push dword [ebp - 0xa8]
call fcn.00420633
cmp eax, ebx
mov dword [ebp - 0x40], eax
jne 0x41bbc5
lea eax, [ebp - 0xc8]
mov esi, dword [eax]
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x174]
push eax
push esi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 0x28], ebx
jle 0x41bb73
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x28], eax
jle 0x41bb6a
mov dword [ebp - 0x28], eax
add edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp - 0x2c]
jl 0x41bb94
add dword [ebp - 0x2c], 0x100000
mov eax, dword [ebp - 0x2c]
add eax, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.004460b0
cmp byte [ebp + 0x1f], bl
je 0x41bba3
mov eax, dword [ebp - 0x2c]
sub eax, edi
mov dword [ebp - 0x44], eax
jmp 0x41bbaa
mov dword [ebp - 0x44], 0x100000
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x1f], bl
je 0x41bbf9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x70], eax
sub eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0xd4]
jge 0x41bcb3
cmp edi, dword [ebp - 0x20]
je 0x41bd70
cmp eax, 0x14
jl 0x41bd70
jmp 0x41bcb3
mov eax, dword [ebp - 0xa8]
cmp eax, 1
jle 0x41bc25
dec eax
cmp eax, dword [ebp - 0x40]
jne 0x41bc25
cmp byte [ebp + 0x1f], bl
mov byte [ebp - 0x19], 1
je 0x41bd79
cmp edi, dword [ebp - 0x20]
je 0x41bd79
jmp 0x41bcb3
test byte [ebp + 0x13], 1
je 0x41bc45
mov eax, dword [ebp - 0x88]
jmp 0x41bc41
mov ecx, dword [ebp - 0x10]
cmp byte [eax + ecx], 0xa
je 0x41bd79
inc eax
cmp eax, edi
jl 0x41bc33
push 5
pop esi
dec esi
js 0x41bb00
cmp byte [0x5152e8], bl
jle 0x41bb00
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41bb00
cmp dword [ebp - 0x1cc], 0x12
je 0x41bc9a
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x41bc48
cmp byte [ebp + 0x1f], bl
mov byte [ebp + 0xf], bl
mov byte [ebp - 0x19], 1
je 0x41bb00
cmp edi, dword [ebp - 0x20]
je 0x41bb00
cmp byte [ebp - 0x1a], bl
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x5c], ecx
jne 0x41bcf2
cmp dword [ebp - 0xa0], 0x4b0
je 0x41bce5
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x4c]
push edi
push eax
call fcn.00446330
mov eax, dword [ebp - 0x4c]
jmp 0x41bcf2
mov word [eax + edi + 2], bx
mov ecx, dword [ebp - 0x10]
mov word [ecx + edi + 2], bx
cmp byte [ebp + 0x1f], 1
jne 0x41bd0f
mov ecx, dword [ebp - 0x18]
push eax
push eax
push 0x4ebd38
push dword [ebp - 0x58]
push dword [ebp - 0x58]
call fcn.00442010
jmp 0x41bd3c
cmp byte [ebp - 0x1a], bl
je 0x41bd30
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x98]
push dword [ebp - 0x18]
call fcn.0045f260
add esp, 0x18
jmp 0x41bd3c
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebp - 0x58]
call fcn.00444550
cmp dword [ebp - 0xac], ebx
je 0x41bd70
push dword [ebp - 0xac]
lea ecx, [ebp - 0x68]
call fcn.00457400
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push dword [ebp - 0x68]
mov byte [ebp - 4], 0x3a
call fcn.00435957
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x39
call fcn.0043f290
cmp byte [ebp - 0x19], bl
je 0x41bbf9
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x37
call fcn.0043f290
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41be85
cmp dword [ebp - 0x64], 0xffffff9c
je 0x41be85
jmp 0x41be75
mov ecx, dword [ebp - 0x18]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0xa8]
call fcn.00420633
mov ecx, dword [ebp - 0xa8]
dec ecx
cmp ecx, eax
je 0x41be85
cmp dword [ebp - 0xa8], 1
jle 0x41be6d
cmp eax, ebx
jne 0x41be6d
lea eax, [edi + 0x100000]
cmp eax, dword [ebp - 0x2c]
jl 0x41be04
add dword [ebp - 0x2c], 0x100000
mov eax, dword [ebp - 0x2c]
add eax, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.004460b0
push ebx
lea eax, [ebp + 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push 1
add eax, edi
push eax
push dword [ebp - 0xc8]
mov dword [ebp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x41be6d
cmp dword [ebp + 0x1c], ebx
jbe 0x41be6d
add edi, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
mov byte [eax + edi], bl
jmp 0x41be6d
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41be75
cmp dword [ebp - 0x18c], 0x12
je 0x41be75
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x5152e8], bl
jg 0x41be34
mov al, byte [0x5152e8]
cmp al, bl
mov byte [ebp + 0xf], al
jg 0x41bd9f
cmp dword [ebp - 0x64], 0xffffff9c
mov eax, dword [ebp - 0x10]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp - 0x10]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp - 0x10]
mov byte [eax + edi], bl
mov dword [ebp - 0xc4], ebx
je 0x41beb9
cmp byte [ebp + 0xf], bl
jle 0x41beb9
push ebx
lea eax, [ebp - 0x148]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x148]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x13], bl
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x41c0b2
mov eax, dword [ebp - 0x98]
mov ax, word [eax]
xor esi, esi
cmp ax, 0x40
je 0x41bf0d
cmp byte [ebp - 0x52], bl
je 0x41bf0d
cmp ax, 0x26
je 0x41bf07
mov eax, dword [ebp - 0x18]
test byte [eax + 0xb], 0xf
je 0x41bf0d
mov byte [ebp + 0x1b], 1
jmp 0x41bf10
mov byte [ebp + 0x1b], bl
lea ecx, [ebp - 0xb8]
call fcn.00446060
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
cmp byte [ebp + 0x1b], bl
mov byte [ebp - 4], 0x3b
jne 0x41c03e
cmp byte [ebp + 0x17], 2
jne 0x41bf46
mov eax, dword [ebp - 0x10]
mov word [eax + edi], bx
mov esi, dword [ebp - 0x10]
jmp 0x41bfab
cmp byte [ebp + 0x17], 1
lea ecx, [ebp - 0xb8]
jne 0x41bf63
push dword [ebp - 0xa0]
push edi
push dword [ebp - 0x10]
call fcn.00446330
jmp 0x41bfaf
lea eax, [edi + 0x18]
push eax
call fcn.004462b0
lea eax, [edi + 1]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xb0], edi
push dword [ebp - 0xb8]
mov dword [ebp - 0xb4], edi
call fcn.004b0040
mov eax, dword [ebp - 0xb8]
push 0x10
add eax, edi
push ebx
push eax
call fcn.004afe00
lea eax, [ebp - 0xb8]
push ebx
push eax
call fcn.00463e60
add esp, 0x20
cmp esi, ebx
jne 0x41bfb5
mov esi, dword [ebp - 0xb8]
test byte [ebp + 0x13], 4
je 0x41bfe6
push esi
mov dword [ebp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 - 2]
jmp 0x41bfdf
mov ax, word [esi]
cmp ax, 0xd
je 0x41bfda
cmp ax, 0xa
jne 0x41c03e
mov word [esi], bx
dec esi
dec esi
cmp esi, dword [ebp + 0x1c]
jae 0x41bfcb
jmp 0x41c03e
test byte [ebp + 0x13], 1
jne 0x41c005
test byte [ebp + 0x13], 2
je 0x41c03e
jmp 0x41c036
mov ax, word [esi]
cmp ax, 0xd
je 0x41c00a
cmp ax, 0xa
je 0x41c00a
inc esi
inc esi
cmp word [esi], bx
jne 0x41bff4
mov word [esi], bx
jmp 0x41c03e
cmp ax, 0xd
je 0x41c01f
cmp ax, 0xa
je 0x41c01f
inc esi
inc esi
jmp 0x41c036
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.004aee50
add esp, 0xc
mov ax, word [esi]
cmp ax, bx
jne 0x41c00f
mov eax, dword [ebp - 0x98]
cmp word [eax], 0x40
jne 0x41c06b
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0xb8]
push 0x4ebd38
push dword [ebp - 0x24]
push dword [ebp - 0x24]
call fcn.00442010
jmp 0x41c097
cmp byte [ebp + 0x1b], bl
je 0x41c088
push 1
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.0045f260
add esp, 0x18
jmp 0x41c097
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00444550
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x37
call fcn.0043f290
mov eax, dword [ebp - 0xc4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x32c]
push 0x4efae8
push eax
mov word [ebp - 0x32c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
lea eax, [ebp - 0x32c]
push eax
push str.ERRORLEVEL
call fcn.00444550
cmp dword [ebp - 0xbc], ebx
je 0x41c0fc
push 1
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2a
call fcn.0043f290
mov ecx, dword [ebp - 0xdc]
cmp ecx, ebx
je 0x41c128
cmp word [ecx], bx
je 0x41c128
lea eax, [ebp - 0x148]
push dword [eax + 8]
push ecx
call fcn.00415344
pop ecx
pop ecx
lea eax, [ebp - 0x148]
mov eax, dword [eax]
cmp eax, ebx
je 0x41c137
push eax
call esi
lea eax, [ebp - 0x148]
lea edi, [ebp - 0x6c]
mov dword [eax], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x41c14b
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x80]
mov eax, dword [edi]
cmp eax, ebx
je 0x41c159
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x9c]
cmp dword [edi], ebx
je 0x41c168
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x3c]
mov eax, dword [edi]
cmp eax, ebx
je 0x41c176
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xc8]
mov eax, dword [edi]
cmp eax, ebx
je 0x41c187
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xd0]
mov eax, dword [edi]
cmp eax, ebx
je 0x41c198
push eax
call esi
cmp dword [ebp - 0x164], ebx
mov dword [edi], ebx
je 0x41c1aa
push dword [ebp - 0x164]
call esi
lea eax, [ebp - 0x148]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x41c1ba
push eax
call esi
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x148]
push ebx
mov dword [eax + 4], ebx
call fcn.00460e70
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x22
call fcn.0043f290
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x21
call fcn.0043f290
lea ecx, [ebp - 0xa4]
call fcn.004151b3
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x1b
call fcn.0043f290
lea ecx, [ebp - 0x94]
call fcn.004151b3
lea ecx, [ebp - 0x90]
call fcn.004151b3
lea ecx, [ebp - 0x9c]
call fcn.004151b3
lea ecx, [ebp - 0x80]
call fcn.004151b3
lea ecx, [ebp - 0x6c]
call fcn.004151b3
lea ecx, [ebp - 0xd0]
call fcn.004151b3
lea ecx, [ebp - 0x3c]
call fcn.004151b3
lea ecx, [ebp - 0xc8]
call fcn.004151b3
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x12
call fcn.0043f290
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x10
call fcn.0043f290
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0xf
call fcn.0043f290
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xe
call fcn.0043f290
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xd
call fcn.0043f290
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xc
call fcn.0043f290
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0xb
call fcn.0043f290
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xa
call fcn.0043f290
lea ecx, [ebp - 0xbc]
call fcn.004151b3
lea ecx, [ebp - 0x104]
call fcn.004151b3
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 7
call fcn.0043f290
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 6
call fcn.0043f290
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.0043f290
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 4
call fcn.0043f290
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.0043f290
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 2
call fcn.0043f290
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 1
call fcn.0043f290
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], bl
call fcn.0043f290
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.0043f290
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18