Function at 0x406fc0
Capabilities:
Copy file
Create process on windows
Create process suspended
Delete file
Get common file path
Persist via run registry key
Set registry value
Shutdown system
Terminate process

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x40a5bc
push eax
mov eax, 0x3554
mov dword fs:[0], esp
call fcn.0040a1c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3570]
test esi, esi
push edi
je 0x40897b
mov ebx, dword [esp + 0x3578]
test ebx, ebx
je 0x40897b
mov ebp, dword [esp + 0x357c]
test ebp, ebp
je 0x40897b
mov eax, dword [0x40d6cc]
mov ecx, 0x40fc50
push eax
call fcn.00401110
push 0x416824
mov ecx, 0x40fc50
call fcn.00401120
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x18f9]
mov byte [esp + 0x18f8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x20f9]
mov byte [esp + 0x20f8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xad5]
mov byte [esp + 0xad4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20f8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xad4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18f8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20f8]
push ecx
push edx
call fcn.00406b30
add esp, 8
mov dword [esp + 0x10], 1
mov byte [esp + 0x4d4], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x4d5]
lea edx, [esp + 0x4d4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x18f8]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x28], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x29], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + ecx + 0x4d4]
mov cl, byte [esp + ecx + 0x4d3]
cmp cl, 0x5c
je 0x40719c
mov ecx, dword [esp + 0x14]
mov byte [eax], 0x5c
mov byte [esp + ecx + 0x4d5], 0
mov edi, dword [str.update.ini]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x4d4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x22fc]
call fcn.00401e50
mov ebx, dword [sym.imp.MSVCRT.dll_time]
mov dword [esp + 0x356c], 0
mov edi, dword [str.Filename]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xed4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xa
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__itoa]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xed4]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov byte [esp + 0x1af8], al
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x7f
lea edi, [esp + 0x1af9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.Name]
lea ecx, [esp + 0xed4]
push eax
push ecx
lea ecx, [esp + 0x2300]
call fcn.00402850
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [esp + 0x1af8]
mov eax, ecx
mov esi, edi
mov edi, ebp
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
add esp, 4
mov esi, str.NO_FIND
lea eax, [esp + 0x1af8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4072f5
test cl, cl
je 0x4072f1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4072f5
add eax, 2
add esi, 2
test cl, cl
jne 0x4072d1
xor eax, eax
jmp 0x4072fa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4080d7
mov esi, 0x40d91c
lea eax, [esp + 0x1af8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407332
test cl, cl
je 0x40732e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407332
add eax, 2
add esi, 2
test cl, cl
jne 0x40730e
xor eax, eax
jmp 0x407337
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4080d7
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1cf9]
mov byte [esp + 0x1cf8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.Serverpath]
lea ecx, [esp + 0xed4]
push eax
push ecx
lea ecx, [esp + 0x2300]
call fcn.00402850
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [esp + 0x1cf8]
mov eax, ecx
mov esi, edi
mov edi, ebp
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x8d9]
mov byte [esp + 0x8d8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x1cfc]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x8d4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x8d4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.NO_FIND
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40741b
test cl, cl
je 0x407417
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40741b
add eax, 2
add esi, 2
test cl, cl
jne 0x4073f7
xor eax, eax
jmp 0x407420
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407432
mov ecx, 0x80
lea edi, [esp + 0x8d4]
rep stosd dword es:[edi], eax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x10d5]
mov byte [esp + 0x10d4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x8d4]
push 0x3a
push eax
mov dword [esp + 0x38], 0
call fcn.004019e0
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x40748c
lea edi, [esp + 0x8d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
je 0x4074c9
lea edi, [esp + edx + 0x8d6]
jmp 0x4074a5
mov al, byte [esp + 0x8d4]
lea edi, [esp + 0x8d5]
cmp al, 0x5c
je 0x4074a5
lea edi, [esp + 0x8d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10d4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x407501
mov al, byte [esp + ecx + 0x10d3]
cmp al, 0x5c
je 0x407501
cmp al, 0x20
je 0x407501
mov byte [esp + ecx + 0x10d4], 0x5c
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x10d5], 0
lea edx, [esp + 0x30]
lea eax, [esp + 0x1af8]
push edx
lea ecx, [esp + 0x10d8]
push eax
lea edx, [esp + 0xedc]
push ecx
lea eax, [esp + 0x1904]
push edx
lea ecx, [esp + 0x2108]
push eax
push ecx
call fcn.00405850
add esp, 0x18
test al, al
je 0x408009
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x6d5]
mov byte [esp + 0x6d4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x40d91c
lea eax, [esp + 0xad4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407589
test cl, cl
je 0x407585
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407589
add eax, 2
add esi, 2
test cl, cl
jne 0x407565
xor eax, eax
jmp 0x40758e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4075f6
mov esi, 0x40d500
lea eax, [esp + 0xad4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4075c2
test cl, cl
je 0x4075be
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4075c2
add eax, 2
add esi, 2
test cl, cl
jne 0x40759e
xor eax, eax
jmp 0x4075c7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4075f6
lea edi, [esp + 0xad4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x6d4]
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x6d4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ebp
cmp byte [ecx + ebp], 0x5c
je 0x407625
mov byte [esp + ecx + 0x6d4], 0x5c
mov byte [esp + ecx + 0x6d5], 0
mov esi, 0x40d91c
lea eax, [esp + 0x8d4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407655
test cl, cl
je 0x407651
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407655
add eax, 2
add esi, 2
test cl, cl
jne 0x407631
xor eax, eax
jmp 0x40765a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4076ca
mov esi, 0x40d500
lea eax, [esp + 0x8d4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40768e
test cl, cl
je 0x40768a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40768e
add eax, 2
add esi, 2
test cl, cl
jne 0x40766a
xor eax, eax
jmp 0x407693
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4076ca
lea edi, [esp + 0x8d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x6d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp]
cmp al, 0x5c
je 0x4076f6
cmp al, 0x20
je 0x4076f6
mov byte [esp + ecx + 0x6d4], 0x5c
mov byte [esp + ecx + 0x6d5], 0
lea edi, [esp + 0x1af8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x6d4], 0x5c
jne 0x40775e
lea edi, [esp + 0x6d5]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40fc50
call fcn.004011a0
test eax, eax
jne 0x408958
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x6d4]
push ecx
push edx
mov ecx, 0x40fc50
call fcn.00401250
lea edi, [esp + 0x20f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x4d3], 0x5c
je 0x4077dd
mov byte [esp + ecx + 0x4d4], 0x5c
mov byte [esp + ecx + 0x4d5], 0
lea edi, [esp + 0x10d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x4d4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00409d60
lea edi, [esp + 0x1afc]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x4d4]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x4d4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40fc50
call fcn.00401290
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x14f9]
mov byte [esp + 0x14f8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x18f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
cmp byte [esp + ecx + 0x14f7], 0x5c
je 0x4078da
mov byte [esp + ecx + 0x14f8], 0x5c
mov byte [esp + ecx + 0x14f9], 0
mov edi, dword [str.updatelog.ini]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x2b64]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x7f
lea edi, [esp + 0x2b65]
mov byte [esp + 0x2b64], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x14f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14f8]
push ecx
lea ecx, [esp + 0x12d8]
call fcn.00401e50
mov eax, dword [str.Name]
lea edx, [esp + 0x1af8]
push edx
lea ecx, [esp + 0xed8]
push eax
push ecx
lea ecx, [esp + 0x12e0]
mov byte [esp + 0x3578], 2
call fcn.004028a0
mov edx, dword [str.Downsize]
push 0x3e8
lea eax, [esp + 0xed8]
push edx
push eax
lea ecx, [esp + 0x12e0]
call fcn.00402940
mov ecx, dword [str.Size]
push 0x3e8
lea edx, [esp + 0xed8]
push ecx
push edx
lea ecx, [esp + 0x12e0]
call fcn.00402940
lea eax, [esp + 0x38]
push eax
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_localtime]
lea ecx, [esp + 0x3c]
push ecx
call esi
mov edx, eax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x316d]
mov byte [esp + 0x316c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push eax
mov eax, dword [edx + 8]
push ecx
mov ecx, dword [edx + 0xc]
push eax
mov eax, dword [edx + 0x10]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
mov ecx, dword [edx + 0x14]
push eax
add ecx, 0x76c
lea edx, [esp + 0x3180]
push ecx
push str._4d__2d__2d__2d:_2d:_2d
push edx
call ebp
mov ecx, dword [str.Starttime]
add esp, 0x28
lea eax, [esp + 0x3164]
lea edx, [esp + 0xed4]
push eax
push ecx
push edx
lea ecx, [esp + 0x12e0]
call fcn.004028a0
mov eax, dword [str.]
mov ecx, dword [str.Endtime]
push eax
lea edx, [esp + 0xed8]
push ecx
push edx
lea ecx, [esp + 0x12e0]
call fcn.004028a0
push 0
lea ecx, [esp + 0x12d8]
call fcn.00402060
lea ecx, [esp + 0x12d4]
call fcn.00402000
mov ecx, 0x40fc50
call fcn.004012d0
cmp eax, 2
je 0x408012
test eax, eax
mov ecx, 0x40fc50
jne 0x40803d
call fcn.004012c0
lea eax, [esp + 0x34]
push eax
call ebx
lea ecx, [esp + 0x38]
push ecx
call esi
mov edx, eax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x2d6d]
mov byte [esp + 0x2d6c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push eax
mov eax, dword [edx + 8]
push ecx
mov ecx, dword [edx + 0xc]
push eax
mov eax, dword [edx + 0x10]
push ecx
mov ecx, dword [edx + 0x14]
add ecx, 0x76c
push eax
push ecx
lea edx, [esp + 0x2d84]
push 0x40d7c8
push edx
call ebp
add esp, 0x28
lea ecx, [esp + 0x251c]
call fcn.00401e00
lea eax, [esp + 0x2b64]
lea ecx, [esp + 0x251c]
push eax
mov byte [esp + 0x3570], 3
call fcn.00401ef0
test al, al
je 0x407b99
mov edx, dword [str.Endtime]
lea ecx, [esp + 0x2d64]
push ecx
lea eax, [esp + 0xed8]
push edx
push eax
lea ecx, [esp + 0x2528]
call fcn.004028a0
mov ecx, dword [str.EndMark]
push 0x40d7c4
lea edx, [esp + 0xed8]
push ecx
push edx
lea ecx, [esp + 0x2528]
call fcn.004028a0
push 0
lea ecx, [esp + 0x2520]
call fcn.00402060
lea ecx, [esp + 0x251c]
call fcn.00402000
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x2f65]
mov byte [esp + 0x2f64], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x1af8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2f64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2f64]
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
mov esi, dword [str.client.exe]
add esp, 4
mov ebx, eax
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407c1c
test cl, cl
je 0x407c18
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407c1c
add eax, 2
add esi, 2
test cl, cl
jne 0x407bf8
xor eax, eax
jmp 0x407c21
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407e3b
mov ecx, 0x7f
lea edi, [esp + 0x2d5]
mov byte [esp + 0x2d4], al
lea edx, [esp + 0x2d4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x18f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x2d3], 0x5c
je 0x407c97
mov byte [esp + ecx + 0x2d4], 0x5c
mov byte [esp + ecx + 0x2d5], 0
mov edi, dword [str.auxprocess.exe]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40d778
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xcd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x7f
lea edi, [esp + 0xcd9]
mov byte [esp + 0xcd8], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, 0x40d7c0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xcd8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xcd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d7c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x2d8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
test eax, eax
jne 0x408063
mov ecx, 0x7f
lea edi, [esp + 0x91]
mov byte [esp + 0x90], al
lea edx, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x20f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x90]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x8f], 0x5c
je 0x407df8
mov byte [esp + ecx + 0x90], 0x5c
mov byte [esp + ecx + 0x91], 0
mov edi, dword [str.client.exe]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x90]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x90]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov ebp, dword [str.auxprocess.exe]
mov eax, ebx
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x407e6d
test cl, cl
je 0x407e69
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x407e6d
add eax, 2
add esi, 2
test cl, cl
jne 0x407e45
xor eax, eax
jmp 0x407e72
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407fdb
mov ecx, 0x7f
lea edi, [esp + 0x1ef9]
mov byte [esp + 0x1ef8], al
lea edx, [esp + 0x1ef8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x18f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1ef8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x1ef7], 0x5c
je 0x407ee8
mov byte [esp + ecx + 0x1ef8], 0x5c
mov byte [esp + ecx + 0x1ef9], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x16f9]
mov byte [esp + 0x16f8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x20f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x16f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x16f7], 0x5c
je 0x407f59
mov byte [esp + ecx + 0x16f8], 0x5c
mov byte [esp + ecx + 0x16f9], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1efc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1efc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1700]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x16f8]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea ecx, [esp + 0x251c]
mov byte [esp + 0x356c], 2
call fcn.00401e90
lea ecx, [esp + 0x12d4]
mov byte [esp + 0x356c], 0
call fcn.00401e90
mov ebx, dword [sym.imp.MSVCRT.dll_time]
inc dword [esp + 0x10]
jmp 0x4071f3
mov ecx, 0x40fc50
call fcn.004012c0
push 0x41661c
call fcn.00409f30
add esp, 4
mov byte [esp + 0x356c], 0
lea ecx, [esp + 0x12d4]
jmp 0x408953
call fcn.004012c0
push 0x4165b4
call fcn.00409eb0
add esp, 4
mov byte [esp + 0x356c], 0
lea ecx, [esp + 0x12d4]
jmp 0x408953
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x414280
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea ecx, [esp + 0x22f8]
call fcn.00402000
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x4c]
lea edx, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push edx
push eax
push eax
push 0x8000000
push eax
push eax
mov dword [esp + 0x40], eax
push eax
lea eax, [esp + 0xcf4]
push eax
push 0
mov dword [esp + 0x74], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [esp + 0x22f8]
call fcn.00402000
push 0x40fbe8
call fcn.00409f30
mov ecx, dword [str.installrun.ini]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
lea edx, [esp + 0x1900]
lea eax, [esp + 0x2100]
push edx
push eax
mov dword [0x41681c], 0
call fcn.004060e0
push 0x4164ec
call fcn.00409f30
mov eax, dword [0x416818]
add esp, 0x14
test eax, eax
jle 0x408370
mov eax, dword [0x40d7b8]
mov ecx, dword [str.bootupdate.exe]
mov edx, dword [0x40d7b4]
mov dword [esp + 0x44], eax
mov eax, dword [str.bootupdate.ini]
mov dword [esp + 0x3c], ecx
mov cx, word [0x40d7bc]
mov dword [esp + 0x40], edx
mov dl, byte [0x40d7be]
mov dword [esp + 0x18], eax
mov ax, word [0x40d2fc]
mov word [esp + 0x48], cx
mov ecx, dword [0x40d2f4]
mov byte [esp + 0x4a], dl
mov edx, dword [0x40d2f8]
mov word [esp + 0x24], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov cl, byte [0x40d2fe]
mov dword [esp + 0x20], edx
mov dx, word [0x40d500]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion_run
push 0x80000002
mov byte [esp + 0x32], cl
mov word [esp + 0x20], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4081d2
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion_run
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 0x2d4]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
lea edx, [esp + 0x2d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x90]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x90]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x90]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x90]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.ksgupdate
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x90]
push 0
lea eax, [esp + 0x40]
push edx
push eax
call ebx
lea edi, [esp + 0x2d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x90]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x90]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x94]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov dword [0x416818], 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x416484]
push 0x24
push 0x40f9f0
push 0x416488
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x408958
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0x414280
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [0x41681c]
test eax, eax
jle 0x408958
mov ecx, dword [str.installrun.ini]
mov dword [0x41681c], 0
push ecx
lea ecx, [esp + 0x2944]
call fcn.00401e50
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x3365]
mov byte [esp + 0x3364], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x91]
mov byte [esp + 0x90], 0
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [esp + 0x356c], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x44
mov edi, dword [str.Filename]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x90]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xa
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x41681c]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x3368]
mov dword [0x41681c], eax
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__itoa]
lea edi, [esp + 0x3370]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x90]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov byte [esp + 0x2d4], al
and ecx, 3
mov byte [esp + 0x1cf8], 0
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x7f
lea edi, [esp + 0x2d5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1cf9]
mov byte [esp + 0x2740], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x2741]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.Name]
lea ecx, [esp + 0x90]
push eax
push ecx
lea ecx, [esp + 0x2948]
call fcn.00402850
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x2d4]
sub edi, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
mov ecx, dword [str.Param]
add esp, 4
lea edx, [esp + 0x90]
push ecx
push edx
lea ecx, [esp + 0x2948]
call fcn.00402850
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x1cf8]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
mov ecx, dword [str.runmode]
add esp, 4
lea edx, [esp + 0x90]
push ecx
push edx
lea ecx, [esp + 0x2948]
call fcn.00402850
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x2740]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
add esp, 4
mov esi, str.NO_FIND
lea eax, [esp + 0x2d4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4085d2
test cl, cl
je 0x4085ce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4085d2
add eax, 2
add esi, 2
test cl, cl
jne 0x4085ae
xor eax, eax
jmp 0x4085d7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40892e
mov esi, 0x40d91c
lea eax, [esp + 0x2d4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40860f
test cl, cl
je 0x40860b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40860f
add eax, 2
add esi, 2
test cl, cl
jne 0x4085eb
xor eax, eax
jmp 0x408614
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40892e
mov esi, 0x40d7a0
lea eax, [esp + 0x2740]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40864c
test cl, cl
je 0x408648
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40864c
add eax, 2
add esi, 2
test cl, cl
jne 0x408628
xor eax, eax
jmp 0x408651
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408763
mov ecx, 0x11
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov ecx, 0x7f
lea edi, [esp + 0xcd5]
mov byte [esp + 0xcd4], al
lea edx, [esp + 0xcd4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, 0x40d7c0
xor eax, eax
mov dword [esp + 0x4c], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0xcd4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x2d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xcd4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d79c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xcd4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1cf8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xcf0]
push 0
push edx
push 0
call ebp
jmp 0x4083e3
mov esi, 0x40d798
lea eax, [esp + 0x2740]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x408793
test cl, cl
je 0x40878f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x408793
add eax, 2
add esi, 2
test cl, cl
jne 0x40876f
xor eax, eax
jmp 0x408798
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4088dc
mov ecx, 0x11
lea edi, [esp + 0x290]
rep stosd dword es:[edi], eax
mov ecx, 0x7f
lea edi, [esp + 0xad5]
mov byte [esp + 0xad4], al
lea edx, [esp + 0xad4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, 0x40d7c0
xor eax, eax
mov dword [esp + 0x290], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0xad4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x2d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xad4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d79c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xad4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1cf8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x290]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xaf0]
push 0
push edx
push 0
call ebp
test eax, eax
je 0x4083e3
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
jmp 0x4083e3
mov esi, 0x40d794
lea eax, [esp + 0x2740]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40890c
test cl, cl
je 0x408908
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40890c
add eax, 2
add esi, 2
test cl, cl
jne 0x4088e8
xor eax, eax
jmp 0x408911
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4083e3
lea eax, [esp + 0x2d4]
push eax
call fcn.00401990
add esp, 4
jmp 0x4083e3
lea ecx, [esp + 0x2940]
call fcn.00402000
mov dword [0x41681c], 0
mov byte [esp + 0x356c], 0
lea ecx, [esp + 0x2940]
call fcn.00401e90
lea ecx, [esp + 0x22f8]
call fcn.00402000
lea ecx, [esp + 0x22f8]
mov dword [esp + 0x356c], 0xffffffff
call fcn.00401e90
mov ecx, dword [esp + 0x3564]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3560
ret