Function at 0x41b3b0
Capabilities:
Check for time delay via gettickcount
Create directory
Get number of processors
Set file attributes
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x4519f7
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x230]
mov dword [esp + 0x60], ebp
push ebp
mov dword [esp + 0x22c], 6
call fcn.00406f40
lea eax, [ebp + 0x18]
push eax
mov byte [esp + 0x22c], 7
call fcn.00431e30
lea edi, [ebp + 0xe0]
push edi
mov byte [esp + 0x22c], 8
call fcn.0042b5e0
xor ebx, ebx
mov dword [edi + 0x34], 0xf
mov dword [edi + 0x30], ebx
mov byte [edi + 0x20], bl
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
lea esi, [ebp + 0x138]
call fcn.004044e0
mov esi, 0xf
mov dword [ebp + 0x198], esi
mov dword [ebp + 0x194], ebx
mov byte [ebp + 0x184], bl
mov dword [ebp + 0x1b4], esi
mov dword [ebp + 0x1b0], ebx
mov byte [ebp + 0x1a0], bl
mov dword [ebp + 0x1d0], esi
mov dword [ebp + 0x1cc], ebx
mov byte [ebp + 0x1bc], bl
mov dword [ebp + 0x1f0], esi
mov dword [ebp + 0x1ec], ebx
mov byte [ebp + 0x1dc], bl
mov dword [ebp + 0x210], esi
mov dword [ebp + 0x20c], ebx
mov byte [ebp + 0x1fc], bl
lea ecx, [ebp + 0x214]
push ecx
mov byte [esp + 0x22c], 0xf
call fcn.0042b5e0
lea edx, [ebp + 0x22c]
push edx
mov byte [esp + 0x22c], 0x10
call fcn.0042b5e0
mov dword [ebp + 0x25c], esi
mov dword [ebp + 0x258], ebx
mov byte [ebp + 0x248], bl
mov dword [ebp + 0x278], esi
mov dword [ebp + 0x274], ebx
mov byte [ebp + 0x264], bl
mov dword [ebp + 0x2a0], esi
mov dword [ebp + 0x29c], ebx
mov byte [ebp + 0x28c], bl
mov dword [ebp + 0x2bc], esi
mov dword [ebp + 0x2b8], ebx
mov byte [ebp + 0x2a8], bl
lea eax, [ebp + 0x2c0]
push eax
mov byte [esp + 0x22c], 0x15
call fcn.0042b5e0
lea eax, [ebp + 0x2d8]
push eax
mov byte [esp + 0x22c], 0x16
call fcn.0042b5e0
lea ecx, [ebp + 0x2f0]
push ecx
mov byte [esp + 0x22c], 0x17
call fcn.0042b5e0
lea esi, [ebp + 0x30c]
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [ebp + 0x340], eax
mov dword [ebp + 0x33c], ebx
mov byte [ebp + 0x32c], bl
mov dword [ebp + 0x35c], eax
mov dword [ebp + 0x358], ebx
mov byte [ebp + 0x348], bl
mov dword [ebp + 0x378], eax
mov dword [ebp + 0x374], ebx
mov byte [ebp + 0x364], bl
mov dword [ebp + 0x394], eax
mov dword [ebp + 0x390], ebx
mov byte [ebp + 0x380], bl
push ebx
mov byte [esp + 0x22c], 0x1d
call fcn.0043af41
add esp, 4
cmp dword [0x4628e0], 3
jne 0x41b5e1
call fcn.0041d3f0
push ebp
call fcn.0041d580
call fcn.00417bd0
sub eax, 1
jne 0x41b5fb
call fcn.0041a8a0
call fcn.00417c40
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x23c]
push edx
lea ecx, [ebp + 0x180]
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x258]
push eax
mov ecx, esi
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x274]
push ecx
lea ecx, [ebp + 0x328]
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x290]
push edx
lea ecx, [ebp + 0x344]
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2ac]
push eax
lea ecx, [ebp + 0x360]
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x2c8]
push ecx
lea ecx, [ebp + 0x37c]
call fcn.00402be0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x2e4]
push edx
lea ecx, [ebp + 0x2a4]
call fcn.00402be0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push esi
mov byte [ecx + 4], bl
call fcn.00402be0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x260], 0x1e
mov dword [esp + 0x94], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x360]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x27c], 0x1f
mov dword [esp + 0x74], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x344]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
mov byte [esp + 0x27c], 0x20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x8c], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x328]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
mov ecx, edi
mov byte [esp + 0x298], 0x1d
call fcn.00437180
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
lea ecx, [esp + 0x18]
cmp eax, ecx
jle 0x41b768
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov eax, 1
jmp 0x41b779
push 0xe
call esi
xor ecx, ecx
lea edx, [esp + 0x18]
cmp eax, edx
setg cl
mov eax, ecx
sub eax, 1
jne 0x41b795
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00417cb0
mov esi, ebp
call fcn.0041d910
call fcn.00417b30
test eax, eax
je 0x41b7aa
call fcn.00417d20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41b7d7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 1
jmp 0x41b7d9
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x27
jle 0x41b805
push 0x27
call edi
call fcn.00431550
call fcn.0041ab40
call fcn.0041d980
call fcn.0041da00
push 0x103
lea ecx, [esp + 0x119]
push ebx
push ecx
mov byte [esp + 0x120], bl
call fcn.00440440
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41b841
sub eax, 2
je 0x41b841
sub eax, 4
jne 0x41b855
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00417df0
call fcn.00417ea0
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jle 0x41b878
mov edx, 1
jmp 0x41b87d
mov eax, esi
cdq
idiv esi
mov eax, 0x4c8f8d29
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x6b
jle 0x41b8a1
push 0x6b
call edi
call fcn.00401350
call fcn.00401350
push 0x104
lea ecx, [esp + 0x118]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b9e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x28]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x40], esp
cmp eax, 0x10
jb 0x41b8ed
mov ecx, dword [edi]
jmp 0x41b8ef
mov ecx, edi
cmp ecx, str._WRUH
ja 0x41b92a
cmp eax, 0x10
jb 0x41b900
mov ecx, dword [edi]
jmp 0x41b902
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str._WRUH
jbe 0x41b92a
cmp eax, 0x10
jb 0x41b916
mov edi, dword [edi]
push 0x21
mov eax, str._WRUH
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x41b96d
cmp eax, 0x21
jae 0x41b93c
mov ecx, dword [esi + 0x14]
push ecx
push 0x21
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41b948
mov eax, dword [edi]
jmp 0x41b94a
mov eax, edi
push 0x21
push str._WRUH
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x21
jb 0x41b96a
mov edi, dword [edi]
mov byte [edi + 0x21], bl
lea esi, [esp + 0xe0]
call fcn.004014e0
mov byte [esp + 0x230], 0x21
call fcn.00401900
mov esi, 0x10
mov byte [esp + 0x22c], 0x22
cmp dword [eax + 0x18], esi
jb 0x41b99d
mov eax, dword [eax + 4]
jmp 0x41b9a0
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x3c], esi
jb 0x41b9bf
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
jmp 0x41ba0d
lea eax, [esp + 0x114]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41b9f0
sub eax, edx
push eax
lea eax, [esp + 0x118]
push eax
lea ecx, [ebp + 0x244]
call fcn.00402f50
push ebp
call fcn.0041dbc0
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jg 0x41ba38
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x41ba42
call fcn.00417f50
call fcn.00431550
mov edi, ebp
call fcn.0041de90
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41ba60
sub eax, 2
je 0x41ba60
sub eax, 4
jne 0x41ba7e
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.0041ab40
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
cmp esi, ebx
jge 0x41bbb3
lea edx, [esp + 0x24]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x41baaf
mov ecx, dword [edi]
jmp 0x41bab1
mov ecx, edi
cmp ecx, 0x456a34
ja 0x41baec
cmp eax, 0x10
jb 0x41bac2
mov ecx, dword [edi]
jmp 0x41bac4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456a34
jbe 0x41baec
cmp eax, 0x10
jb 0x41bad8
mov edi, dword [edi]
push 0x17
mov eax, 0x456a34
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x41bb2f
cmp eax, 0x17
jae 0x41bafe
mov ecx, dword [esi + 0x14]
push ecx
push 0x17
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41bb0a
mov eax, dword [edi]
jmp 0x41bb0c
mov eax, edi
push 0x17
push 0x456a34
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x17
jb 0x41bb2c
mov edi, dword [edi]
mov byte [edi + 0x17], bl
lea esi, [esp + 0xdc]
call fcn.004014e0
mov byte [esp + 0x22c], 0x23
call fcn.00401900
mov esi, 0x10
mov byte [esp + 0x228], 0x24
cmp dword [eax + 0x18], esi
jb 0x41bb5f
mov eax, dword [eax + 4]
jmp 0x41bb62
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0xc
cmp dword [esp + 0x3c], esi
jb 0x41bb81
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
call fcn.00417740
test eax, eax
je 0x41bbb3
call fcn.0041ab40
push ebp
call fcn.0041df50
push ebx
call fcn.0043af41
add esp, 4
push ebp
call fcn.0041f870
push ebp
call fcn.00420290
call fcn.00430ea0
test eax, eax
je 0x41bbdc
call fcn.00417fc0
call fcn.00430df0
test eax, eax
je 0x41bbea
call fcn.00418050
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x45460f
mov byte [ecx + 4], bl
call fcn.00402f50
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov byte [esp + 0x268], 0x25
mov esi, esp
lea eax, [esi + 4]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov dword [esp + 0x58], eax
mov edx, eax
mov byte [eax], bl
mov eax, dword [esi + 0x18]
mov edi, 0x10
mov dword [esp + 0x60], esp
cmp eax, edi
jb 0x41bc44
mov ecx, dword [edx]
jmp 0x41bc48
mov ecx, dword [esp + 0x58]
cmp ecx, 0x456a50
ja 0x41bc89
cmp eax, edi
jb 0x41bc58
mov ecx, dword [edx]
jmp 0x41bc5a
mov ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456a50
jbe 0x41bc85
cmp eax, edi
mov eax, dword [esp + 0x58]
jb 0x41bc71
mov eax, dword [eax]
push 0x45
mov ecx, 0x456a50
sub ecx, eax
push ecx
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x41bcd2
mov edx, dword [esp + 0x58]
cmp eax, 0x45
jae 0x41bc9f
mov edx, dword [esi + 0x14]
push edx
push 0x45
mov ecx, esi
call fcn.00403340
mov edx, dword [esp + 0x58]
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jb 0x41bcaa
mov eax, dword [edx]
jmp 0x41bcac
mov eax, edx
push 0x45
push 0x456a50
push ecx
push eax
call fcn.00439ca9
mov eax, dword [esp + 0x68]
add esp, 0x10
mov dword [esi + 0x14], 0x45
cmp dword [esi + 0x18], edi
jb 0x41bccf
mov eax, dword [eax]
mov byte [eax + 0x45], bl
lea esi, [esp + 0xfc]
call fcn.004014e0
mov byte [esp + 0x24c], 0x26
call fcn.00401900
mov byte [esp + 0x248], 0x27
cmp dword [eax + 0x18], edi
jb 0x41bcfd
mov ecx, dword [eax + 4]
jmp 0x41bd00
lea ecx, [eax + 4]
sub esp, 0x1c
mov esi, esp
mov eax, ecx
lea edx, [eax + 1]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x5c], esp
mov byte [esi + 4], bl
mov dword [esp + 0x54], edx
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41bd20
sub eax, dword [esp + 0x54]
push eax
push ecx
mov ecx, esi
call fcn.00402f50
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x29
call fcn.004207b0
and eax, 0x80004005
mov dword [esp + 0x18], eax
cmp dword [esp + 0x3c], edi
jb 0x41bd63
mov eax, dword [esp + 0x28]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x45460f
mov byte [ecx + 4], bl
call fcn.00402f50
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov byte [esp + 0x268], 0x2a
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x31
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.ev1
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xfc]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x24c], 0x2b
call fcn.00401760
mov byte [esp + 0x248], 0x2c
cmp dword [eax + 0x18], edi
jb 0x41be02
mov eax, dword [eax + 4]
jmp 0x41be05
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x2e
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x3c], edi
jb 0x41be3e
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x45460f
call fcn.00402930
sub esp, 0x1c
mov byte [esp + 0x264], 0x2f
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x45
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.SOFTWA_0
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xf8]
call fcn.004014e0
lea edx, [esp + 0x44]
mov ecx, eax
mov byte [esp + 0x248], 0x30
call fcn.00401a80
mov byte [esp + 0x248], 0x31
cmp dword [eax + 0x18], edi
jb 0x41bed1
mov eax, dword [eax + 4]
jmp 0x41bed4
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x33
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x3c], edi
jb 0x41bf0d
mov eax, dword [esp + 0x28]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x45460f
call fcn.00402930
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov byte [esp + 0x268], 0x34
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x31
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456b18
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xfc]
call fcn.004014e0
mov byte [esp + 0x24c], 0x35
call fcn.004015b0
mov byte [esp + 0x248], 0x36
cmp dword [eax + 0x18], edi
jb 0x41bf9f
mov eax, dword [eax + 4]
jmp 0x41bfa2
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x38
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x3c], edi
jb 0x41bfdb
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push 1
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 4
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456b4c
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x88]
call fcn.004014e0
mov byte [esp + 0x230], 0x39
call fcn.004016a0
mov byte [esp + 0x22c], 0x3a
cmp dword [eax + 0x18], edi
jb 0x41c053
mov eax, dword [eax + 4]
jmp 0x41c056
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00402930
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov byte [esp + 0x268], 0x3b
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x38
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456b54
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xfc]
call fcn.004014e0
mov byte [esp + 0x24c], 0x3c
call fcn.00401900
mov byte [esp + 0x248], 0x3d
cmp dword [eax + 0x18], edi
jb 0x41c0bf
mov eax, dword [eax + 4]
jmp 0x41c0c2
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x3f
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x3c], edi
jb 0x41c0fb
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004037a0
cmp dword [esp + 0x58], edi
jb 0x41c12a
mov eax, dword [esp + 0x44]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push 1
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 3
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456b90
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xe0]
call fcn.004014e0
mov byte [esp + 0x230], 0x40
call fcn.004015b0
mov byte [esp + 0x22c], 0x41
cmp dword [eax + 0x18], edi
jb 0x41c19f
mov eax, dword [eax + 4]
jmp 0x41c1a2
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00402930
sub esp, 0x1c
mov byte [esp + 0x264], 0x42
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x38
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.SOFT_6_2___
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xa0]
call fcn.004014e0
lea edx, [esp + 0x60]
mov ecx, eax
mov byte [esp + 0x248], 0x43
call fcn.00401a80
mov byte [esp + 0x248], 0x44
cmp dword [eax + 0x18], edi
jb 0x41c20c
mov eax, dword [eax + 4]
jmp 0x41c20f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, closesocket
mov byte [esp + 0x268], 0x46
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x58], edi
jb 0x41c248
mov edx, dword [esp + 0x44]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004037a0
cmp dword [esp + 0x3c], edi
jb 0x41c274
mov eax, dword [esp + 0x28]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x45460f
call fcn.00402930
sub esp, 0x1c
mov byte [esp + 0x264], 0x47
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x4f
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str..DEFAUL:_
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xa0]
call fcn.004014e0
lea edx, [esp + 0x60]
mov ecx, eax
mov byte [esp + 0x248], 0x48
call fcn.00401a80
mov byte [esp + 0x248], 0x49
cmp dword [eax + 0x18], edi
jb 0x41c307
mov eax, dword [eax + 4]
jmp 0x41c30a
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, reloc.WS2_32.dll_closesocket
mov byte [esp + 0x268], 0x4b
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x58], edi
jb 0x41c343
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
call fcn.00417b90
test eax, eax
je 0x41c372
call fcn.00418100
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x45460f
call fcn.00402930
lea edx, [esp + 0x60]
push edx
sub esp, 0x1c
mov byte [esp + 0x268], 0x4c
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x3b
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456c20
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xa4]
call fcn.004014e0
mov byte [esp + 0x24c], 0x4d
call fcn.004015b0
mov byte [esp + 0x248], 0x4e
cmp dword [eax + 0x18], edi
jb 0x41c3e0
mov eax, dword [eax + 4]
jmp 0x41c3e3
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00402930
push ebp
mov ecx, reloc.WS2_32.dll_closesocket
mov byte [esp + 0x268], 0x50
call fcn.004207b0
and dword [esp + 0x18], eax
cmp dword [esp + 0x58], edi
jb 0x41c41c
mov eax, dword [esp + 0x44]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
cmp dword [esp + 0x18], ebx
jge 0x41c6d7
lea ecx, [esp + 0x40]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x34
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456c5c
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x84]
call fcn.004014e0
mov byte [esp + 0x22c], 0x51
call fcn.00401900
mov byte [esp + 0x228], 0x52
cmp dword [eax + 0x18], edi
jb 0x41c499
mov eax, dword [eax + 4]
jmp 0x41c49c
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0xc
cmp dword [esp + 0x58], edi
jb 0x41c4bb
mov edx, dword [esp + 0x44]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x244]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
sub esp, 0x1c
mov byte [esp + 0x260], 0x53
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xb
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x456c94
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xf4]
call fcn.004014e0
lea edx, [esp + 0x40]
mov ecx, eax
mov byte [esp + 0x244], 0x54
call fcn.00401a80
mov byte [esp + 0x244], 0x55
cmp dword [eax + 0x18], edi
jb 0x41c559
mov eax, dword [eax + 4]
jmp 0x41c55c
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00402930
lea eax, [esp + 0x78]
push eax
sub esp, 0x1c
mov byte [esp + 0x280], 0x56
mov ecx, esp
mov dword [esp + 0xb4], esp
push 0x31
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456b18
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0xbc]
call fcn.004014e0
mov byte [esp + 0x264], 0x57
call fcn.004015b0
mov byte [esp + 0x260], 0x58
cmp dword [eax + 0x18], edi
jb 0x41c5c8
mov eax, dword [eax + 4]
jmp 0x41c5cb
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.00402930
push ebp
mov byte [esp + 0x280], 0x5c
call fcn.0042abf0
mov dword [esp + 0x18], eax
cmp dword [esp + 0x58], edi
jb 0x41c602
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004037a0
cmp dword [esp + 0x3c], edi
jb 0x41c62e
mov edx, dword [esp + 0x28]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xbc]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
cmp dword [esp + 0x18], ebx
jge 0x41c6d7
lea eax, [esp + 0x40]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x26
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456ca0
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x84]
call fcn.004014e0
mov byte [esp + 0x22c], 0x5d
call fcn.004016a0
mov byte [esp + 0x228], 0x5e
cmp dword [eax + 0x18], edi
jb 0x41c6ae
mov eax, dword [eax + 4]
jmp 0x41c6b1
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0xc
lea ecx, [esp + 0x40]
call fcn.004029a0
lea esi, [esp + 0x64]
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
mov ecx, dword [ebp + 0x2e8]
sub ecx, dword [ebp + 0x2e4]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x41c791
lea edx, [esp + 0x40]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x21
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456cc8
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x84]
call fcn.004014e0
mov byte [esp + 0x22c], 0x5f
call fcn.00401900
mov byte [esp + 0x228], 0x60
cmp dword [eax + 0x18], edi
jb 0x41c74e
mov eax, dword [eax + 4]
jmp 0x41c751
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0xc
cmp dword [esp + 0x58], edi
jb 0x41c770
mov eax, dword [esp + 0x44]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x19c]
lea esi, [ebp + 0x260]
push eax
mov ecx, esi
call fcn.00402be0
mov eax, dword [ebp + 0x274]
cmp eax, ebx
je 0x41c7ef
dec eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x14], eax
ja 0x41c7c5
call fcn.00438c11
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x18], edi
jb 0x41c7cf
mov esi, dword [esi + 4]
jmp 0x41c7d2
add esi, 4
cmp byte [eax + esi], 0x5c
je 0x41c7ef
push 0x5c
mov eax, 1
lea edi, [ebp + 0x260]
call fcn.00412960
mov edi, 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 8
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456cec
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x80]
call fcn.004014e0
lea edx, [esp + 0x40]
mov ecx, eax
mov byte [esp + 0x228], 0x61
call fcn.00401a80
mov byte [esp + 0x228], 0x62
cmp dword [eax + 0x18], edi
jb 0x41c842
mov edx, dword [eax + 4]
jmp 0x41c845
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41c850
sub eax, esi
push eax
push edx
lea eax, [ebp + 0x260]
call fcn.00405840
cmp dword [esp + 0x58], edi
jb 0x41c879
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x64]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x260]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
call fcn.0041ddd0
mov esi, eax
call fcn.00436780
mov ecx, eax
mov eax, 0x62204b21
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x14df
jle 0x41c8fa
push 0x14df
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00418130
call fcn.00419d50
cmp esi, ebx
jge 0x41c9d8
cmp dword [ebp + 0x278], edi
jb 0x41c912
mov eax, dword [ebp + 0x264]
jmp 0x41c918
lea eax, [ebp + 0x264]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41c954
cmp dword [ebp + 0x278], edi
jb 0x41c940
mov eax, dword [ebp + 0x264]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41c9d8
lea eax, [ebp + 0x264]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41c9d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x24
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x456cf8
mov byte [ecx + 4], bl
call fcn.00402f50
lea esi, [esp + 0x88]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x230], 0x63
call fcn.00401760
mov byte [esp + 0x22c], 0x64
cmp dword [eax + 0x18], edi
jb 0x41c9af
mov eax, dword [eax + 4]
jmp 0x41c9b2
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.004029a0
lea esi, [esp + 0x64]
mov byte [esp + 0x228], 0x1d
call fcn.004037a0
push 1
push 0x76c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x328]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x268], 0x65
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1d8]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
lea ecx, [ebp + 0x138]
mov byte [esp + 0x268], 0x1d
call fcn.004045b0
cmp dword [esp + 0x24c], edi
jb 0x41ca5a
mov edx, dword [esp + 0x238]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x24c], esi
mov dword [esp + 0x248], ebx
mov byte [esp + 0x238], bl
cmp dword [esp + 0x268], edi
jb 0x41ca88
mov eax, dword [esp + 0x254]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x268], esi
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
cmp dword [esp + 0x284], edi
jb 0x41cab6
mov ecx, dword [esp + 0x270]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x284], esi
mov dword [esp + 0x280], ebx
mov byte [esp + 0x270], bl
cmp dword [esp + 0x2a0], edi
jb 0x41cae4
mov edx, dword [esp + 0x28c]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x2a0], esi
mov dword [esp + 0x29c], ebx
mov byte [esp + 0x28c], bl
cmp dword [esp + 0x2bc], edi
jb 0x41cb12
mov eax, dword [esp + 0x2a8]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x2bc], esi
mov dword [esp + 0x2b8], ebx
mov byte [esp + 0x2a8], bl
cmp dword [esp + 0x2d8], edi
jb 0x41cb40
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x2d8], esi
mov dword [esp + 0x2d4], ebx
mov byte [esp + 0x2c4], bl
cmp dword [esp + 0x2f4], edi
jb 0x41cb6e
mov edx, dword [esp + 0x2e0]
push edx
call fcn.00439c49
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00439641
add esp, 0x218
ret 0xc8