Function at 0x5a99e0
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x874e05
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x110]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov eax, dword [eax + 0x60]
push eax
lea ecx, [esp + 0x2c]
call fcn.004b2080
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
push eax
mov dword [esp + 0x10c], ebx
call fcn.004a9b50
add eax, 0x10
add esp, 4
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
mov byte [esp + 0x110], 1
call fcn.005a91e0
test al, al
jne 0x5a9abe
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x108], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9a8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x108], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9ab7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x5aaf91
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x80]
call fcn.004a8f10
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x80]
mov byte [esp + 0x10c], 2
call fcn.004d44d0
mov ecx, eax
mov byte [esp + 0x108], 3
call fcn.004b1130
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004a9b50
lea ebp, [eax + 0x10]
add esp, 4
mov dword [esp + 0x90], ebp
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
mov byte [esp + 0x108], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9b3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9b65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x54]
call fcn.004a8f10
lea ecx, [esp + 0x50]
mov byte [esp + 0x108], 7
call fcn.004f5ad0
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5a9b9e
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x54], edi
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x60]
push eax
push ebp
lea ecx, [esi + 0x30]
mov byte [esp + 0x118], 8
call fcn.005a8560
cmp eax, ebx
je 0x5a9c08
add eax, 4
push eax
lea ecx, [esp + 0x58]
call fcn.004aa540
mov edi, dword [esp + 0x54]
push edi
lea ecx, [esp + 0x28]
call fcn.004a8f10
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x30], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5a9c08
xor bl, bl
jmp 0x5a9c0a
mov bl, 1
test byte [esp + 0x2c], 1
je 0x5a9c31
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5a9c31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x5a9cae
lea eax, [edi - 0x10]
mov byte [esp + 0x108], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9c59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x108], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9c81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x108], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9a64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x5a9a64
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esi, eax
xor eax, eax
push eax
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x94], eax
lea edx, [esp + 0x70]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x90], eax
push edx
lea eax, [esp + 0x8c]
push eax
mov dword [esp + 0x94], 0xc
mov dword [esp + 0x9c], 1
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x5a9d3d
mov edx, dword [esp + 0x80]
push 2
push 0
push 0
lea ecx, [esp + 0x80]
push ecx
push esi
push edx
push esi
call edi
mov eax, dword [esp + 0x80]
push eax
call ebx
push 0
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x78]
push eax
call ebp
xor ebp, ebp
test eax, eax
je 0x5a9d75
mov edx, dword [esp + 0x78]
push 2
push ebp
push ebp
lea ecx, [esp + 0x70]
push ecx
push esi
push edx
push esi
call edi
mov eax, dword [esp + 0x78]
push eax
call ebx
push 0x44
lea ecx, [esp + 0xc0]
push ebp
push ecx
call fcn.00802690
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
or dword [esp + 0xf4], 0x101
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], eax
xor eax, eax
add esp, 0xc
mov dword [esp + 0xbc], 0x44
mov dword [esp + 0xf4], edx
mov word [esp + 0xec], ax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x5a9dfb
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x108], 9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
mov dword [esp + 0x60], edi
cmp edi, ebp
je 0x5aabb0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], 0xa
mov byte [esp + 0x108], 0xa
mov esi, edi
cmp word [edi], bp
je 0x5a9ebe
mov bl, 0xb
cmp esi, edi
je 0x5a9e9f
push esi
lea ecx, [esp + 0x1c]
call fcn.004a8f10
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], bl
call fcn.004b34a0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5a9e9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x5a9ea4
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], bp
lea esi, [esi + eax*2 + 2]
jne 0x5a9e54
push 0x428d34
lea ecx, [esp + 0x1c]
call fcn.004a8f10
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0xc
call fcn.004b34a0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5a9f0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x428cb8
lea ecx, [esp + 0x1c]
call fcn.004a8f10
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0xd
call fcn.004b34a0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5a9f56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x110]
mov eax, dword [edi + 0x68]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.004afcb0
lea ecx, [esp + 0x20]
add esp, 4
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.0065c5b0
push eax
lea edx, [esp + 0x28]
push 0x428c94
mov bl, 0xe
push edx
mov byte [esp + 0x11c], bl
call fcn.004b1a10
add esp, 0x14
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0xf
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9fd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5a9fff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0x5c]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.004afcb0
lea ecx, [esp + 0x20]
add esp, 4
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.0065c5b0
push eax
lea edx, [esp + 0x28]
push 0x428c74
push edx
mov byte [esp + 0x11c], 0x10
call fcn.004b1a10
add esp, 0x14
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x11
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa079
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa0a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x20]
push 0x428c5c
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x12
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa0f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push 0x428c38
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x13
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x20]
push 0x428c1c
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x14
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa194
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0x64]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.004afcb0
lea ecx, [esp + 0x20]
add esp, 4
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.0065c5b0
push eax
lea edx, [esp + 0x28]
push 0x428c00
mov bl, 0x15
push edx
mov byte [esp + 0x11c], bl
call fcn.004b1a10
add esp, 0x14
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x16
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa20e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa236
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x5aa250
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov ebp, dword [esp + 0x110]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x78]
push eax
push 0x411bbc
lea ecx, [ebp + 0x70]
mov byte [esp + 0x118], 0x17
call fcn.005ec920
test eax, eax
je 0x5aa343
add eax, 4
push eax
lea ecx, [esp + 0x24]
call fcn.004b1400
mov esi, dword [esp + 0x20]
push ecx
lea eax, [esi - 0x10]
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.004afcb0
lea ecx, [esp + 0x20]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.0065c5b0
push eax
lea edx, [esp + 0x28]
push 0x428be4
mov bl, 0x18
push edx
mov byte [esp + 0x11c], bl
call fcn.004b1a10
add esp, 0x14
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x19
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa31b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa343
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x78]
push eax
push 0x428a00
lea ecx, [ebp + 0x70]
call fcn.005ec920
test eax, eax
je 0x5aa417
add eax, 4
push eax
lea ecx, [esp + 0x24]
call fcn.004b1400
mov esi, dword [esp + 0x20]
push ecx
lea eax, [esi - 0x10]
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.004afcb0
lea ecx, [esp + 0x20]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.0065c5b0
push eax
lea edx, [esp + 0x28]
push 0x428bc4
mov bl, 0x1a
push edx
mov byte [esp + 0x11c], bl
call fcn.004b1a10
add esp, 0x14
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x1b
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa3ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa417
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa43b
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
xor eax, eax
cmp dword [ebp + 0x74], eax
je 0x5aa463
mov edx, dword [ebp + 0x78]
test edx, edx
je 0x5aa461
mov ebp, dword [ebp + 0x70]
mov ecx, ebp
mov edi, edi
cmp dword [ecx], 0
jne 0x5aa4d7
inc eax
add ecx, 4
cmp eax, edx
jb 0x5aa450
xor eax, eax
mov dword [esp + 0x1c], eax
test eax, eax
je 0x5aa7fe
nop
mov edi, dword [esp + 0x1c]
xor ebx, ebx
test edi, edi
setne bl
test ebx, ebx
je 0x5a9b94
mov esi, dword [edi]
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x5a9b94
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x108], 0x1c
test esi, esi
je 0x5aa4dd
test esi, 0xffff0000
jne 0x5aa4dd
movzx esi, si
push esi
call fcn.007cfe78
test eax, eax
je 0x5aa4e7
push esi
push eax
lea ecx, [esp + 0x28]
call fcn.004a8d10
jmp 0x5aa4e7
mov eax, dword [ebp + eax*4]
jmp 0x5aa463
push esi
lea ecx, [esp + 0x24]
call fcn.004b10a0
mov byte [esp + 0x108], 0x1d
test ebx, ebx
je 0x5a9b94
mov ecx, dword [edi + 8]
mov ebx, edi
test ecx, ecx
jne 0x5aa529
mov eax, dword [edi + 0xc]
mov esi, dword [esp + 0x110]
mov edi, dword [esi + 0x78]
xor edx, edx
div edi
inc edx
cmp edx, edi
jae 0x5aa529
mov eax, dword [esi + 0x70]
cmp dword [eax + edx*4], 0
lea eax, [eax + edx*4]
je 0x5aa524
mov ecx, dword [eax]
inc edx
test ecx, ecx
je 0x5aa512
mov esi, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x5a9b94
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x5c], eax
mov byte [esp + 0x108], 0x1e
test esi, esi
je 0x5aa586
test esi, 0xffff0000
jne 0x5aa586
movzx esi, si
push esi
call fcn.007cfe78
test eax, eax
je 0x5aa590
push esi
push eax
lea ecx, [esp + 0x64]
call fcn.004a8d10
jmp 0x5aa590
push esi
lea ecx, [esp + 0x60]
call fcn.004b10a0
push 0x427d00
push 0x40d72c
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x1f
call fcn.004aa070
mov edi, dword [esp + 0x20]
mov esi, dword [edi - 0xc]
test esi, esi
js 0x5aa818
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x5aa5d9
push esi
lea ecx, [esp + 0x24]
call fcn.004a8a90
mov edi, dword [esp + 0x20]
lea ecx, [esi + 1]
push ecx
push edi
call fcn.00809eae
add esp, 8
cmp esi, dword [edi - 8]
jg 0x5aa818
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
xor edx, edx
push 0x428bb8
mov dword [edi - 0xc], esi
push ecx
mov word [edi + esi*2], dx
call fcn.004b1a10
push 0x427cfc
push eax
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0x120], 0x20
call fcn.004af3d0
lea ecx, [esp + 0x74]
push ecx
push eax
lea edx, [esp + 0x90]
push edx
mov byte [esp + 0x12c], 0x21
call fcn.004ac680
add esp, 0x24
mov esi, eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x38]
mov byte [esp + 0x108], 0x22
mov dword [esp + 0x9c], eax
call fcn.005dfd30
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov ebp, eax
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x94], eax
mov esi, dword [esi]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add eax, 8
mov dword [esp + 0xb0], eax
mov eax, dword [edx + 0x10]
mov byte [esp + 0x108], 0x23
call eax
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x5aa6b7
cmp eax, dword [esi - 0x10]
jne 0x5aa6b7
lea ebx, [esi - 0x10]
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x5aa6ef
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x5aa822
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.0080217f
add esp, 0x10
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xb4]
mov eax, dword [esp + 0x9c]
add ebx, 0x10
mov dword [ecx], ebx
mov dword [esp + 0x48], edx
mov dword [ebp + 4], eax
mov dword [ebp], 0
mov eax, dword [esp + 0x3c]
inc dword [esp + 0x40]
test eax, eax
je 0x5aa727
mov dword [eax], ebp
jmp 0x5aa72b
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x108], 0x21
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa757
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa77f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x1f
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa7a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x1d
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa7cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0xfffffff0
mov byte [esp + 0x108], 0xa
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa7f3
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
cmp dword [esp + 0x18], 0
jne 0x5aa470
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x5aa827
push 0x80004005
call fcn.004a8210
push 0x80070057
call fcn.004a8210
call fcn.004a8580
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x108], 0x24
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x5aa859
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov esi, dword [esp + 0x110]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
mov bl, 0x25
push edx
mov ecx, esi
mov byte [esp + 0x110], bl
call fcn.007dd77a
test eax, eax
je 0x5aa996
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push 0x403a48
push ecx
call fcn.004aa600
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x24]
push 0x428b9c
push eax
call fcn.004b1a10
add esp, 0x18
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x26
call fcn.004b34a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa8f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push 0x428b80
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x27
call fcn.004b34a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa946
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push 0x428b64
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x28
call fcn.004b34a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aa996
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.007dd801
test eax, eax
je 0x5aaa63
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push 0x403a48
push ecx
call fcn.004aa600
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x24]
push 0x428b48
push eax
call fcn.004b1a10
add esp, 0x18
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x29
call fcn.004b34a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaa13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push 0x428b2c
push edx
call fcn.004b1a10
add esp, 0xc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x2a
call fcn.004b34a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaa63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x405080
lea ecx, [esp + 0x20]
call fcn.004a8f10
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x10c], 0x2b
call fcn.004b34a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5aaaae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004f85f0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x2c
call fcn.004aa540
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaafb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.005a8910
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x10c], 0x2d
call fcn.004b1400
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aab46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x24
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5aab79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x108], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aab9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x108], 9
call fcn.004afe70
xor ebp, ebp
push 0x10000
call fcn.007c8558
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x58]
push ecx
push edx
push 0x428b18
push 0x8000
push 0x8000
push eax
mov dword [esp + 0x34], eax
call fcn.00803678
add esp, 0x1c
cmp dword [esp + 0x6c], ebp
je 0x5aae8c
cmp dword [esp + 0x68], 0
je 0x5aae8c
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 0xc]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x20]
push ecx
push eax
xor edi, edi
push edi
push 1
push edi
push edi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x5aae7b
mov ecx, dword [esp + 0xa0]
lea eax, [esp + 0x94]
push eax
push edi
push ecx
push 0x5a8470
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [esp + 0x110]
mov edx, dword [esi + 0x6c]
mov dword [esp + 0x1c], edi
mov ebx, dword [edx - 0xc]
cmp ebx, edi
jle 0x5aaca2
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [esp]
mov eax, ebx
sub eax, edi
cmp eax, 0x400
jl 0x5aac80
mov eax, 0x400
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x20]
push edx
push eax
lea eax, [edi + ecx]
mov ecx, dword [esp + 0x70]
push eax
push ecx
call ebp
test eax, eax
je 0x5aaca2
add edi, dword [esp + 0x1c]
cmp edi, ebx
jl 0x5aac70
mov edx, dword [esp + 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x68]
push eax
call esi
mov ebp, dword [esp + 0x118]
mov ecx, ebp
call fcn.004b01d0
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x5aacde
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov byte [esp + 0x108], 0x2e
cmp edi, ebx
jne 0x5aad6a
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x400
or eax, ecx
jge 0x5aad26
push 0x400
lea ecx, [esp + 0x28]
call fcn.004b05e0
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x74]
push 0
lea ecx, [esp + 0x64]
push ecx
push 0x400
push esi
push edx
call edi
test eax, eax
je 0x5aad6a
mov eax, dword [esp + 0x60]
test eax, eax
je 0x5aad6a
js 0x5aa818
cmp eax, dword [esi - 8]
jg 0x5aa818
mov dword [esi - 0xc], eax
mov byte [esi + eax], 0
mov eax, dword [esi - 0xc]
push eax
push esi
mov ecx, ebp
call fcn.004e74c0
jmp 0x5aad00
mov eax, dword [ebp]
cmp dword [eax - 0xc], 0
jl 0x5aae2d
push 0x411bd8
push eax
call fcn.00807018
add esp, 8
test eax, eax
je 0x5aae2d
sub eax, dword [ebp]
mov edi, eax
js 0x5aae2d
lea eax, [edi + 2]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.00534560
mov ecx, dword [esp + 0x114]
push eax
mov byte [esp + 0x10c], 0x2f
call fcn.004b1400
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x2e
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5aade5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 4
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.00535510
push eax
mov ecx, ebp
mov byte [esp + 0x10c], 0x30
call fcn.004b1400
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0x2e
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5aae2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x74]
push edx
call edi
mov eax, dword [esp + 0xa0]
push eax
call edi
mov ecx, dword [esp + 0xa4]
push ecx
call edi
add esi, 0xfffffff0
mov byte [esp + 0x108], 9
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x5aae8c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x5aae8c
mov ecx, dword [esp + 0x118]
push 0x428b04
call fcn.004b2120
mov ecx, dword [esp + 0x18]
push ecx
call fcn.007c8563
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x108], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5aaec1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov byte [esp + 0x108], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaee9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x108], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaf11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
mov byte [esp + 0x108], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaf3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x108], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaf64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x108], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5aaf8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 0x10