Function at 0x40dba3
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4388cf
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
push 0
push 0x26
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041aee6
add esp, 0xc
and dword [ebp - 4], 0
push 0x43bb20
lea ecx, [ebp - 0x80]
call fcn.00408e1f
mov byte [ebp - 4], 1
push 0x43b782
lea ecx, [ebp - 0x208]
call fcn.00408211
mov byte [ebp - 4], 2
push 0x43bb20
lea ecx, [ebp - 0x48]
call fcn.00408e1f
mov byte [ebp - 4], 3
push 0x43bb1c
lea ecx, [ebp - 0x9c]
call fcn.00408e1f
mov byte [ebp - 4], 4
push 0x43bb1c
lea ecx, [ebp - 0x1ec]
call fcn.00408e1f
mov byte [ebp - 4], 5
push 0x43bb1c
lea ecx, [ebp - 0x64]
call fcn.00408e1f
mov byte [ebp - 4], 6
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00408632
pop ecx
pop ecx
mov dword [ebp - 0x264], 0x43bb18
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x264]
mov al, byte [eax]
mov byte [ebp - 0x269], al
inc dword [ebp - 0x264]
cmp byte [ebp - 0x269], 0
jne 0x40dc86
mov eax, dword [ebp - 0x264]
sub eax, dword [ebp - 0x268]
mov dword [ebp - 0x270], eax
push dword [ebp - 0x270]
push 0x43bb18
push 2
push 1
lea ecx, [ebp - 0x208]
call fcn.00416775
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00408591
pop ecx
pop ecx
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00407683
mov dword [ebp - 0x274], 0x43ba2c
mov eax, dword [ebp - 0x274]
add eax, 2
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x274]
mov ax, word [eax]
mov word [ebp - 0x27a], ax
add dword [ebp - 0x274], 2
cmp word [ebp - 0x27a], 0
jne 0x40dd14
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x278]
sar eax, 1
mov dword [ebp - 0x280], eax
push dword [ebp - 0x280]
push 0x43ba2c
lea ecx, [ebp - 0x80]
call fcn.004073b3
mov dword [ebp - 0x284], str.SUPInstall.exe
mov eax, dword [ebp - 0x284]
add eax, 2
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x284]
mov ax, word [eax]
mov word [ebp - 0x28a], ax
add dword [ebp - 0x284], 2
cmp word [ebp - 0x28a], 0
jne 0x40dd75
mov eax, dword [ebp - 0x284]
sub eax, dword [ebp - 0x288]
sar eax, 1
mov dword [ebp - 0x290], eax
push dword [ebp - 0x290]
push str.SUPInstall.exe
lea ecx, [ebp - 0x80]
call fcn.004073b3
mov dword [ebp - 0x294], 0x43bb20
mov eax, dword [ebp - 0x294]
add eax, 2
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x294]
mov ax, word [eax]
mov word [ebp - 0x29a], ax
add dword [ebp - 0x294], 2
cmp word [ebp - 0x29a], 0
jne 0x40ddd6
mov eax, dword [ebp - 0x294]
sub eax, dword [ebp - 0x298]
sar eax, 1
mov dword [ebp - 0x2a0], eax
push dword [ebp - 0x2a0]
push 0x43bb20
lea ecx, [ebp - 0x80]
call fcn.004073b3
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x114
push 0
lea eax, [ebp - 0x1b4]
push eax
call fcn.0041d130
add esp, 0xc
mov dword [ebp - 0x1b4], 0x114
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1b0], 5
jne 0x40de79
cmp dword [ebp - 0x1ac], 1
je 0x40de86
cmp dword [ebp - 0x1ac], 2
jne 0x40e4c8
mov dword [ebp - 0x2a4], str._setupapi.dll_InstallHinfSection_DefaultInstall_132
mov eax, dword [ebp - 0x2a4]
add eax, 2
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a4]
mov ax, word [eax]
mov word [ebp - 0x2aa], ax
add dword [ebp - 0x2a4], 2
cmp word [ebp - 0x2aa], 0
jne 0x40de9f
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x2a8]
sar eax, 1
mov dword [ebp - 0x2b0], eax
push dword [ebp - 0x2b0]
push str._setupapi.dll_InstallHinfSection_DefaultInstall_132
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x2b4], 0x43bb20
mov eax, dword [ebp - 0x2b4]
add eax, 2
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b4]
mov ax, word [eax]
mov word [ebp - 0x2ba], ax
add dword [ebp - 0x2b4], 2
cmp word [ebp - 0x2ba], 0
jne 0x40df03
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x2b8]
sar eax, 1
mov dword [ebp - 0x2c0], eax
push dword [ebp - 0x2c0]
push 0x43bb20
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00407683
mov dword [ebp - 0x2c4], 0x43ba2c
mov eax, dword [ebp - 0x2c4]
add eax, 2
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c4]
mov ax, word [eax]
mov word [ebp - 0x2ca], ax
add dword [ebp - 0x2c4], 2
cmp word [ebp - 0x2ca], 0
jne 0x40df81
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x2c8]
sar eax, 1
mov dword [ebp - 0x2d0], eax
push dword [ebp - 0x2d0]
push 0x43ba2c
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x2d4], str.newver_
mov eax, dword [ebp - 0x2d4]
add eax, 2
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d4]
mov ax, word [eax]
mov word [ebp - 0x2da], ax
add dword [ebp - 0x2d4], 2
cmp word [ebp - 0x2da], 0
jne 0x40dfe5
mov eax, dword [ebp - 0x2d4]
sub eax, dword [ebp - 0x2d8]
sar eax, 1
mov dword [ebp - 0x2e0], eax
push dword [ebp - 0x2e0]
push str.newver_
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x2e4], str.YSDrv
mov eax, dword [ebp - 0x2e4]
add eax, 2
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e4]
mov ax, word [eax]
mov word [ebp - 0x2ea], ax
add dword [ebp - 0x2e4], 2
cmp word [ebp - 0x2ea], 0
jne 0x40e049
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0x2e8]
sar eax, 1
mov dword [ebp - 0x2f0], eax
push dword [ebp - 0x2f0]
push str.YSDrv
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x2f4], 0x43b960
mov eax, dword [ebp - 0x2f4]
add eax, 2
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f4]
mov ax, word [eax]
mov word [ebp - 0x2fa], ax
add dword [ebp - 0x2f4], 2
cmp word [ebp - 0x2fa], 0
jne 0x40e0ad
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x2f8]
sar eax, 1
mov dword [ebp - 0x300], eax
push dword [ebp - 0x300]
push 0x43b960
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x304], str.YSDrv
mov eax, dword [ebp - 0x304]
add eax, 2
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x304]
mov ax, word [eax]
mov word [ebp - 0x30a], ax
add dword [ebp - 0x304], 2
cmp word [ebp - 0x30a], 0
jne 0x40e111
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x308]
sar eax, 1
mov dword [ebp - 0x310], eax
push dword [ebp - 0x310]
push str.YSDrv
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x314], str..inf
mov eax, dword [ebp - 0x314]
add eax, 2
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x314]
mov ax, word [eax]
mov word [ebp - 0x31a], ax
add dword [ebp - 0x314], 2
cmp word [ebp - 0x31a], 0
jne 0x40e175
mov eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0x318]
sar eax, 1
mov dword [ebp - 0x320], eax
push dword [ebp - 0x320]
push str..inf
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x324], 0x43bb20
mov eax, dword [ebp - 0x324]
add eax, 2
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x324]
mov ax, word [eax]
mov word [ebp - 0x32a], ax
add dword [ebp - 0x324], 2
cmp word [ebp - 0x32a], 0
jne 0x40e1d9
mov eax, dword [ebp - 0x324]
sub eax, dword [ebp - 0x328]
sar eax, 1
mov dword [ebp - 0x330], eax
push dword [ebp - 0x330]
push 0x43bb20
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
push 0
push 0x25
lea eax, [ebp - 0x2c]
push eax
call fcn.0041aee6
add esp, 0xc
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x258]
lea ecx, [ebp - 0x1d0]
call fcn.00406fbc
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004050af
mov byte [ebp - 4], 6
mov dword [ebp - 0x338], 0x43b782
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x338]
mov al, byte [eax]
mov byte [ebp - 0x33d], al
inc dword [ebp - 0x338]
cmp byte [ebp - 0x33d], 0
jne 0x40e286
mov eax, dword [ebp - 0x338]
sub eax, dword [ebp - 0x33c]
mov dword [ebp - 0x344], eax
push dword [ebp - 0x344]
push 0x43b782
lea ecx, [ebp - 0x208]
call fcn.00405fab
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00408632
pop ecx
pop ecx
mov dword [ebp - 0x348], 0x43bb18
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x348]
mov al, byte [eax]
mov byte [ebp - 0x34d], al
inc dword [ebp - 0x348]
cmp byte [ebp - 0x34d], 0
jne 0x40e2f7
mov eax, dword [ebp - 0x348]
sub eax, dword [ebp - 0x34c]
mov dword [ebp - 0x354], eax
push dword [ebp - 0x354]
push 0x43bb18
push 2
push 1
lea ecx, [ebp - 0x208]
call fcn.00416775
mov dword [ebp - 0x358], 0x43bb1c
mov eax, dword [ebp - 0x358]
add eax, 2
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x358]
mov ax, word [eax]
mov word [ebp - 0x35e], ax
add dword [ebp - 0x358], 2
cmp word [ebp - 0x35e], 0
jne 0x40e359
mov eax, dword [ebp - 0x358]
sub eax, dword [ebp - 0x35c]
sar eax, 1
mov dword [ebp - 0x364], eax
push dword [ebp - 0x364]
push 0x43bb1c
lea ecx, [ebp - 0x9c]
call fcn.0040606c
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00408591
pop ecx
pop ecx
mov dword [ebp - 0x368], 0x43bb1c
mov eax, dword [ebp - 0x368]
add eax, 2
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x368]
mov ax, word [eax]
mov word [ebp - 0x36e], ax
add dword [ebp - 0x368], 2
cmp word [ebp - 0x36e], 0
jne 0x40e3d2
mov eax, dword [ebp - 0x368]
sub eax, dword [ebp - 0x36c]
sar eax, 1
mov dword [ebp - 0x374], eax
push dword [ebp - 0x374]
push 0x43bb1c
lea ecx, [ebp - 0x80]
call fcn.0040606c
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00407683
mov dword [ebp - 0x378], str.rundll32.exe
mov eax, dword [ebp - 0x378]
add eax, 2
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x378]
mov ax, word [eax]
mov word [ebp - 0x37e], ax
add dword [ebp - 0x378], 2
cmp word [ebp - 0x37e], 0
jne 0x40e44a
mov eax, dword [ebp - 0x378]
sub eax, dword [ebp - 0x37c]
sar eax, 1
mov dword [ebp - 0x384], eax
push dword [ebp - 0x384]
push str.rundll32.exe
lea ecx, [ebp - 0x80]
call fcn.004073b3
lea ecx, [ebp - 0x1ec]
call fcn.00416ddb
mov dword [ebp - 0x25c], eax
push 0
push 0
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x80]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e92f
mov dword [ebp - 0x388], 0x43bb20
mov eax, dword [ebp - 0x388]
add eax, 2
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x388]
mov ax, word [eax]
mov word [ebp - 0x38e], ax
add dword [ebp - 0x388], 2
cmp word [ebp - 0x38e], 0
jne 0x40e4e1
mov eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0x38c]
sar eax, 1
mov dword [ebp - 0x394], eax
push dword [ebp - 0x394]
push 0x43bb20
lea ecx, [ebp - 0x80]
call fcn.0040606c
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00407683
mov dword [ebp - 0x398], 0x43ba2c
mov eax, dword [ebp - 0x398]
add eax, 2
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x398]
mov ax, word [eax]
mov word [ebp - 0x39e], ax
add dword [ebp - 0x398], 2
cmp word [ebp - 0x39e], 0
jne 0x40e559
mov eax, dword [ebp - 0x398]
sub eax, dword [ebp - 0x39c]
sar eax, 1
mov dword [ebp - 0x3a4], eax
push dword [ebp - 0x3a4]
push 0x43ba2c
lea ecx, [ebp - 0x80]
call fcn.004073b3
mov dword [ebp - 0x3a8], str.DPInst.exe
mov eax, dword [ebp - 0x3a8]
add eax, 2
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3a8]
mov ax, word [eax]
mov word [ebp - 0x3ae], ax
add dword [ebp - 0x3a8], 2
cmp word [ebp - 0x3ae], 0
jne 0x40e5ba
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0x3ac]
sar eax, 1
mov dword [ebp - 0x3b4], eax
push dword [ebp - 0x3b4]
push str.DPInst.exe
lea ecx, [ebp - 0x80]
call fcn.004073b3
mov dword [ebp - 0x3b8], 0x43bb20
mov eax, dword [ebp - 0x3b8]
add eax, 2
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3b8]
mov ax, word [eax]
mov word [ebp - 0x3be], ax
add dword [ebp - 0x3b8], 2
cmp word [ebp - 0x3be], 0
jne 0x40e61b
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0x3bc]
sar eax, 1
mov dword [ebp - 0x3c4], eax
push dword [ebp - 0x3c4]
push 0x43bb20
lea ecx, [ebp - 0x80]
call fcn.004073b3
mov dword [ebp - 0x3c8], str.__Q__LM__PATH
mov eax, dword [ebp - 0x3c8]
add eax, 2
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3c8]
mov ax, word [eax]
mov word [ebp - 0x3ce], ax
add dword [ebp - 0x3c8], 2
cmp word [ebp - 0x3ce], 0
jne 0x40e67c
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x3cc]
sar eax, 1
mov dword [ebp - 0x3d4], eax
push dword [ebp - 0x3d4]
push str.__Q__LM__PATH
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x3d8], 0x43bb20
mov eax, dword [ebp - 0x3d8]
add eax, 2
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3d8]
mov ax, word [eax]
mov word [ebp - 0x3de], ax
add dword [ebp - 0x3d8], 2
cmp word [ebp - 0x3de], 0
jne 0x40e6e0
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x3dc]
sar eax, 1
mov dword [ebp - 0x3e4], eax
push dword [ebp - 0x3e4]
push 0x43bb20
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00407683
mov dword [ebp - 0x3e8], 0x43ba2c
mov eax, dword [ebp - 0x3e8]
add eax, 2
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3e8]
mov ax, word [eax]
mov word [ebp - 0x3ee], ax
add dword [ebp - 0x3e8], 2
cmp word [ebp - 0x3ee], 0
jne 0x40e75e
mov eax, dword [ebp - 0x3e8]
sub eax, dword [ebp - 0x3ec]
sar eax, 1
mov dword [ebp - 0x3f4], eax
push dword [ebp - 0x3f4]
push 0x43ba2c
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x3f8], str.newver_
mov eax, dword [ebp - 0x3f8]
add eax, 2
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3f8]
mov ax, word [eax]
mov word [ebp - 0x3fe], ax
add dword [ebp - 0x3f8], 2
cmp word [ebp - 0x3fe], 0
jne 0x40e7c2
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x3fc]
sar eax, 1
mov dword [ebp - 0x404], eax
push dword [ebp - 0x404]
push str.newver_
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x408], str.YSDrv
mov eax, dword [ebp - 0x408]
add eax, 2
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x408]
mov ax, word [eax]
mov word [ebp - 0x40e], ax
add dword [ebp - 0x408], 2
cmp word [ebp - 0x40e], 0
jne 0x40e826
mov eax, dword [ebp - 0x408]
sub eax, dword [ebp - 0x40c]
sar eax, 1
mov dword [ebp - 0x414], eax
push dword [ebp - 0x414]
push str.YSDrv
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
mov dword [ebp - 0x418], 0x43bb20
mov eax, dword [ebp - 0x418]
add eax, 2
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x418]
mov ax, word [eax]
mov word [ebp - 0x41e], ax
add dword [ebp - 0x418], 2
cmp word [ebp - 0x41e], 0
jne 0x40e88a
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0x41c]
sar eax, 1
mov dword [ebp - 0x424], eax
push dword [ebp - 0x424]
push 0x43bb20
lea ecx, [ebp - 0x1ec]
call fcn.004073b3
cmp dword [ebp - 0x1d8], 8
jb 0x40e8ec
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x428], eax
jmp 0x40e8f8
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x6c], 8
jb 0x40e909
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x42c], eax
jmp 0x40e912
lea eax, [ebp - 0x80]
mov dword [ebp - 0x42c], eax
push 0
push 0
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x430], str.start
mov eax, dword [ebp - 0x430]
add eax, 2
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x430]
mov ax, word [eax]
mov word [ebp - 0x436], ax
add dword [ebp - 0x430], 2
cmp word [ebp - 0x436], 0
jne 0x40e948
mov eax, dword [ebp - 0x430]
sub eax, dword [ebp - 0x434]
sar eax, 1
mov dword [ebp - 0x43c], eax
push dword [ebp - 0x43c]
push str.start
lea ecx, [ebp - 0x64]
call fcn.0040606c
mov dword [ebp - 0x440], str.YSDrv
mov eax, dword [ebp - 0x440]
add eax, 2
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x440]
mov ax, word [eax]
mov word [ebp - 0x446], ax
add dword [ebp - 0x440], 2
cmp word [ebp - 0x446], 0
jne 0x40e9a9
mov eax, dword [ebp - 0x440]
sub eax, dword [ebp - 0x444]
sar eax, 1
mov dword [ebp - 0x44c], eax
push dword [ebp - 0x44c]
push str.YSDrv
lea ecx, [ebp - 0x64]
call fcn.004073b3
cmp dword [ebp - 0x50], 8
jb 0x40ea02
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x450], eax
jmp 0x40ea0b
lea eax, [ebp - 0x64]
mov dword [ebp - 0x450], eax
push 0
push 0
push dword [ebp - 0x450]
push str.sc.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
and dword [ebp - 0x20c], 0
mov byte [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004050af
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0xa
push 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004050af
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.004050af
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0xc
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004050af
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0xd
push 0
push 1
lea ecx, [ebp - 0x208]
call fcn.00402ad2
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0xe
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.004050af
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xf
push 0
push 1
lea ecx, [ebp - 0x1d0]
call fcn.004050af
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c438
leave
ret