Function at 0x40b10a
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Execute vbscript javascript or jscript in memory
Extract resource via kernel32 functions
Get common file path
Get file attributes
Set current directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov dword [0x412b68], eax
push 0x208
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x40b166
jmp 0x40cdc9
push 0x104
lea ecx, [ebp - 0x36c]
push ecx
push 1
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 8
lea eax, [ebp - 0x14]
push eax
push 0x11
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x79
push 5
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x40b21f
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
je 0x40b21f
mov eax, dword [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x40b21f
mov ecx, dword [ebp - 0x268]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 1
jne 0x40b21f
mov edx, dword [ebp - 0x4dc]
xor eax, eax
mov al, byte [edx]
cmp eax, 1
jne 0x40b21f
mov dword [ebp - 8], 0
mov byte [ebp - 0x240], 0
push 0x204
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x1c], eax
push 0x79
push 3
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x40b354
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jne 0x40b282
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x40b2a6
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [ebp - 0x268]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0x100
jbe 0x40b2cf
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x100
push 0
lea edx, [ebp - 0x5e8]
push edx
call fcn.0040cf7f
add esp, 0xc
push str.Everstrike_Software
lea eax, [ebp - 0x5e8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x100
lea ecx, [ebp - 0x5e8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401677
add esp, 0xc
mov eax, dword [ebp - 0x600]
mov byte [ebp + eax - 0x240], 0
mov ecx, dword [ebp - 0x600]
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.0040d02b
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x600]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.0040ab45
add esp, 0xc
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x40b45f
push 0x104
lea edx, [ebp - 0x4d8]
push edx
push 0x21
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [ebp - 8], 0
jne 0x40b3aa
push 0
push str.Warning
lea ecx, [ebp - 0x4d8]
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40b45f
push 0xfffffffffffffff5
call fcn.00406480
add esp, 4
mov dword [ebp - 0x61c], eax
push 0xfffffffffffffff6
call fcn.00406480
add esp, 4
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x61c], 0xffffffff
je 0x40b45f
lea edx, [ebp - 0x4d8]
push edx
lea eax, [ebp - 0x4d8]
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
push 0
lea ecx, [ebp - 0x37c]
push ecx
lea edx, [ebp - 0x4d8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x4d8]
push eax
mov ecx, dword [ebp - 0x61c]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteConsoleA]
mov edx, 1
test edx, edx
je 0x40b45f
lea eax, [ebp - 0x37c]
push eax
push 1
lea ecx, [ebp - 0x614]
push ecx
mov edx, dword [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadConsoleInputA]
test eax, eax
jne 0x40b442
jmp 0x40b45f
mov eax, dword [ebp - 0x614]
and eax, 0xffff
cmp eax, 1
je 0x40b454
jmp 0x40b416
cmp dword [ebp - 0x610], 0
jne 0x40b45f
jmp 0x40b416
push 0x79
push 4
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x40b536
mov ecx, dword [ebp - 0x268]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jne 0x40b4a4
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [ebp - 0x3d0]
push edx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x40b4c8
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp - 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x10
je 0x40b4ee
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x10
mov ecx, dword [ebp - 0x4dc]
push ecx
lea edx, [ebp - 0x5f8]
push edx
call fcn.0040d02b
add esp, 0xc
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x5f8]
push ecx
lea edx, [ebp - 0x4d8]
push edx
call fcn.0040add2
add esp, 0xc
test eax, eax
jne 0x40b536
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jle 0x40b5e4
push 0x100
push 0
lea ecx, [ebp - 0x5e8]
push ecx
call fcn.0040cf7f
add esp, 0xc
cmp dword [ebp - 0x134], 0
jne 0x40b5ce
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x624], 0
jmp 0x40b598
mov eax, dword [ebp - 0x624]
add eax, 1
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [ebp - 0x620]
jae 0x40b5cc
mov edx, dword [ebp - 0x624]
movsx eax, byte [ebp + edx - 0x240]
movsx ecx, byte [ebp - 0x624]
xor eax, ecx
mov edx, dword [ebp - 0x624]
mov byte [ebp + edx - 0x5e8], al
jmp 0x40b589
jmp 0x40b5e2
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x5e8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x40b60c
push 0x100
push 0
lea edx, [ebp - 0x5e8]
push edx
call fcn.0040cf7f
add esp, 0xc
push 0x40f1d0
lea eax, [ebp - 0x5e8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x100
lea ecx, [ebp - 0x5e8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401677
add esp, 0xc
push 0x79
push 2
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x40b65a
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jne 0x40b693
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [ebp - 0x3d0]
push edx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x40b6ca
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x40b718
mov edx, dword [ebp - 0x1c]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [ebp - 0x20]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x4dc]
add edx, 4
push edx
mov eax, dword [ebp - 0x25c]
push eax
call fcn.0040d02b
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 4
push edx
mov eax, dword [ebp - 0x25c]
push eax
call fcn.0040ab45
add esp, 0xc
mov ecx, dword [ebp - 0x4dc]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x20]
mov byte [eax], 0
push 0x79
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x40b7b5
mov ecx, dword [ebp - 0x25c]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jne 0x40b803
mov eax, dword [ebp - 0x25c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x1c]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [ebp - 0x3d0]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x40b84f
mov edx, dword [ebp - 0x25c]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp - 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
add ecx, 1
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x40b8bc
mov eax, dword [ebp - 0x25c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x1c]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [ebp - 0x4e4]
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
mov eax, dword [ebp - 0x264]
push eax
call fcn.0040d02b
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x4e4]
push edx
mov eax, dword [ebp - 0x264]
push eax
call fcn.0040ab45
add esp, 0xc
mov ecx, dword [ebp - 0x264]
add ecx, dword [ebp - 0x4e4]
mov byte [ecx], 0
push 0x1c
call fcn.0040cf46
add esp, 4
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
je 0x40b935
mov edx, dword [ebp - 0x264]
push edx
mov ecx, dword [ebp - 0x694]
call fcn.00405cb2
mov dword [ebp - 0x6e4], eax
jmp 0x40b93f
mov dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x6e8], edx
cmp dword [ebp - 0x6e8], 0
je 0x40b97a
cmp dword [ebp - 0x6e8], 1
je 0x40b98e
cmp dword [ebp - 0x6e8], 2
je 0x40b9a2
jmp 0x40b9fd
lea eax, [ebp - 0x128]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x40b9fd
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x40b9fd
mov ecx, dword [ebp - 0x138]
call fcn.00405f82
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xffffffff
je 0x40b9eb
mov edx, dword [ebp - 0x628]
and edx, 0x10
test edx, edx
je 0x40b9eb
mov ecx, dword [ebp - 0x138]
call fcn.00405f82
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x40b9fd
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jle 0x40ba3a
mov eax, dword [ebp - 0x3d4]
movsx ecx, byte [ebp + eax - 0x129]
cmp ecx, 0x5c
jne 0x40ba3a
mov edx, dword [ebp - 0x3d4]
mov byte [ebp + edx - 0x129], 0
call fcn.0040ceaa
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x40ba67
mov ecx, dword [ebp - 0x138]
call fcn.00405fa4
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x36c]
push edx
lea eax, [ebp - 0x128]
push eax
push 0x40f1dc
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40baef
mov dword [ebp - 0x24], 1
push 0
push 0x80
push 1
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40bb49
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jle 0x40bb47
mov eax, dword [ebp - 0x3d4]
movsx ecx, byte [ebp + eax - 0x129]
cmp ecx, 0x5c
jne 0x40bb47
mov edx, dword [ebp - 0x3d4]
mov byte [ebp + edx - 0x129], 0
jmp 0x40bb69
mov eax, dword [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x40bb69
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x3c8], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x374], ecx
mov dword [ebp - 4], 0
push 0x208
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x370], 0
jmp 0x40bbc5
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [ebp - 0x3c8]
jge 0x40bd1c
mov edx, dword [ebp - 0x374]
push edx
lea eax, [ebp - 0x128]
push eax
push 0x40f1e4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bcf0
mov eax, dword [ebp - 0x374]
mov ecx, dword [eax + 0x104]
mov dword [ebp - 0x62c], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x374]
cmp ecx, dword [eax]
jne 0x40bc46
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x374]
mov edx, dword [ecx + 0x104]
mov dword [eax], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x374]
cmp edx, dword [ecx + 4]
jne 0x40bc69
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
cmp dword [ebp - 4], 0
je 0x40bc84
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x374]
mov edx, dword [ecx + 0x104]
mov dword [eax + 0x104], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 8]
sub edx, 1
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x10]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x374]
mov dword [ebp - 0x69c], edx
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0
je 0x40bcd5
push 1
mov ecx, dword [ebp - 0x698]
call fcn.00406420
mov dword [ebp - 0x6ec], eax
jmp 0x40bcdf
mov dword [ebp - 0x6ec], 0
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x374], ecx
jmp 0x40bbb6
mov edx, dword [ebp - 0x374]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x374]
mov ecx, dword [eax + 0x104]
mov dword [ebp - 0x374], ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x40bbb6
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x3c8], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x374], edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x370], 0
jmp 0x40bd61
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [ebp - 0x3c8]
jge 0x40c056
mov dword [ebp - 0x630], 0
push 0xa
mov edx, dword [ebp - 0x370]
add edx, 1
and edx, 0xffff
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x40bdf5
mov eax, dword [ebp - 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
je 0x40bdf5
mov ecx, dword [ebp - 0x3d0]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x40bdf5
mov edx, dword [ebp - 0x268]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x40be8f
cmp dword [ebp - 0x630], 0
je 0x40be2c
mov eax, dword [ebp - 0x630]
sub eax, 4
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x634], eax
jmp 0x40be36
mov dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0
je 0x40be8d
mov edx, dword [ebp - 0x630]
sub edx, 4
push edx
mov eax, dword [ebp - 0x4dc]
add eax, 4
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call fcn.0040d02b
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x630]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call fcn.0040ab45
add esp, 0xc
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x630], eax
jmp 0x40be99
mov dword [ebp - 0x634], 0
mov ecx, dword [ebp - 0x374]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0x40f1ec
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bfb2
mov edx, dword [ebp - 0x374]
mov eax, dword [edx + 0x104]
mov dword [ebp - 0x638], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x374]
cmp eax, dword [edx]
jne 0x40bf08
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x374]
mov ecx, dword [eax + 0x104]
mov dword [edx], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x374]
cmp ecx, dword [eax + 4]
jne 0x40bf2b
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
cmp dword [ebp - 4], 0
je 0x40bf46
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x374]
mov ecx, dword [eax + 0x104]
mov dword [edx + 0x104], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 8]
sub ecx, 1
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x6a4], ecx
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6a0], edx
cmp dword [ebp - 0x6a0], 0
je 0x40bf97
push 1
mov ecx, dword [ebp - 0x6a0]
call fcn.00406420
mov dword [ebp - 0x6f0], eax
jmp 0x40bfa1
mov dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x374], eax
jmp 0x40bd52
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x374]
mov eax, dword [edx + 0x104]
mov dword [ebp - 0x374], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
je 0x40c032
cmp dword [ebp - 0x634], 0
je 0x40c025
push 0
lea edx, [ebp - 0x37c]
push edx
mov eax, dword [ebp - 0x630]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
mov edx, dword [ebp - 0x4e0]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x634], 0
je 0x40c051
mov ecx, dword [ebp - 0x634]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x40bd52
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x1c]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x18]
and edx, 0x20
test edx, edx
je 0x40c5b2
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov word [ebp - 0x65c], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x65a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
push eax
call fcn.0040aaf8
add esp, 4
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea edx, [ebp - 0x128]
push edx
call fcn.0040ab22
add esp, 4
push 0x40f1f4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40c112
lea ecx, [ebp - 0x66c]
push ecx
push 0x40f1f8
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
jmp 0x40c1c6
push 0x40f208
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40c13c
lea eax, [ebp - 0x66c]
push eax
push str.VBScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
jmp 0x40c1c6
mov ecx, dword [ebp - 0x264]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x25c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.0040cdcf
add esp, 8
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x6ac], ecx
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6a8], edx
cmp dword [ebp - 0x6a8], 0
je 0x40c1b4
push 1
mov ecx, dword [ebp - 0x6a8]
call fcn.0040d3a0
mov dword [ebp - 0x6f4], eax
jmp 0x40c1be
mov dword [ebp - 0x6f4], 0
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x1ac
call fcn.0040cf46
add esp, 4
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
je 0x40c1fd
mov ecx, dword [ebp - 0x6b0]
call fcn.0040d3d0
mov dword [ebp - 0x6f8], eax
jmp 0x40c207
mov dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x244]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov ecx, dword [ebp - 0x63c]
call fcn.00409176
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
je 0x40c2f5
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x6b4], eax
mov ecx, dword [ebp - 0x6b4]
push ecx
call fcn.0040cf67
add esp, 4
mov edx, dword [ebp - 0x264]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp - 0x25c]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.0040cdcf
add esp, 8
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x6bc], edx
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0
je 0x40c2e3
push 1
mov ecx, dword [ebp - 0x6b8]
call fcn.0040d3a0
mov dword [ebp - 0x6fc], eax
jmp 0x40c2ed
mov dword [ebp - 0x6fc], 0
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [ebp - 0x67c]
push ecx
push 0x40e4b0
push 1
push 0
lea edx, [ebp - 0x66c]
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x67c]
mov dword [eax + 0x184], ecx
lea edx, [ebp - 0x678]
push edx
push 0x40e4a0
mov eax, dword [ebp - 0x67c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x67c]
push edx
call dword [ecx]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x20]
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
mov ecx, dword [ebp - 0x670]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x25c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push 0xc
call fcn.0040cf46
add esp, 4
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
je 0x40c3b7
mov ecx, dword [ebp - 0x6c0]
call fcn.0040d430
mov dword [ebp - 0x700], eax
jmp 0x40c3c1
mov dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x680], eax
mov ecx, dword [ebp - 0x680]
mov edx, dword [ebp - 0x63c]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x680]
push eax
mov ecx, dword [ebp - 0x67c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x67c]
push eax
call dword [edx + 0xc]
mov dword [ebp - 0x674], eax
mov ecx, dword [ebp - 0x678]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x678]
push eax
call dword [edx + 0xc]
mov dword [ebp - 0x674], eax
push 6
push str.WScript
mov ecx, dword [ebp - 0x67c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x67c]
push eax
call dword [edx + 0x20]
lea ecx, [ebp - 0x65c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x678]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x678]
push edx
call dword [ecx + 0x14]
mov dword [ebp - 0x674], eax
push 2
mov eax, dword [ebp - 0x67c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x67c]
push edx
call dword [ecx + 0x14]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x670]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x67c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [eax + 0x1c]
mov edx, dword [ebp - 0x678]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x678]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x67c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x680]
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x6c4]
push eax
call fcn.0040cf67
add esp, 4
mov ecx, dword [ebp - 0x63c]
call fcn.00409489
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x6c8], ecx
mov edx, dword [ebp - 0x6c8]
push edx
call fcn.0040cf67
add esp, 4
mov eax, dword [0x412b60]
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp - 0x264]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x25c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.0040cdcf
add esp, 8
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x6d0], ecx
mov edx, dword [ebp - 0x6d0]
mov dword [ebp - 0x6cc], edx
cmp dword [ebp - 0x6cc], 0
je 0x40c595
push 1
mov ecx, dword [ebp - 0x6cc]
call fcn.0040d3a0
mov dword [ebp - 0x704], eax
jmp 0x40c59f
mov dword [ebp - 0x704], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x36c]
push edx
lea eax, [ebp - 0x128]
push eax
push str._s_s_s
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40c676
cmp dword [ebp - 0x378], 0xb7
je 0x40c628
cmp dword [ebp - 0x378], 0x50
jne 0x40c676
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea ecx, [ebp - 0x128]
push ecx
push str._s_d_s
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
jmp 0x40c60a
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40c70d
mov ecx, dword [ebp - 0x264]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x25c]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.0040cdcf
add esp, 8
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x6d8], ecx
mov edx, dword [ebp - 0x6d8]
mov dword [ebp - 0x6d4], edx
cmp dword [ebp - 0x6d4], 0
je 0x40c6fb
push 1
mov ecx, dword [ebp - 0x6d4]
call fcn.0040d3a0
mov dword [ebp - 0x708], eax
jmp 0x40c705
mov dword [ebp - 0x708], 0
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0
lea eax, [ebp - 0x37c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x4e0]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x10
push 0
lea edx, [ebp - 0x254]
push edx
call fcn.0040cf7f
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040cf7f
add esp, 0xc
mov dword [ebp - 0x398], 1
mov word [ebp - 0x394], 0xa
mov dword [ebp - 0x3c4], 0x44
push 0x104
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x130], eax
push 0x104
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x12c], 0
push 0x40f244
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40c7e6
push 0x40f24c
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40c8d8
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x18]
and eax, 0x10
test eax, eax
je 0x40c8d8
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x688], 1
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x690], 0xc
mov ecx, dword [ebp - 0x398]
or ch, 1
mov dword [ebp - 0x398], ecx
mov edx, dword [ebp - 0x258]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov eax, dword [ebp - 0x130]
push eax
push 0
push str.exescript
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 0
push 0x80
push 2
lea edx, [ebp - 0x690]
push edx
push 1
push 0x40000000
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x4e0], eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x4e0]
mov dword [ebp - 0x388], ecx
mov edx, dword [ebp - 0x4e0]
mov dword [ebp - 0x384], edx
cmp dword [ebp - 0x684], 0x80000000
jb 0x40c8c7
mov word [ebp - 0x394], 0
jmp 0x40c8d8
mov eax, dword [ebp - 0x12c]
or eax, 0x8000000
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x258]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x40f260
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40c93a
push str..vbs
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40c93a
push str..wsf
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40c93a
push str..wsh
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40c98e
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x18]
and edx, 8
test edx, edx
je 0x40c96c
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x18]
and ecx, 0x10
test ecx, ecx
je 0x40c963
mov dword [ebp - 0xc], str.wscript.exe__B
jmp 0x40c96a
mov dword [ebp - 0xc], str.wscript.exe
jmp 0x40c98c
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x18]
and eax, 0x10
test eax, eax
je 0x40c985
mov dword [ebp - 0xc], str.cscript.exe__B
jmp 0x40c98c
mov dword [ebp - 0xc], str.cscript.exe
jmp 0x40c9b1
push str..hta
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40c9aa
mov dword [ebp - 0xc], str.mshta.exe
jmp 0x40c9b1
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x40ca68
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add esi, eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [esi + eax + 0xa]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jle 0x40ca43
mov edx, dword [ebp - 0x260]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0x40f2c8
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x380]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
jmp 0x40ca63
mov ecx, dword [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push str._s___s_
mov eax, dword [ebp - 0x380]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40cb04
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [esi + eax + 0xa]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x380], eax
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jle 0x40cae8
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
push 0x40f2dc
mov edx, dword [ebp - 0x380]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
jmp 0x40cb04
mov edx, dword [ebp - 0x260]
push edx
push str.__s_
mov eax, dword [ebp - 0x380]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x5fc], ecx
push 0x40f2ec
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40cb3a
push 0x40f2f4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40cbda
push 0x104
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
je 0x40cbda
mov edx, dword [ebp - 0x5fc]
mov byte [edx], 0
push 0x104
mov eax, dword [ebp - 0x5fc]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ecx, dword [ebp - 0x5fc]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x3d4], eax
mov edx, dword [ebp - 0x3d4]
mov dword [ebp - 0x370], edx
jmp 0x40cbaa
mov eax, dword [ebp - 0x370]
sub eax, 1
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
jl 0x40cbda
mov ecx, dword [ebp - 0x5fc]
add ecx, dword [ebp - 0x370]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x40cbd8
mov eax, dword [ebp - 0x5fc]
add eax, dword [ebp - 0x370]
mov byte [eax], 0
jmp 0x40cbda
jmp 0x40cb9b
mov ecx, dword [ebp - 0x5fc]
push ecx
call fcn.0040aaf8
add esp, 4
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov dword [ebp - 0x3cc], 1
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x3c4]
push ecx
mov edx, dword [ebp - 0x5fc]
push edx
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x380]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40cc74
push 0xffffffffffffffff
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x3cc]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x5fc]
push ecx
call fcn.0040ab22
add esp, 4
mov edx, dword [ebp - 0x5fc]
lea eax, [ebp - 0x128]
cmp edx, eax
je 0x40ccb2
cmp dword [ebp - 0x5fc], 0
je 0x40ccb2
mov ecx, dword [ebp - 0x5fc]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x40f2fc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x40ccd8
push str..cmd
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40cd02
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x18]
and eax, 0x10
test eax, eax
je 0x40cd02
mov ecx, dword [ebp - 0x4e0]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [ebp - 0x130]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x264]
push edx
push 0
mov eax, dword [0x412b68]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp - 0x25c]
push ecx
push 0
mov edx, dword [0x412b68]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x380]
push eax
push 0
mov ecx, dword [0x412b68]
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.0040cdcf
add esp, 8
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x6e0], edx
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 0
je 0x40cdb2
push 1
mov ecx, dword [ebp - 0x6dc]
call fcn.0040d3a0
mov dword [ebp - 0x70c], eax
jmp 0x40cdbc
mov dword [ebp - 0x70c], 0
mov ecx, dword [ebp - 0x3cc]
push ecx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
ret