Function at 0x401610
Capabilities:
Create directory
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Initialize winhttp library
Prepare http request
Receive http response
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405154
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x408004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x358], 0
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x401694
push 0x10
push str.Message_Box
push str.Error_Load_File_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x402afc
xor eax, eax
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
lea edx, [ecx + 2]
mov word [ebp - 0x234], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016c4
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x17
jb 0x401736
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x2e
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x17]
push str.z_amd64_ttechpnptls.sys
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x401757
push 0x17
push str.z_amd64_ttechpnptls.sys
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0x17
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401780
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x15
jb 0x4017eb
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x2a
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x15]
push str.z_amd64_ttechusbd.sys
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x40180c
push 0x15
push str.z_amd64_ttechusbd.sys
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0x15
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401830
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0xf
jb 0x40189b
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x1e
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0xf]
push str.z_ttechusbd.cat
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x4018bc
push 0xf
push str.z_ttechusbd.cat
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0xf
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4018e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0xf
jb 0x40194b
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x1e
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0xf]
push str.z_ttechusbd.inf
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x40196c
push 0xf
push str.z_ttechusbd.inf
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0xf
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401990
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x1b
jb 0x4019fb
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x36
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x1b]
push str.zusbredirectortechcsrv.exe
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x401a1c
push 0x1b
push str.zusbredirectortechcsrv.exe
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0x1b
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a40
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00403540
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0xb
jb 0x401aab
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x16
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0xb]
push str.zEXE64.exe
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x401acc
push 0xb
push str.zEXE64.exe
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x21c]
push 0xb
call fcn.00403d20
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x250], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401b17
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.00403540
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
mov edi, dword [ebp - 0x23c]
mov eax, edi
mov esi, dword [ebp - 0x240]
sub eax, esi
cmp eax, 1
jb 0x401b7d
mov ax, word [0x406468]
lea edx, [esi + 1]
cmp edi, 8
mov dword [ebp - 0x240], edx
cmovae ecx, dword [ebp - 0x250]
mov word [ecx + esi*2], ax
xor eax, eax
mov word [ecx + edx*2], ax
jmp 0x401b98
push 1
push 0x406468
mov byte [ebp - 0x21c], 0
push dword [ebp - 0x21c]
push 1
call fcn.00403d20
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x28c]
call fcn.00401470
cmp dword [eax + 0x14], 0x10
jb 0x401bb1
mov eax, dword [eax]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea ecx, [ebp - 0x2bc]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x278]
add esp, 8
test eax, eax
setne al
mov byte [ebp - 0x345], al
cmp edx, 0x10
jb 0x401c11
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401c01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401c01
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
mov al, byte [ebp - 0x345]
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test al, al
je 0x401c3c
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
push 0
cmovae eax, dword [ebp - 0x250]
push eax
call esi
test eax, eax
je 0x401d86
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x401c7c
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
push 0
cmovae eax, dword [ebp - 0x250]
push eax
call esi
test eax, eax
je 0x401d86
mov edx, dword [ebp - 0x23c]
mov eax, edx
mov ecx, dword [ebp - 0x240]
sub eax, ecx
cmp eax, 6
jb 0x401cd1
cmp edx, 8
lea esi, [ebp - 0x250]
push 0xc
cmovae esi, dword [ebp - 0x250]
lea edi, [ecx + 6]
push 0x40646c
mov dword [ebp - 0x240], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
jmp 0x401cf2
push 6
push 0x40646c
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x21c]
push 6
call fcn.00403d20
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x28c]
call fcn.00401470
cmp dword [eax + 0x14], 0x10
jb 0x401d0b
mov eax, dword [eax]
lea ecx, [ebp - 0x2bc]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x278]
add esp, 8
test eax, eax
setne al
mov byte [ebp - 0x345], al
cmp edx, 0x10
jb 0x401d65
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401d55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401d55
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
mov al, byte [ebp - 0x345]
add esp, 8
test al, al
je 0x401da2
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
push 0
cmovae eax, dword [ebp - 0x250]
push eax
call esi
test eax, eax
jne 0x401da2
push 0x10
push str.Message_Box
push str.Error_Load_File_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or esi, 0xffffffff
jmp 0x402a5f
xorps xmm0, xmm0
mov dword [ebp - 0x26c], 0
movq qword [ebp - 0x274], xmm0
push 0x30
mov dword [ebp - 0x2bc], 0x65
mov dword [ebp - 0x2b8], str.z_amd64_ttechpnptls.sys
mov dword [ebp - 0x2b4], 0x66
mov dword [ebp - 0x2b0], str.z_amd64_ttechusbd.sys
mov dword [ebp - 0x2ac], 0x67
mov dword [ebp - 0x2a8], str.z_ttechusbd.cat
mov dword [ebp - 0x2a4], 0x68
mov dword [ebp - 0x2a0], str.z_ttechusbd.inf
mov dword [ebp - 0x29c], 0x35
mov dword [ebp - 0x298], str.zusbredirectortechcsrv.exe
mov dword [ebp - 0x294], 0x34
mov dword [ebp - 0x290], str.zEXE64.exe
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
call fcn.00404327
mov esi, eax
lea edx, [ebp - 0x2bc]
add esp, 4
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 0x26c], ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
add edx, 8
mov dword [esi], eax
lea eax, [ebp - 0x28c]
mov dword [esi + 4], ecx
add esi, 8
cmp edx, eax
jne 0x401e74
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x270], esi
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x274]
mov dword [ebp - 0x334], edi
cmp edi, esi
je 0x402159
xor eax, eax
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
lea edx, [ecx + 2]
mov word [ebp - 0x268], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ee2
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00403540
mov byte [ebp - 4], 3
mov edi, dword [edi + 4]
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401f10
mov eax, dword [ebp - 0x254]
sub edx, ecx
mov ecx, dword [ebp - 0x258]
sub eax, ecx
sar edx, 1
cmp edx, eax
ja 0x401f75
cmp dword [ebp - 0x254], 8
lea eax, [edx + edx]
push eax
mov eax, dword [ebp - 0x334]
lea esi, [ebp - 0x268]
cmovae esi, dword [ebp - 0x268]
lea edi, [ecx + edx]
mov dword [ebp - 0x258], edi
push dword [eax + 4]
lea ecx, [esi + ecx*2]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov esi, dword [ebp - 0x21c]
jmp 0x401f90
push edx
push edi
mov byte [ebp - 0x35c], 0
lea ecx, [ebp - 0x268]
push dword [ebp - 0x35c]
push edx
call fcn.00403d20
lea edx, [ebp - 0x268]
lea ecx, [ebp - 0x28c]
call fcn.00401470
cmp dword [eax + 0x14], 0x10
jb 0x401fa9
mov eax, dword [eax]
lea ecx, [ebp - 0x2ec]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
mov edx, dword [ebp - 0x278]
add esp, 8
test eax, eax
setne al
mov byte [ebp - 0x345], al
cmp edx, 0x10
jb 0x402005
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401ff5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bfb
push edx
push ecx
call fcn.00404357
mov al, byte [ebp - 0x345]
add esp, 8
test al, al
je 0x4020fe
cmp dword [ebp - 0x254], 8
lea eax, [ebp - 0x268]
push 0xa
cmovae eax, dword [ebp - 0x268]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x334]
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4021db
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x4021db
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x350], eax
test eax, eax
je 0x4021db
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x4021db
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4021db
push 0
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x350]
push dword [ebp - 0x34c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4021d4
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x238], eax
jne 0x4021d4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x345], 0
je 0x4021db
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x402142
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402138
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bfb
push edx
push ecx
call fcn.00404357
add esp, 8
mov edi, dword [ebp - 0x334]
add edi, 8
mov dword [ebp - 0x334], edi
cmp edi, esi
jne 0x401eb2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402162
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.00403540
mov edx, dword [ebp - 0x23c]
mov eax, edx
mov ecx, dword [ebp - 0x240]
sub eax, ecx
cmp eax, 0xb
jb 0x40223b
cmp edx, 8
lea esi, [ebp - 0x250]
push 0x16
cmovae esi, dword [ebp - 0x250]
lea edi, [ecx + 0xb]
push str.zEXE64.exe
mov dword [ebp - 0x240], edi
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x40225c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push str.Message_Box
push str.Error_Load_File_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x4022eb
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402229
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bfb
push edx
push ecx
call fcn.00404357
add esp, 8
or esi, 0xffffffff
jmp 0x402a04
push 0xb
push str.zEXE64.exe
mov byte [ebp - 0x238], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x238]
push 0xb
call fcn.00403d20
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x28c]
call fcn.00401470
cmp dword [eax + 0x14], 0x10
jb 0x402275
mov eax, dword [eax]
lea ecx, [ebp - 0x2bc]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
mov edx, dword [ebp - 0x278]
add esp, 8
test eax, eax
setne al
mov byte [ebp - 0x345], al
cmp edx, 0x10
jb 0x4022d3
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4022c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4022c3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
mov al, byte [ebp - 0x345]
add esp, 8
test al, al
je 0x4022f3
push 0x10
push str.Message_Box
push str.Error_Load_File_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or esi, 0xffffffff
jmp 0x402a04
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x32c]
push 0x40
push 0
lea esi, [ebp - 0x250]
mov dword [ebp - 0x330], 0x44
cmovae esi, dword [ebp - 0x250]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x330]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40236b
push 0x10
push str.Error
push str.Failed_to_run_the_executable_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x402a04
cmp dword [ebp - 0x33c], 0
je 0x4029ec
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2d4]
push 0x17
mov dword [ebp - 0x2d4], 0
push str.Unable_to_get_public_IP
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0xf
mov byte [ebp - 0x2d4], 0
call fcn.004036a0
push 0
push 0
push 0
push 0
push str.A_WinHTTP_Example_Program_1.0
mov dword [ebp - 0x358], 1
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x4024ff
push 0
push 0x50
push str.api.ipify.org
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 0x354], eax
test eax, eax
je 0x4024f7
push 0
push 0
push 0
push 0
push 0
push 0x406338
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
test edi, edi
je 0x4024ef
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4024ec
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x4024ec
mov dword [ebp - 0x238], 0
nop dword [eax + eax]
lea eax, [ebp - 0x334]
mov dword [ebp - 0x334], 0
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x4024e6
mov eax, dword [ebp - 0x334]
inc eax
push eax
call fcn.00404365
mov ecx, dword [ebp - 0x334]
mov esi, eax
inc ecx
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x334]
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4024cb
push esi
call fcn.00404322
add esp, 4
cmp dword [ebp - 0x334], 0
ja 0x402460
jmp 0x4024e6
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4024d0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x2d4]
call fcn.004036a0
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push edi
call esi
push dword [ebp - 0x354]
call esi
push dword [ebp - 0x34c]
call esi
mov ecx, dword [ebp - 0x2c0]
mov eax, ecx
mov edx, dword [ebp - 0x2c4]
sub eax, edx
cmp eax, 9
jb 0x40259b
cmp ecx, 0x10
lea esi, [ebp - 0x2d4]
lea eax, [edx + 9]
cmovae esi, dword [ebp - 0x2d4]
mov dword [ebp - 0x2c4], eax
cmp esi, 0x4064cd
jae 0x402559
lea eax, [esi + edx]
cmp eax, str.Your_IP:
jb 0x402559
cmp esi, str.Your_IP:
ja 0x40254f
xor edi, edi
jmp 0x40255e
mov edi, esi
sub edi, str.Your_IP:
jmp 0x40255e
mov edi, 9
lea eax, [edx + 1]
push eax
lea ecx, [esi + 9]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
push edi
push str.Your_IP:
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, 9
lea ecx, [esi + edi]
sub eax, edi
push eax
lea eax, [edi + 0x4064cd]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
lea eax, [ebp - 0x2d4]
jmp 0x4025ba
push 9
sub esp, 8
mov byte [ebp - 0x238], 0
lea ecx, [ebp - 0x2d4]
push dword [ebp - 0x238]
push 9
call fcn.00404020
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x27c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebp - 0x334], 2
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2c0]
cmp edx, 0x10
jb 0x40264a
mov ecx, dword [ebp - 0x2d4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402640
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402640
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
add esp, 8
mov eax, dword [ebp - 0x33c]
mov dword [0x408590], eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x340]
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0xf
mov byte [ebp - 0x2d4], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4029b0
nop dword [eax + eax]
cmp dword [ebp - 0x21c], 0x103
jne 0x4029b0
cmp dword [ebp - 0x278], 0x10
lea ecx, [ebp - 0x28c]
mov esi, dword [ebp - 0x27c]
jb 0x4026bf
mov edi, dword [ebp - 0x28c]
add esi, edi
jmp 0x4026c7
add esi, ecx
lea edi, [ebp - 0x28c]
xor eax, eax
mov dword [ebp - 0x268], 0
mov word [ebp - 0x268], ax
mov edx, 7
mov eax, esi
mov dword [ebp - 0x254], edx
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x258], ecx
cmp eax, edx
jbe 0x40271b
mov byte [ebp - 0x358], cl
lea ecx, [ebp - 0x268]
push dword [ebp - 0x358]
push eax
call fcn.00404170
mov edx, dword [ebp - 0x254]
xor ecx, ecx
mov dword [ebp - 0x258], ecx
lea eax, [ebp - 0x268]
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 7
cmp edi, esi
je 0x402798
nop
movsx ax, byte [edi]
movzx eax, ax
mov dword [ebp - 0x238], eax
cmp ecx, edx
jae 0x40276d
lea eax, [ecx + 1]
cmp edx, 8
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x268]
cmovae eax, dword [ebp - 0x268]
mov word [eax + ecx*2], dx
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x402787
push eax
mov byte [ebp - 0x354], 0
push dword [ebp - 0x354]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004037e0
mov edx, dword [ebp - 0x254]
inc edi
mov ecx, dword [ebp - 0x258]
cmp edi, esi
jne 0x402730
mov eax, edx
mov byte [ebp - 4], 8
sub eax, ecx
cmp eax, 0x24
jb 0x402847
cmp edx, 8
lea esi, [ebp - 0x268]
lea eax, [ecx + 0x24]
cmovae esi, dword [ebp - 0x268]
lea edx, [ecx + ecx]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x350], esi
cmp esi, 0x406518
jae 0x4027f5
lea eax, [esi + edx]
cmp eax, str.USB_Redirector_Technician_Edition__
jb 0x4027f5
cmp esi, str.USB_Redirector_Technician_Edition__
ja 0x4027e9
xor edi, edi
jmp 0x4027fa
mov edi, esi
sub edi, str.USB_Redirector_Technician_Edition__
sar edi, 1
jmp 0x4027fa
mov edi, 0x24
lea eax, [edx + 2]
push eax
lea ecx, [esi + 0x48]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
lea esi, [edi + edi]
push esi
push str.USB_Redirector_Technician_Edition__
push dword [ebp - 0x350]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x350]
mov eax, 0x24
sub eax, edi
add ecx, esi
add eax, eax
push eax
lea eax, [edi*2 + 0x406518]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
lea eax, [ebp - 0x268]
jmp 0x402866
push 0x24
sub esp, 8
mov byte [ebp - 0x34c], 0
lea ecx, [ebp - 0x268]
push dword [ebp - 0x34c]
push 0x24
call fcn.00403eb0
or dword [ebp - 0x334], 4
xor ecx, ecx
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2a4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x294], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x4028f9
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4028ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bfb
push edx
push ecx
call fcn.00404357
add esp, 8
cmp dword [ebp - 0x290], 8
lea eax, [ebp - 0x2a4]
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
cmovae eax, dword [ebp - 0x2a4]
push eax
push 0
call esi
mov ecx, eax
test ecx, ecx
jne 0x40292c
push 0x406520
push eax
call esi
mov ecx, eax
test ecx, ecx
je 0x402955
cmp dword [ebp - 0x290], 8
lea eax, [ebp - 0x2a4]
cmovae eax, dword [ebp - 0x2a4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x401410
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x402995
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40298b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bfb
push edx
push ecx
call fcn.00404357
add esp, 8
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x340]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x402690
mov edx, dword [ebp - 0x278]
cmp edx, 0x10
jb 0x4029ec
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4029e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4029e2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
add esp, 8
push dword [ebp - 0x344]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x340]
call esi
xor esi, esi
mov edx, dword [ebp - 0x274]
test edx, edx
je 0x402a5f
mov ecx, dword [ebp - 0x26c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x402a37
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402aea
push ecx
push edx
call fcn.00404357
add esp, 8
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov edx, dword [ebp - 0x23c]
cmp edx, 8
jb 0x402a9b
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402a91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402aea
push edx
push ecx
call fcn.00404357
add esp, 8
mov edx, dword [ebp - 0x220]
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
cmp edx, 8
jb 0x402afa
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402af0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402af0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404357
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404314
mov esp, ebp
pop ebp
ret