Function at 0x40d920
Capabilities:
Create process on windows
Enumerate processes
Get file size
Initialize winhttp library
Prepare http request
Read file on windows
Read http header
Receive http response
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56597a
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3004
call fcn.00548050
mov eax, dword [0x5c6fc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2ed4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2ee4], eax
cmp dword [0x5d043c], 0
jne 0x40e97f
mov dword [0x5d043c], 1
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea esi, [edi + edi]
push esi
call fcn.0054e885
mov dword [ebp - 0x2ed0], eax
push esi
push 0
push eax
call fcn.0054a720
add esp, 0x10
push edi
push dword [ebp - 0x2ed0]
push 0xffffffffffffffff
push dword [ebp - 0x2ee4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x7e2
mov esi, dword [ebp - 0x2ed4]
mov ecx, esi
call fcn.00402cc0
mov dword [ebp - 0x2ee8], eax
push 0x7e3
mov ecx, esi
call fcn.00402cc0
mov dword [ebp - 0x2ed8], eax
push 0x7e4
mov ecx, esi
call fcn.00402cc0
mov dword [ebp - 0x2ee0], eax
push 0xc8
push 0
lea eax, [ebp - 0xdc]
push eax
call fcn.0054a720
add esp, 0xc
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2ee4], eax
mov dword [ebp - 0x2f4c], eax
mov dword [ebp - 4], 1
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2f18], eax
mov byte [ebp - 4], 3
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2f08], eax
mov byte [ebp - 4], 5
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x2ef8], edi
mov dword [ebp - 0x2f50], edi
mov byte [ebp - 4], 7
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x2ef4], esi
mov dword [ebp - 0x2f38], esi
mov byte [ebp - 4], 9
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2f04], eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2f00], 1
mov dword [ebp - 0x2efc], 0
mov dword [ebp - 0x2f28], 0
mov dword [ebp - 0x2f40], 4
mov dword [ebp - 0x2f3c], 0
push 0x1000
push 0
lea eax, [ebp - 0x126c]
push eax
call fcn.0054a720
add esp, 0xc
push 0x7ff
lea eax, [ebp - 0x126c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x2e
lea eax, [ebp - 0x126c]
push eax
call fcn.005493c5
add esp, 8
test eax, eax
je 0x40db7d
mov dword [eax + 2], 0x700075
mov dword [eax + 6], 0x64
jmp 0x40dbab
lea ecx, [ebp - 0x126c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40db86
mov eax, dword [str..upd]
mov dword [ecx], eax
mov eax, dword [0x5a86bc]
mov dword [ecx + 4], eax
mov ax, word [0x5a86c0]
mov word [ecx + 8], ax
push 0x190
push 0
lea eax, [ebp - 0x26c]
push eax
call fcn.0054a720
push 0x5c
push 0x5d0510
call fcn.005493c5
add esp, 0x14
test eax, eax
je 0x40dbf1
lea ecx, [eax + 2]
lea edx, [ebp - 0x26c]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
mov word [ecx + edx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40dbe0
jmp 0x40dc17
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ecx + 0x5d0510]
mov word [ebp + ecx - 0x26c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40dc00
mov dword [ebp - 0x2c98], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x2ec8], eax
cmp eax, 0xffffffff
jne 0x40dc4f
push 0
push 0x5a8498
push 0x5a84a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40dced
lea ecx, [ebp - 0x2c98]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40dce1
mov edi, dword [ebp - 0x2ec8]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x26c]
lea eax, [ebp - 0x2c74]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40dca6
test dx, dx
je 0x40dca2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40dca6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40dc80
xor eax, eax
jmp 0x40dcab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40dcc3
push dword [ebp - 0x2c90]
push eax
push 1
call esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x2c98]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40dc71
mov esi, dword [ebp - 0x2ef4]
mov edi, dword [ebp - 0x2ef8]
push dword [ebp - 0x2ec8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 9
mov ecx, dword [ebp - 0x2ed4]
call fcn.00418e78
push 2
push 0xe1
push 0
mov eax, dword [ebp - 0x2ed4]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 9
mov ecx, dword [0x5d4568]
call fcn.00418e78
mov eax, dword [0x5d4568]
test eax, eax
je 0x40dd2b
mov eax, dword [eax + 0x20]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x5d4568]
test eax, eax
je 0x40dd4a
mov eax, dword [eax + 0x20]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov byte [ebp - 4], 0xc
wait
mov ecx, dword [ebp - 0x2ee8]
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
push 1
mov ecx, dword [ebp - 0x2ee8]
call fcn.004079e0
mov ecx, dword [ebp - 0x2ed8]
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x2ee0]
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
push 0x5d0448
push 0x5a86c4
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, esp
mov dword [ebp - 0x2f0c], esp
lea eax, [ebp - 0xdc]
push eax
call fcn.00406440
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2ed8]
call fcn.00407c40
push ecx
mov ecx, esp
mov dword [ebp - 0x2ec8], esp
push 0x5a86d4
call fcn.00406440
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2ee0]
call fcn.00407c40
push 0
mov ecx, dword [ebp - 0x2ee8]
call fcn.0040b450
push 0x1800
push 0
lea eax, [ebp - 0x2a6c]
push eax
call fcn.0054a720
push 0x3c
push 0
lea eax, [ebp - 0x2f8c]
push eax
call fcn.0054a720
add esp, 0x18
mov dword [ebp - 0x2f8c], 0x3c
lea eax, [ebp - 0x166c]
mov dword [ebp - 0x2f58], eax
lea eax, [ebp - 0x266c]
mov dword [ebp - 0x2f7c], eax
lea eax, [ebp - 0x1e6c]
mov dword [ebp - 0x2f68], eax
lea eax, [ebp - 0x2a6c]
mov dword [ebp - 0x2f88], eax
lea eax, [ebp - 0x1a6c]
mov dword [ebp - 0x2f60], eax
lea eax, [ebp - 0x226c]
mov dword [ebp - 0x2f70], eax
mov dword [ebp - 0x2f6c], 0x200
mov dword [ebp - 0x2f5c], 0x200
mov dword [ebp - 0x2f84], 0x200
mov dword [ebp - 0x2f64], 0x200
mov dword [ebp - 0x2f78], 0x200
mov dword [ebp - 0x2f54], 0x200
lea eax, [ebp - 0x2f8c]
push eax
push SysReAllocStringLen
push 0
push dword [ebp - 0x2ed0]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_MSIE_8.0__Windows_NT_5.1__Trident_4.0__
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x2f0c], eax
test eax, eax
je 0x40e32a
push 0xbb8
push 0xbb8
push 0xbb8
push 0x1388
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
push 0
push dword [ebp - 0x2f74]
push dword [ebp - 0x2f7c]
push dword [ebp - 0x2f0c]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp - 0x2f10], eax
test eax, eax
je 0x40e315
push 0x100
push 0
push 0
push str.HTTP_1.1
push dword [ebp - 0x2f60]
push str.HEAD
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 0x2ed4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push 0
push dword [ebp - 0x2ed4]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea eax, [ebp - 0x2f3c]
push eax
lea eax, [ebp - 0x2f40]
push eax
lea eax, [ebp - 0x2f2c]
push eax
push 0
push 0x20000005
push dword [ebp - 0x2ed4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push dword [ebp - 0x2ed4]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 0x2f2c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5a8ce0]
movsd xmm1, qword [0x5a8c58]
movsd qword [ebp - 0x2f9c], xmm1
mulsd xmm0, xmm1
mulsd xmm0, xmm1
movsd qword [ebp - 0x2ff8], xmm0
sub esp, 8
movsd qword [esp], xmm0
push str._.2f
lea eax, [ebp - 0x2f18]
push eax
call fcn.00406c60
add esp, 0x10
push 0x100
push 0
push 0
push str.HTTP_1.1
push dword [ebp - 0x2f60]
push 0x5a878c
push dword [ebp - 0x2f10]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 0x2ef0], eax
test eax, eax
je 0x40e309
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [ebp - 0x2efc], eax
test eax, eax
je 0x40e2fd
push 0
push dword [ebp - 0x2ef0]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 0x2efc], eax
test eax, eax
je 0x40e2fd
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x126c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2f34], eax
movsd xmm0, qword [0x5a8c88]
movsd qword [ebp - 0x2f94], xmm0
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x2edc], 0
lea eax, [ebp - 0x2edc]
push eax
push dword [ebp - 0x2ef0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x40e2f1
mov eax, dword [ebp - 0x2edc]
test eax, eax
je 0x40e2f1
inc eax
push eax
call fcn.00410adb
add esp, 4
mov dword [ebp - 0x2eec], eax
test eax, eax
je 0x40e2f1
mov ecx, dword [ebp - 0x2edc]
inc ecx
push ecx
push 0
push eax
call fcn.0054a720
add esp, 0xc
lea eax, [ebp - 0x2f24]
push eax
push dword [ebp - 0x2edc]
push dword [ebp - 0x2eec]
push dword [ebp - 0x2ef0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x40e2d6
mov ecx, dword [ebp - 0x2f24]
mov dword [ebp - 0x2ec8], ecx
mov dword [ebp - 0x2f44], ecx
mov dword [ebp - 0x2f1c], 0
mov eax, dword [ebp - 0x2eec]
mov dword [ebp - 0x2f20], eax
nop dword [eax]
push 0
lea edx, [ebp - 0x2f1c]
push edx
push ecx
push eax
push dword [ebp - 0x2f34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2f1c]
mov ecx, dword [ebp - 0x2ec8]
sub ecx, eax
mov dword [ebp - 0x2ec8], ecx
mov dword [ebp - 0x2f44], ecx
add dword [ebp - 0x2f20], eax
test ecx, ecx
mov eax, dword [ebp - 0x2eec]
jne 0x40e170
mov eax, dword [ebp - 0x2f28]
add eax, dword [ebp - 0x2f24]
mov dword [ebp - 0x2f28], eax
movd xmm2, eax
cvtdq2pd xmm2, xmm2
shr eax, 0x1f
addsd xmm2, qword [eax*8 + 0x5a8ce0]
mov eax, dword [ebp - 0x2f2c]
test eax, eax
je 0x40e20a
movaps xmm1, xmm2
mulsd xmm1, qword [ebp - 0x2f94]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5a8ce0]
divsd xmm1, xmm0
cvttsd2si eax, xmm1
jmp 0x40e20f
mov eax, 0x63
mov dword [ebp - 0x2f30], eax
mulsd xmm2, qword [ebp - 0x2f9c]
mulsd xmm2, qword [ebp - 0x2f9c]
movsd qword [ebp - 0x2ecc], xmm2
movsd qword [ebp - 0x3000], xmm2
push eax
push 0x5a81e8
lea eax, [ebp - 0x2f04]
push eax
call fcn.00406c60
add esp, 4
movsd xmm0, qword [ebp - 0x2ecc]
movsd qword [esp], xmm0
push str._.2fMB
lea eax, [ebp - 0x2f08]
push eax
call fcn.00406c60
add esp, 0x10
push dword [ebp - 0x2f30]
mov ecx, dword [ebp - 0x2ee8]
call fcn.0040b450
push 0x5a87a4
lea eax, [ebp - 0x2f04]
push eax
lea eax, [ebp - 0x2f48]
push eax
call fcn.00410870
mov byte [ebp - 4], 0xf
add esp, 8
mov ecx, esp
mov dword [ebp - 0x2ed4], esp
lea edx, [ebp - 0x2f08]
push edx
push eax
push ecx
call fcn.00408d40
add esp, 0xc
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x2ee0]
call fcn.00407c40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f48]
call fcn.00406ec0
push dword [ebp - 0x2eec]
call fcn.00410ad6
add esp, 4
cmp dword [ebp - 0x2edc], 0
ja 0x40e0c0
push dword [ebp - 0x2f34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2ef0]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push dword [ebp - 0x2f10]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push dword [ebp - 0x2f0c]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp dword [ebp - 0x2efc], 0
jne 0x40e334
mov dword [ebp - 0x2f00], 0
wait
mov dword [ebp - 4], 0xb
jmp 0x40e418
mov eax, dword [ebp - 0x2ed0]
test eax, eax
je 0x40e42b
push eax
call fcn.0054c573
add esp, 4
push 0x5d0448
lea eax, [ebp - 0xdc]
cmp dword [ebp - 0x2f00], 0
je 0x40e828
push 0x5a87c4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov dword [ebp - 0x2ed0], esp
mov dword [ebp - 0x2ec8], esp
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, dword [ebp - 0x2ec8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xdc]
push eax
call fcn.004062b0
test al, al
jne 0x40e4c2
lea ecx, [ebp - 0xdc]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e4a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x2ec8]
call fcn.00406560
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2ed8]
call fcn.00407c40
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x126c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2ec8], eax
cmp eax, 0xffffffff
je 0x40e8b6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x2ee0], esi
push esi
call fcn.0054e885
mov dword [ebp - 0x2ed0], eax
push esi
push 0
push eax
call fcn.0054a720
add esp, 0x10
mov edi, esi
mov dword [ebp - 0x2f14], 0
mov esi, dword [ebp - 0x2ed0]
nop
push 0
lea eax, [ebp - 0x2f14]
push eax
push edi
push esi
push dword [ebp - 0x2ec8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x2f14]
test eax, eax
je 0x40e56d
add esi, eax
sub edi, eax
jne 0x40e540
push dword [ebp - 0x2ec8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - method.Cmd5.virtual_0], vtable.Cmd5.0
mov byte [ebp - 4], 0x16
push dword [ebp - 0x2ee0]
push dword [ebp - 0x2ed0]
lea ecx, [ebp - 0x2fac]
call fcn.00401ce0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x2ef4]
mov edi, dword [ebp - 0x2ef8]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e5d0
test dl, dl
je 0x40e5cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e5d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e5b0
xor eax, eax
jmp 0x40e5d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e777
mov eax, dword [0x5d4568]
test eax, eax
je 0x40e5e9
mov eax, dword [eax + 0x20]
push 0x1004
push dword [0x5c7814]
push 0x5a87dc
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40e815
mov dword [ebp - 0x2ec4], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x2ec8], eax
cmp eax, 0xffffffff
jne 0x40e642
push 0
push dword [0x5c7814]
push 0x5a84a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40e6ed
lea ecx, [ebp - 0x2ec4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40e6e1
mov edi, dword [ebp - 0x2ec8]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [eax]
nop dword [eax + eax]
lea ecx, [ebp - 0x26c]
lea eax, [ebp - 0x2ea0]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e6a6
test dx, dx
je 0x40e6a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e6a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e680
xor eax, eax
jmp 0x40e6ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e6c3
push dword [ebp - 0x2ebc]
push eax
push 1
call esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x2ec4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40e670
mov esi, dword [ebp - 0x2ef4]
mov edi, dword [ebp - 0x2ef8]
push dword [ebp - 0x2ec8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2fec], xmm0
movlpd qword [ebp - 0x2fe4], xmm0
movlpd qword [ebp - 0x2fdc], xmm0
movlpd qword [ebp - 0x2fd4], xmm0
movlpd qword [ebp - 0x2fcc], xmm0
movlpd qword [ebp - 0x2fc4], xmm0
movlpd qword [ebp - 0x2fbc], xmm0
movlpd qword [ebp - 0x2fb4], xmm0
movups xmmword [ebp - 0x3010], xmm0
mov dword [ebp - 0x2ff0], 0x44
lea eax, [ebp - 0x3010]
push eax
lea eax, [ebp - 0x2ff0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x126c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40e9a7
jmp 0x40e815
push 0x5d0448
push 0x5a87fc
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov dword [ebp - 0x2ed0], esp
mov dword [ebp - 0x2ec8], esp
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e9ae
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, dword [ebp - 0x2ec8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xdc]
push eax
call fcn.004062b0
test al, al
jne 0x40e802
lea ecx, [ebp - 0xdc]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e7e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x2ec8]
call fcn.00406560
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x2ed8]
call fcn.00407c40
mov byte [ebp - 4], 0xb
mov dword [ebp - method.Cmd5.virtual_0], vtable.Cmd5.0
jmp 0x40e8b6
push 0x5a87ac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov dword [ebp - 0x2ed0], esp
mov dword [ebp - 0x2ec8], esp
call fcn.00419f95
mov ecx, eax
test ecx, ecx
je 0x40e99d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, dword [ebp - 0x2ec8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xdc]
push eax
call fcn.004062b0
test al, al
jne 0x40e8a3
lea ecx, [ebp - 0xdc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e881
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x2ec8]
call fcn.00406560
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2ed8]
call fcn.00407c40
mov dword [0x5d043c], 0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x2f04]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e8e2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 7
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e900
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 5
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40e91b
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2f08]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e93c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2f18]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e95d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2ee4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40e97f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005478fb
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00406f20
push 0
call fcn.0054e86f
push 0x80004005
call fcn.00406f20
int3