Function at 0x42a500
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3ca0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xe0
mov eax, dword [0x52c018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea ecx, [ebx + 8]
mov esi, dword [ebx + 0x1c]
cmp esi, 0x10
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 0x18]
cmovae ecx, edi
cmp eax, 4
jne 0x42a67f
mov eax, dword [ecx]
mov edx, str.exit
cmp eax, dword [edx]
je 0x42a58e
cmp al, byte [edx]
jne 0x42a592
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x42a592
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x42a592
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x42a592
xor eax, eax
jmp 0x42a597
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42a67c
push eax
mov eax, dword [0x533960]
push dword [eax + 0x284]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0xe8], 0x44
mov word [ebp - 0xa6], ax
xorps xmm0, xmm0
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username___IM_work.exe
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], str.taskkill
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42a64c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x42b613
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
jmp 0x42b613
mov eax, dword [ebx + 0x18]
cmp esi, 0x10
lea ecx, [ebx + 8]
cmovae ecx, edi
cmp eax, 4
jne 0x42a823
mov eax, dword [ecx]
mov edx, str.kill
cmp eax, dword [edx]
je 0x42a6b8
cmp al, byte [edx]
jne 0x42a6bc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x42a6bc
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x42a6bc
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x42a6bc
xor eax, eax
jmp 0x42a6c1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42a823
push eax
mov eax, dword [0x533960]
push dword [eax + 0x284]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0xe8], 0x44
mov word [ebp - 0xa6], ax
xorps xmm0, xmm0
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username___IM_work.exe
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], str.taskkill
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42a776
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x42a79d
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x98], esp
push 0x17
push str.kill___terminateProcess
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push 3
push 0x518318
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0
call fcn.004109f0
add esp, 0x18
mov ecx, esp
push 0x1b
push str.MC:_KILL_no_work.exe_L1....
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
add esp, 0x18
jmp 0x42b613
mov eax, dword [0x533960]
cmp dword [eax + 0x2bc], 0
je 0x42a99f
mov ecx, 0x518960
call fcn.0042a450
test al, al
je 0x42b613
mov eax, dword [0x533960]
push 0
push dword [eax + 0x284]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0xe8], 0x44
mov word [ebp - 0xa6], ax
xorps xmm0, xmm0
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username____IM_work.exe
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], str.taskkill
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42a8f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x42a91c
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
sub esp, 0x18
mov ecx, esp
push 0x1b
push str.MC:_KILL_no_work.exe_L2....
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
mov ecx, esp
mov dword [ebp - 0x9c], esp
push 0x31
push str.session_locked__true___terminateProcess_taskkill
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
push 3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x518318
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0
call fcn.004109f0
add esp, 0x30
jmp 0x42b613
cmp byte [eax + 0x4bc], 0
jne 0x42aae8
mov ecx, 0x518960
call fcn.0042a450
test al, al
je 0x42b613
mov eax, dword [0x533960]
push 0
push dword [eax + 0x284]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0xe8], 0x44
mov word [ebp - 0xa6], ax
xorps xmm0, xmm0
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username____IM_work.exe
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], str.taskkill
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42aa6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x42aa93
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
sub esp, 0x18
mov ecx, esp
push 0x1b
push str.MC:_KILL_no_work.exe_L3....
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
mov ecx, esp
mov dword [ebp - 0x9c], esp
push 0x27
push str.active_media__false___terminateProcess
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 3
jmp 0x42a96c
mov ecx, 0x5335e8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ab02
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x34]
call fcn.00408530
push str.work.exe__321
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.004078c0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x54], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x42ab84
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ab7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcd0
push edx
push ecx
call fcn.004748b1
add esp, 8
mov ecx, 0x5335e8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x94], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42abb6
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x94]
call fcn.00408530
push 0x518960
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 7
call fcn.004078c0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x80]
cmp edx, 0x10
jb 0x42ac4f
mov ecx, dword [ebp - 0x94]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ac45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcd5
push edx
push ecx
call fcn.004748b1
add esp, 8
mov esi, dword [0x533960]
mov edx, 0x512695
add esi, 0x1a4
mov dword [ebp - 0x84], 0
mov ecx, esi
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], 0
call fcn.00409510
test al, al
jne 0x42adfd
push esi
mov edx, str.__server
lea ecx, [ebp - 0x34]
call fcn.00409220
add esp, 4
mov byte [ebp - 4], 0xa
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x42aca6
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
mov esi, dword [ebp - 0x38]
mov eax, esi
mov edx, dword [ebp - 0x3c]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x42acdb
lea eax, [edi + edx]
cmp esi, 0x10
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
lea esi, [eax + edx]
push esi
call fcn.004c8d50
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x42acf1
mov byte [ebp - 0x98], 0
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x98]
push edi
call fcn.004098a0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x42ad29
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ad1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcda
push edx
push ecx
call fcn.004748b1
add esp, 8
mov esi, dword [0x533960]
mov edx, 0x512695
add esi, 0x1bc
mov dword [ebp - 0x24], 0
mov ecx, esi
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.00409510
test al, al
jne 0x42adfd
push esi
mov edx, str.__thumbserver
lea ecx, [ebp - 0x34]
call fcn.00409220
add esp, 4
mov byte [ebp - 4], 0xb
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x42ad7a
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
mov esi, dword [ebp - 0x38]
mov eax, esi
mov edx, dword [ebp - 0x3c]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x42adaf
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
lea esi, [eax + edx]
push esi
call fcn.004c8d50
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x42adc5
mov byte [ebp - 0x98], 0
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x98]
push edi
call fcn.004098a0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x42adfd
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42adf3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcdf
push edx
push ecx
call fcn.004748b1
add esp, 8
lea ecx, [ebp - 0x4c]
call fcn.0040d440
mov edi, dword [ebx + 0x1c]
lea ecx, [ebx + 8]
mov edx, dword [ebx + 8]
cmp edi, 0x10
mov eax, dword [ebx + 0x18]
cmovae ecx, edx
cmp eax, 6
jne 0x42b4ee
mov eax, dword [ecx]
mov esi, str.reload
mov dword [ebp - 0x98], 2
cmp eax, dword [esi]
jne 0x42ae45
add ecx, 4
mov dword [ebp - 0x98], 0xfffffffe
add esi, 4
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x42ae70
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x42ae70
cmp dword [ebp - 0x98], 0xfffffffe
je 0x42ae6c
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x42ae70
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
jne 0x42ae70
xor eax, eax
jmp 0x42ae75
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42b4eb
sub esp, 0x18
mov ecx, esp
push 0x20
push str.Capturas_de_telas_recarregado...
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
call fcn.00408530
call fcn.0040cd00
add esp, 0x18
mov ecx, 0x518960
call fcn.0042a450
test al, al
je 0x42b034
mov eax, dword [0x533960]
push 0
push dword [eax + 0x284]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov word [ebp - 0xa6], ax
xorps xmm0, xmm0
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username____IM_work.exe
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xe8], 0x44
mov dword [ebp - 0xdc], str.taskkill
movups xmmword [ebp - 0x2c], xmm0
call edi
test eax, eax
jne 0x42af64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call esi
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x42af8d
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
sub esp, 0x18
mov ecx, esp
push 0x1b
push str.MC:_KILL_no_work.exe_L4....
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
mov ecx, esp
mov dword [ebp - 0x9c], esp
push 0x19
push str.reload___terminateProcess
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
push 3
push 0x518318
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 9
call fcn.004109f0
add esp, 0x18
mov ecx, esp
push 0x19
push str.reload___terminateProcess
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
add esp, 0x18
jmp 0x42b040
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0xd
mov eax, dword [0x533960]
cmp byte [eax + 0x4bc], 0
je 0x42b379
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
xorps xmm0, xmm0
mov dword [ebp - 0xe8], 0x44
cmovae eax, dword [ebp - 0x4c]
xor ecx, ecx
mov word [ebp - 0xa6], cx
mov word [ebp - 0xb8], cx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push ecx
push 0
push 0
push 0x200
push 1
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], 0x518960
movups xmmword [ebp - 0x2c], xmm0
call edi
test eax, eax
je 0x42b0f2
xor edi, edi
jmp 0x42b0fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, 0x512695
cmp eax, str.WAIT
jne 0x42b10d
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call esi
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
test edi, edi
jne 0x42b43a
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407ac0
push 0x14
push str.reload___executar__
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.0040a320
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov esi, esp
mov dword [ebp - 0x9c], esp
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x98], esi
push 0x512a60
call fcn.004078c0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0x10
mov ecx, esp
push 3
push 0x518318
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0xf
call fcn.004109f0
mov byte [ebp - 4], 0xe
add esp, 0x30
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x42b213
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b209
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bce4
push edx
push ecx
call fcn.004748b1
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edx, 0x10
jb 0x42b25d
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b253
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bce4
push edx
push ecx
call fcn.004748b1
add esp, 8
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407ac0
push 0x14
push str.reload___executar__
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.0040a320
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0x12
mov esi, esp
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x9c], esi
push 0x512a60
call fcn.004078c0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.0040cd00
mov edx, dword [ebp - 0x20]
add esp, 0x18
cmp edx, 0x10
jb 0x42b333
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b329
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bce9
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edx, 0x10
jb 0x42b379
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b36f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bce9
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x42b3ad
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b3a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
cmp edx, 0x10
jb 0x42b3f3
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b3e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42b427
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b41d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, 1
jmp 0x42bcb2
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x42b46e
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b464
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x42b4b4
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b4aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42bcb0
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bb44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcee
jmp 0x42bb44
mov eax, dword [ebx + 0x18]
cmp edi, 0x10
lea ecx, [ebx + 8]
cmovae ecx, edx
cmp eax, 5
jne 0x42bbfc
mov eax, dword [ecx]
mov esi, str.check
mov dword [ebp - 0x98], 1
cmp eax, dword [esi]
jne 0x42b525
add ecx, 4
mov dword [ebp - 0x98], 0xfffffffd
add esi, 4
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x42b550
cmp dword [ebp - 0x98], 0xfffffffd
je 0x42b54c
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x42b550
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x42b550
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
jne 0x42b550
xor eax, eax
jmp 0x42b555
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42bbfc
mov ecx, 0x518960
call fcn.0042a450
test al, al
je 0x42b655
sub esp, 0x18
mov ecx, esp
push 0x19
push str.check:_work_is_runing....
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0040cd00
mov edx, dword [ebp - 0x38]
add esp, 0x18
cmp edx, 0x10
jb 0x42b5cd
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b5c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x42b613
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b609
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42b427
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b641
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, 1
jmp 0x42bcb2
mov byte [ebp - 4], 0x14
mov eax, dword [0x533960]
cmp byte [eax + 0x4bc], 0
je 0x42bb4b
cmp byte [eax + 0x4bb], 0
je 0x42bb4b
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
xorps xmm0, xmm0
mov dword [ebp - 0xe8], 0x44
cmovae eax, dword [ebp - 0x4c]
xor ecx, ecx
mov word [ebp - 0xa6], cx
mov word [ebp - 0xb8], cx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xe8]
movlpd qword [ebp - 0xc0], xmm0
or dword [ebp - 0xbc], 1
push ecx
push 0
push 0
push 0x200
push 1
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xb6], xmm0
movlpd qword [ebp - 0xae], xmm0
mov dword [ebp - 0xdc], 0x518960
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42b718
xor esi, esi
jmp 0x42b720
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0x512695
cmp eax, str.WAIT
jne 0x42b737
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax + 0x284], xmm0
test esi, esi
jne 0x42ba9c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407ac0
push 0x13
push str.check___executar__
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0040a320
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0x16
mov esi, esp
mov dword [ebp - 0x9c], esp
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x98], esi
push 0x512a60
call fcn.004078c0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
push 3
push 0x518318
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0x16
call fcn.004109f0
mov byte [ebp - 4], 0x15
add esp, 0x30
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x42b84d
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b843
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcf3
push edx
push ecx
call fcn.004748b1
add esp, 8
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edx, 0x10
jb 0x42b897
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b88d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcf3
push edx
push ecx
call fcn.004748b1
add esp, 8
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407ac0
push 0x12
push str.check:_executar__
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.0040a320
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0x19
mov esi, esp
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x9c], esi
push 0x512a60
call fcn.004078c0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.0040cd00
mov edx, dword [ebp - 0x20]
add esp, 0x18
cmp edx, 0x10
jb 0x42b96d
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b963
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcf8
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edx, 0x10
jb 0x42b9b3
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b9a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcf8
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x42b9e7
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b9dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x42ba2d
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ba23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42b427
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b41d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, 1
jmp 0x42bcb2
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x42bad0
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bac6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x42bb16
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bb0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42bcb0
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bb44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
jmp 0x42bca8
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x42bb7f
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bb75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x42bbc5
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42bbbb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x42b427
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b41d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bcfd
jmp 0x42b41d
mov eax, dword [ebp - 0x38]
cmp eax, 0x10
jb 0x42bc38
mov ecx, dword [ebp - 0x4c]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x42bc28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edx
push ecx
call fcn.004748b1
mov edi, dword [ebx + 0x1c]
add esp, 8
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp eax, 0x10
jb 0x42bc86
mov ecx, dword [ebp - 0x64]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x42bc76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edx
push ecx
call fcn.004748b1
mov edi, dword [ebx + 0x1c]
add esp, 8
mov edx, dword [ebx + 8]
cmp edi, 0x10
jb 0x42bcb0
inc edi
mov eax, edx
cmp edi, 0x1000
jb 0x42bca6
mov edx, dword [edx - 4]
add edi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42bd02
push edi
push edx
call fcn.004748b1
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
int3