Function at 0x45b480
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Create process suspended
Encode data using xor
Get file size
Read file on windows
Resume thread
Schedule task via at
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x11b8
call fcn.00461a80
push ebx
mov ebx, ecx
push ebp
push esi
mov al, byte [ebx]
push edi
test al, al
jne 0x45c819
call fcn.0045cb60
mov byte [ebx + 0x1135], al
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebx + 0x10c8], eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x11cc]
mov dword [0x732f4c], eax
lea eax, [ebx + 0x10cc]
push 0x20
push ecx
push eax
call fcn.00462088
add esp, 0xc
mov ecx, ebx
mov byte [ebx + 0x10eb], 0
push 0x104
push 0x732e38
call fcn.0045cc00
push 0
push 0x732e38
call fcn.00462042
add esp, 8
cmp eax, 0xffffffff
jne 0x45b549
push 0
push 0x732e38
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x45b549
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4764b0
call fcn.004609f0
add esp, 4
add ebx, 0x28
push eax
push ebx
call fcn.0045c9d0
add esp, 0xc
mov eax, 0x6f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
push 0x475d4c
push 0x732e38
call esi
push 0x4764a0
call fcn.004609f0
add esp, 4
push eax
push 0x732e38
call esi
mov eax, dword [ebx + 0x28]
lea ebp, [ebx + 0x28]
cmp eax, 0xffffffff
jne 0x45b742
mov edi, 0x732e38
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x1030], 0
mov dword [ebp + 0x1034], 0x3e8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x45b5de
cmp byte [0x732e39], 0x3a
je 0x45b5de
lea edx, [esp + 0x4c0]
push 0x104
push edx
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x4c0]
push 0x5c
push eax
call fcn.00461fd0
add esp, 8
lea edx, [eax + 1]
test eax, eax
jne 0x45b5e5
lea edx, [esp + 0x4c0]
mov edi, 0x732e38
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80000080
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4d4]
push 0xc0000000
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
je 0x45b742
lea edi, [ebp + 0x101c]
push edi
call dword [sym.imp.kernel32.dll_GetLocalTime]
xor edx, edx
xor eax, eax
mov dx, word [ebp + 0x102a]
mov ax, word [ebp + 0x1028]
push edx
xor ecx, ecx
mov cx, word [ebp + 0x1026]
xor edx, edx
mov dx, word [ebp + 0x1024]
push eax
push ecx
xor eax, eax
mov ax, word [ebp + 0x1022]
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x101e]
mov dx, word [edi]
push eax
push ecx
push edx
push 0x476450
lea esi, [ebp + 0x1c]
call fcn.00460980
add esp, 4
push eax
push esi
call fcn.0046105f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x1034]
not ecx
dec ecx
cmp eax, 0x3e7
mov edi, ecx
jne 0x45b6b9
xor edi, edi
mov eax, dword [ebp + 0x1030]
test eax, eax
je 0x45b6f2
test edi, edi
jle 0x45b72c
mov eax, esi
mov esi, 0xffffffe4
sub esi, ebp
mov ecx, 2
mov edx, dword [ebp + 0x1030]
add edx, ecx
mov dword [ebp + 0x1030], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [esi + eax]
cmp edx, edi
jl 0x45b6d5
jmp 0x45b72c
test edi, edi
mov dword [ebp + 0x102c], 0x58a
jle 0x45b72c
mov eax, esi
mov esi, 0xffffffe4
sub esi, ebp
mov edx, dword [ebp + 0x102c]
lea ecx, [edx + edx*2 + 1]
mov dl, cl
mov dword [ebp + 0x102c], ecx
mov cl, byte [eax]
add dl, 0x46
xor cl, dl
mov byte [eax], cl
inc eax
lea ecx, [eax + esi]
cmp ecx, edi
jl 0x45b709
lea edx, [esp + 0x18]
push 0
push edx
lea eax, [ebp + 0x1c]
push edi
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push 0x476434
push 0x1f
push 0x476408
call fcn.00460980
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov ecx, dword [esp + 0x11dc]
mov edx, dword [ebx + 0x10c8]
add esp, 0x10
push fcn.0045afd0
push ecx
push edx
push 0x4763c8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x14
call fcn.0045dff0
call fcn.0045e0d0
mov ecx, ebx
call fcn.0045d3c0
test eax, eax
jne 0x45b7c9
push 0x4763ac
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov eax, 0x73
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0
mov ecx, ebx
call fcn.0045d4c0
test eax, eax
jne 0x45b869
push 0x476398
call fcn.004609f0
add esp, 4
push eax
push 0
push 0x100002
call dword [sym.imp.kernel32.dll_OpenEventA]
mov esi, eax
test esi, esi
jne 0x45b822
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x476384
push ebp
call fcn.0045c9d0
add esp, 0xc
mov eax, 0x6e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push esi
call dword [sym.imp.kernel32.dll_SetEvent]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x251c
mov ecx, ebx
call fcn.0045d4c0
test eax, eax
jne 0x45b852
pop edi
pop esi
pop ebp
mov eax, 0x6e
pop ebx
add esp, 0x11b8
ret 4
push 0x476364
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
and eax, 0xfff00000
mov dword [esp + 0x18], eax
push 0
push 0
lea eax, [esp + 0x38]
push 1
push eax
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 1
call esi
test eax, eax
mov dword [ebx + 0x1140], eax
jne 0x45b8bf
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x476340
jmp 0x45b90c
push 0
push 0
lea ecx, [esp + 0x38]
push 1
push ecx
call esi
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x45b8e5
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x47631c
jmp 0x45b90c
push 0
push 0
lea edx, [esp + 0x38]
push 1
push edx
call esi
test eax, eax
mov dword [ebx + 0x113c], eax
jne 0x45b93a
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4762f8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
mov dword [0x732f48], 2
mov eax, 0xab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x4762f0
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
lea eax, [esp + 0x1b8]
mov ecx, ebx
push 0x104
push eax
call fcn.0045cc50
mov edi, 0x475d4c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1b8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4762dc
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004609f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00462042
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45ba15
lea ecx, [esp + 0x1b8]
push ecx
push 0x4762c8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
mov eax, 0x99
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
lea edx, [esp + 0x1b8]
push 1
lea ecx, [ebx + 0x1080]
push edx
mov byte [esp + 0x1a], 0
call fcn.0045fa90
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
test al, al
jne 0x45bbe4
mov eax, dword [ebx + 0x10c4]
mov byte [esp + 0x13], 0
cmp eax, 8
jne 0x45ba5b
call esi
cmp eax, 0x80090006
jne 0x45ba5b
mov byte [esp + 0x13], 1
call esi
mov edi, dword [ebx + 0x10c4]
lea eax, [esp + 0x1b8]
push eax
call esi
push eax
push edi
push 0x4762ac
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x14
lea ecx, [esp + 0x1b8]
push 0
push 0x80
push 3
push 0
push 3
push DirectSoundCreate
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45bad1
lea edx, [esp + 0x1b8]
push edx
call esi
push eax
push 0x476294
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x10
jmp 0x45bb3f
push 0
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push 0x476284
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
push 2
push 0
push 0xfffffffffffffffc
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x4c]
push 0
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [esp + 0x14]
push edx
push 0x476274
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, byte [esp + 0x13]
test al, al
je 0x45bbbb
mov al, byte [ebx + 0x1135]
test al, al
jne 0x45bb85
call fcn.0045e640
test al, al
je 0x45bb85
lea eax, [esp + 0x1b8]
push 1
push eax
lea ecx, [ebx + 0x1080]
call fcn.0045fa90
test al, al
jne 0x45bb9c
cmp dword [ebx + 0x10c4], 8
jne 0x45bb97
call esi
cmp eax, 0x80090006
jne 0x45bb97
pop edi
pop esi
pop ebp
mov eax, 0x9b
pop ebx
add esp, 0x11b8
ret 4
mov byte [esp + 0x12], 1
push 0x47625c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov al, byte [esp + 0x1a]
add esp, 8
test al, al
je 0x45bbe4
push 0x476238
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov eax, 0x7c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x476230
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x58]
mov edx, dword [ebx + 0x10c8]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], ecx
add esp, 8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x24], ecx
push edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebx + 0x1140]
push eax
lea eax, [ebx + 0x10cc]
push ecx
push eax
push edx
push 0x476218
call fcn.004609f0
add esp, 4
push eax
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.user32.dll_wsprintfA]
lea ecx, [esp + 0x2d8]
push ecx
call fcn.004608d0
mov dword [esp + 0x34], eax
lea edi, [esp + 0x2dc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
lea esi, [esp + 0x5c8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + 4]
test eax, eax
jle 0x45bcb9
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
xor eax, eax
mov al, byte [edi]
inc edi
push eax
push 0x476210
push esi
call dword [sym.imp.user32.dll_wsprintfA]
add esi, eax
mov eax, dword [esp + 0x24]
add esp, 0xc
dec eax
mov dword [esp + 0x18], eax
jne 0x45bc97
lea edx, [esp + 0x1c]
lea eax, [esp + 0x50]
push edx
push eax
push 0
push 0
push 0
push 1
push 0
lea ecx, [esp + 0x5e4]
push 0
lea edx, [esp + 0x1d8]
push ecx
push edx
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x45bd36
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [esp + 0x1bc]
push eax
push ecx
push 0x4761e8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x14
mov dword [0x732f48], 2
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x4761e0
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov edx, dword [ebx + 0x1140]
mov eax, dword [esp + 0x24]
add esp, 8
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x44], edx
push 0xffffffffffffffff
push 0
push ecx
push 2
mov dword [esp + 0x58], eax
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
je 0x45bdef
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
jne 0x45bdae
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x4761bc
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push ecx
push 0x476198
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov edx, dword [esp + 0x28]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0xc
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x476190
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 8
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call esi
lea eax, [esp + 0x3bc]
push 0x104
push eax
mov ecx, ebx
call fcn.0045cc00
mov edi, 0x475d4c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x476184
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0x10cc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004609f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3bc]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x3bc]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebx + 0x1080]
call fcn.0045fa90
test al, al
jne 0x45bf1e
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
mov ebx, dword [ebx + 0x10c4]
call esi
push eax
push ebx
push 0x47616c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x10
mov eax, 0x78
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
mov ecx, dword [0x475d84]
push ecx
call fcn.004609f0
add esp, 4
add eax, 5
lea edx, [esp + 0x9c8]
lea ecx, [ebx + 0x1080]
push eax
push 0x7ff
lea eax, [esp + 0x3c4]
push edx
push eax
call fcn.0045fea0
test al, al
jne 0x45bf90
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
mov ebx, dword [ebx + 0x10c4]
call esi
push eax
push ebx
push 0x47614c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x10
mov eax, 0x82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x476140
call fcn.00460980
add esp, 4
lea ecx, [esp + 0x9c8]
lea edx, [esp + 0x94]
mov esi, eax
push ecx
push 0x20
push edx
push 0x476134
call fcn.00460980
add esp, 4
push eax
push 0x476124
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460c20
lea eax, [ebx + 0x10cc]
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.00461e3b
add esp, 0x20
test eax, eax
je 0x45c017
push 0x47610c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov eax, 0x8e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
lea ecx, [esp + 0x9c8]
push ecx
push 1
push 0x476100
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460bb0
add esp, 0x10
lea edx, [esp + 0x9c8]
mov dword [0x475d88], eax
push edx
push 0x186a0
push 0x4760f0
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460bb0
add esp, 0x10
mov dword [0x732f50], eax
lea eax, [esp + 0x9c8]
push eax
push 0
push 0x4760e0
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460bb0
add esp, 0x10
lea ecx, [esp + 0x9c8]
mov dword [0x732f54], eax
push ecx
push 0
push 0x4760cc
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460bb0
add esp, 0x10
lea edx, [esp + 0x9c8]
shr eax, 1
not al
push edx
and al, 1
push 0x3e8
push 0x4760b4
mov byte [ebx + 0x25], al
call fcn.004609f0
add esp, 4
push eax
push esi
call fcn.00460bb0
mov dword [ebx + 0x1138], eax
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x9d8]
rep stosd dword es:[edi], eax
push 0x4760ac
call fcn.004609f0
add esp, 0x14
push eax
push ebp
call fcn.0045c9d0
add esp, 8
lea eax, [esp + 0xb4]
mov ecx, ebx
push 0x104
push eax
call fcn.0045cc00
mov edi, 0x475d4c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
push 0x47609c
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004609f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xb4]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x732f6c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x45c220
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 4]
mov cl, byte [esi + 3]
push eax
xor edx, edx
mov dl, byte [esi + 2]
push ecx
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 1]
mov cl, byte [esi]
push edx
push eax
push ecx
push 0x476078
call fcn.004609f0
mov edx, dword [0x732f6c]
add esp, 4
add edx, 0x28
push eax
push edx
call fcn.0045c9d0
mov eax, dword [0x732f6c]
add esp, 0x1c
test eax, eax
je 0x45c220
xor eax, eax
xor ecx, ecx
mov al, byte [edi + 4]
mov cl, byte [edi + 3]
push eax
xor edx, edx
mov dl, byte [edi + 2]
push ecx
xor eax, eax
xor ecx, ecx
mov al, byte [edi + 1]
mov cl, byte [edi]
push edx
push eax
push ecx
push 0x476054
call fcn.004609f0
mov edx, dword [0x732f6c]
add esp, 4
add edx, 0x28
push eax
push edx
call fcn.0045c9d0
add esp, 0x1c
push 0x47603c
call fcn.004609f0
add esp, 4
push eax
push 0x476028
call fcn.00460980
add esp, 4
push eax
call edi
push eax
call esi
push 0x476020
mov dword [ebx + 0x20], eax
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
lea eax, [esp + 0xbc]
push 0
push eax
call fcn.00462042
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45c341
lea ecx, [esp + 0xb4]
push 0x104
push ecx
mov ecx, ebx
call fcn.0045cc00
mov edi, 0x475d4c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x476010
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004609f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xbc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00462042
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45c341
lea ecx, [esp + 0xb4]
push ecx
push 0x475ff4
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
mov dword [0x732f48], 2
mov eax, 0x9a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
lea edx, [esp + 0xb4]
push 1
push edx
lea ecx, [ebx + 0x1080]
call fcn.0045fa90
test al, al
jne 0x45c3a7
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
mov ebx, dword [ebx + 0x10c4]
lea eax, [esp + 0xb4]
push eax
call esi
push eax
push ebx
push 0x4762ac
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x14
mov dword [0x732f48], 2
mov eax, 0x7a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x475fec
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
lea ecx, [ebx + 0x1064]
call fcn.0045f490
test al, al
jne 0x45c3d7
push 0x475fd8
jmp 0x45c59c
push 0x475fd0
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
mov edx, dword [ebx + 0x1140]
and esi, 0xfff00000
rep stosd dword es:[edi], eax
xor ecx, ecx
push edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [ebx + 0x1140]
mov ecx, dword [ebx + 0x113c]
push eax
lea eax, [ebx + 0x10cc]
lea edi, [ebx + 0x1064]
push ecx
push eax
mov ecx, edi
call fcn.0045f2b0
push eax
mov ecx, edi
call fcn.0045f2a0
xor edx, edx
push eax
mov dl, byte [ebx + 0x1135]
mov eax, dword [ebx + 0x10c8]
push edx
push eax
push esi
push 0x475fac
call fcn.004609f0
add esp, 4
lea ecx, [esp + 0x2dc]
push eax
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edx, [esp + 0x2e4]
push edx
call fcn.004608d0
mov edx, eax
lea edi, [esp + 0x2e8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x2c
lea esi, [esp + 0x5c8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + 4]
test eax, eax
jle 0x45c4df
mov edi, eax
jmp 0x45c4c1
mov edx, dword [esp + 0x14]
xor eax, eax
mov al, byte [edx]
inc edx
push eax
push 0x476210
push esi
mov dword [esp + 0x20], edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
add esi, eax
dec edi
jne 0x45c4bd
push 0x475fa4
mov byte [esi], 0
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x50]
lea edx, [esp + 0x5c8]
push eax
push ecx
push 0
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0xd4]
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x45c56c
lea ecx, [esp + 0x2bc]
lea edx, [esp + 0xb4]
push ecx
push edx
push 0x475f84
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0x10
mov dword [0x732f48], 2
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
mov eax, dword [esp + 0x24]
push eax
push 0x475f78
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
lea ecx, [ebx + 0x1064]
call fcn.0045f5d0
test eax, eax
jne 0x45c5ca
push 0x475f64
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov dword [0x732f48], 2
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push eax
push 0x475f4c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov eax, dword [0x732f54]
add esp, 0xc
test eax, eax
jne 0x45c623
lea ecx, [esp + 0xb4]
push 0x475f38
push ecx
call fcn.0045f0d0
add esp, 8
test al, al
jne 0x45c623
mov edx, dword [esp + 0x1c]
push 7
push edx
call dword [sym.imp.kernel32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
mov eax, 0x7a
pop ebx
add esp, 0x11b8
ret 4
push 0x475f30
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov eax, dword [esp + 0x28]
add esp, 8
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
mov ecx, dword [ebx + 0x113c]
mov eax, dword [0x732f50]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x40]
push 0
push ecx
push 2
mov dword [esp + 0x50], edx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
je 0x45c6a0
mov edx, dword [0x732f50]
push edx
push 0x475f18
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 0xc
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x475f08
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
push 0x475f00
call fcn.004609f0
add esp, 0xc
push eax
push ebp
call fcn.0045c9d0
mov eax, dword [ebx + 0x1140]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x45c707
push 0x475ee8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x475ed4
call fcn.004609f0
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenEventA]
test eax, eax
je 0x45c746
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x475ec8
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
jmp 0x45c75a
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov dword [0x732f64], ecx
mov dword [0x732f68], edx
call fcn.0045e2e0
mov esi, eax
test esi, esi
jne 0x45c771
push 0xb
push 0x62d
call fcn.0045d600
push esi
push 0x475eb0
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov al, byte [ebx + 0x25]
add esp, 0xc
test al, al
je 0x45c7d5
mov eax, dword [ebx + 0x1138]
mov ecx, ebx
push eax
call fcn.0045cfb0
test al, al
jne 0x45c7d5
push 0x475e94
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov dword [0x732f48], 2
mov eax, 0xdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11b8
ret 4
push 0x475e8c
call fcn.004609f0
add esp, 4
push eax
push ebp
call fcn.0045c9d0
mov ecx, dword [ebx + 0x10c8]
push ecx
push 0x611
push 0x8b1
call fcn.0045f3c0
push 0x475e6c
call fcn.004609f0
add esp, 0x18
push eax
push ebp
call fcn.0045c9d0
add esp, 8
mov byte [ebx], 1
pop edi
pop esi
pop ebp
mov eax, 0x755
pop ebx
add esp, 0x11b8
ret 4