Function at 0x406e56
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x594
push ebx
push esi
mov dword [ebp + 0x54], ecx
push edi
lea ecx, [ebp - 0xf0]
call fcn.00433c24
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x406e9a
push dword [ebp + 0x68]
lea ecx, [ebp - 0xf0]
call fcn.0043de8d
mov eax, dword [ebp - 0xf0]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00433c24
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x406ebe
push esi
lea ecx, [ebp - 0xe8]
call fcn.0043de8d
mov esi, dword [ebp - 0xe8]
cmp dword [ebp + 0x78], ebx
jne 0x406ecc
lea eax, [ebp - 0xd0]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
jne 0x406ed9
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x10], eax
mov byte [ebp + 0x3b], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x47], bl
mov byte [ebp - 5], 1
mov byte [ebp - 0x37], bl
mov byte [ebp + 0x43], bl
mov byte [ebp + 0x48], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x29], bl
mov byte [ebp + 0x4b], bl
mov byte [ebp + 0x49], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x23], bl
call fcn.00433c24
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov byte [ebp - 0x35], bl
mov byte [ebp + 0x4a], bl
mov byte [ebp + 3], bl
mov byte [ebp - 0x2a], bl
mov byte [ebp + 0xa], 1
mov byte [ebp - 0x36], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x14], ebx
call fcn.00433c24
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x50], ebx
mov byte [ebp + 0x77], bl
call fcn.00433c24
lea ecx, [ebp - 0xa4]
call fcn.00433c24
lea ecx, [ebp - 0x88]
call fcn.00433c24
or dword [ebp - 0xbc], 0xffffffff
lea ecx, [ebp - 0x11c]
mov byte [ebp + 0xb], bl
mov dword [ebp - 0xe4], ebx
call fcn.00433c24
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x22c], 0x44
mov dword [ebp - 0x228], ebx
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x148], ebx
pop ecx
lea edi, [ebp - 0x1e8]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0x138]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp + 0x1c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc0], ebx
je 0x406fdd
test byte [0x4aa003], 3
je 0x406ff9
push 0x490684
lea ecx, [ebp - 0xc0]
call fcn.0043de8d
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x224], eax
cmp esi, ebx
je 0x40700e
cmp word [esi], 0x24
jne 0x40700e
mov dword [ebp - 0x10], 1
mov byte [ebp + 0x48], 1
cmp esi, ebx
push 2
mov dword [ebp - 0x78], ebx
pop edi
je 0x407092
xor ecx, ecx
cmp word [esi], 0x7c
jne 0x40702b
add dword [ebp + 0x68], edi
add esi, edi
inc ecx
mov dword [ebp - 0x78], ecx
jmp 0x40702c
inc ecx
cmp esi, ebx
je 0x407092
cmp word [esi], 0x2a
jne 0x407092
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x40704c
add dword [ebp + 0x68], edi
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x40705e
mov byte [ebp + 0x73], 0x11
jmp 0x407079
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x40706f
mov byte [ebp + 0x73], 0x12
jmp 0x407079
cmp ax, 0x2d
jne 0x40707c
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00402b47
test al, al
jne 0x407092
mov ebx, ecx
jmp 0x40a612
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
cmp byte [ebp + 0x73], bl
pop ecx
jne 0x407135
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
cmp dword [ebp - 0x74], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x50], eax
je 0x4070c3
cmp byte [ebp + 0x73], bl
jne 0x407208
cmp word [eax], 0x2d
mov esi, eax
jne 0x4070d7
add eax, 2
cmp word [eax], 0x2d
jne 0x4070d7
mov dword [ebp + 0x50], eax
push 1
lea eax, [ebp + 0x50]
push eax
push 0x490680
call fcn.00435950
add esp, 0xc
test al, al
jne 0x407208
mov eax, dword [ebp + 0x50]
mov ax, word [eax]
cmp ax, 0x2d
je 0x407108
cmp ax, 0x2f
jne 0x407208
add dword [ebp + 0x50], edi
push 5
lea eax, [ebp + 0x50]
push eax
push 0x490678
call fcn.00435993
add esp, 0xc
test al, al
je 0x4071b3
mov al, byte [ebp + 0x73]
or byte [ebp + 0x73], 0x10
cmp al, bl
jne 0x407396
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp - 0x10], ecx
mov esi, edi
je 0x40708b
push 2
pop edx
cmp ax, 0x3d
je 0x407161
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x407151
cmp esi, edi
je 0x40708b
cmp word [esi], 0x3d
jne 0x40708b
sub esi, edx
cmp word [esi], 0x2b
jne 0x407182
mov al, byte [esi]
mov byte [ebp - 0x35], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x40719a
mov ax, word [ecx]
call fcn.00402b47
test al, al
je 0x40719a
sub ecx, edx
cmp ecx, edi
ja 0x407188
mov ax, word [ecx]
call fcn.00402b47
test al, al
jne 0x407434
mov edx, ecx
inc ecx
inc ecx
jmp 0x4073c3
push 4
push dword [ebp + 0x50]
push str.cmd:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407314
add dword [ebp + 0x50], 8
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x54]
call fcn.00403994
add esp, 0x10
mov dword [ebp - 0x74], eax
jmp 0x4071fa
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp + 0x50]
jb 0x4071f3
cmp byte [ebp + 0x73], bl
je 0x407396
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
mov eax, dword [ebp - 0x74]
cmp eax, ebx
pop ecx
je 0x407221
cmp word [eax], bx
jne 0x407221
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x78], ebx
jne 0x40722e
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x407232
mov byte [ebp + 0x5b], 1
xor edi, edi
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x28], ebx
call fcn.00433c24
lea ecx, [ebp - 0xcc]
call fcn.00433c24
lea ecx, [ebp - 0xf8]
call fcn.00433c24
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0xc8], ebx
mov byte [ebp + 0x46], bl
mov dword [ebp - 0x20], ebx
jne 0x4072a1
cmp dword [ebp + 0x4c], ebx
jne 0x4072a1
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp - 0xc8]
push eax
push dword [ebp + 0x68]
call fcn.0043c245
mov eax, dword [ebp - 0xc8]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov dword [ebp - 0xa8], eax
jne 0x4072bc
add eax, 2
cmp word [eax], 0x2d
jne 0x4072bc
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x490680
call fcn.00435950
add esp, 0xc
test al, al
jne 0x407dd8
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x4072ed
cmp ax, 0x2f
jne 0x407dd8
push 2
pop esi
add dword [ebp + 0x68], esi
push 5
lea eax, [ebp + 0x68]
push eax
push 0x490678
call fcn.00435950
add esp, 0xc
test al, al
je 0x40743c
mov byte [ebp + 0x73], 0x10
jmp 0x4072a1
push 3
push dword [ebp + 0x50]
push 0x49066c
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x40733e
add dword [ebp + 0x50], 6
jmp 0x407333
add dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x50]
cmp word [eax], 0x2a
je 0x407330
jmp 0x407374
push 4
push dword [ebp + 0x50]
push str.exe:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x40735a
add dword [ebp + 0x50], 8
jmp 0x407374
push 5
push dword [ebp + 0x50]
push str.logs:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407396
add dword [ebp + 0x50], 0xa
mov eax, dword [ebp + 0x50]
cmp word [eax], 0x22
jne 0x407396
add dword [ebp + 0x50], edi
jmp 0x40738b
add dword [ebp + 0x50], edi
cmp ax, 0x22
je 0x407396
mov eax, dword [ebp + 0x50]
mov ax, word [eax]
cmp ax, bx
jne 0x407382
lea eax, [ebp + 0x50]
push eax
call fcn.0040418b
mov eax, dword [ebp + 0x50]
pop ecx
jmp 0x4070c3
lea eax, [edx - 2]
mov dword [ebp - 0xa8], eax
mov ax, word [eax]
call fcn.00402b47
test al, al
jne 0x4073c7
mov edx, dword [ebp - 0xa8]
cmp edx, edi
ja 0x4073a8
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3c]
call fcn.00433d4a
mov edi, dword [ebp + 0x54]
push ebx
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.00402c07
cmp byte [edi + 0x96], bl
jne 0x4073f2
test byte [edi + 0xb], 0xf
je 0x407408
push ebx
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.00402c07
jmp 0x407408
cmp ax, 0x3d
je 0x407416
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x407400
cmp ax, 0x3d
jne 0x407434
lea eax, [ebp - 0xe4]
add esi, 2
push eax
mov dword [ebp - 0xe4], esi
call fcn.0042ebab
pop ecx
push 2
pop edi
jmp 0x4070a5
xor ebx, ebx
inc ebx
jmp 0x40a612
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407483
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407472
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [esi], bx
je 0x407c38
mov dword [ebp + 0x1c], esi
jmp 0x407c38
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x4074cc
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xdc]
call fcn.00433d4a
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
jmp 0x407dd2
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x40757c
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407505
add dword [ebp + 0x68], esi
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x20]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x22], 1
je 0x40753a
cmp ax, 0x30
jb 0x407537
cmp ax, 0x39
jbe 0x40753a
add dword [ebp + 0x20], esi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004369c5
mov eax, dword [ebp + 0x20]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x407566
cmp ax, 0x30
jb 0x407563
cmp ax, 0x39
jbe 0x407566
add dword [ebp + 0x20], esi
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004369c5
pop ecx
jmp 0x407dd2
push 4
pop esi
push esi
push dword [ebp + 0x68]
push str.pid:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x4075bb
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c38
lea ecx, [ebp - 0xec]
jmp 0x407c2d
push esi
push dword [ebp + 0x68]
push str.exe:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x4076d3
mov eax, dword [ebp + 0x68]
add eax, 8
mov dword [ebp + 0x68], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov esi, eax
mov dword [ebp - 0x14], ebx
jne 0x4075f4
mov dword [ebp - 0x20], 1
cmp cx, 0x22
jne 0x40766b
lea edi, [eax + 2]
mov esi, eax
mov ecx, edi
jmp 0x407629
cmp ax, 0x22
jne 0x407627
inc edx
test dl, 1
je 0x407627
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x407634
call fcn.00402b47
test al, al
jne 0x407634
or dword [ebp - 0x20], 2
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407603
push 0x22
pop edx
cmp word [ecx], dx
jne 0x407678
or dword [ebp - 0x14], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
cmp word [ecx - 4], dx
mov esi, edi
mov byte [ebp + 0x46], 2
je 0x40765f
mov ax, word [esi]
cmp ax, dx
jne 0x407678
cmp word [esi + 2], dx
jne 0x407664
mov byte [ebp + 0x46], bl
jmp 0x407678
cmp ax, dx
jne 0x407678
jmp 0x40765f
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
pop ecx
mov ecx, dword [ebp + 0x68]
sub ecx, esi
sar ecx, 1
add dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jle 0x407c38
add esi, 0xfffffff6
push esi
lea ecx, [ebp - 0x94]
call fcn.0043de8d
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x14]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x3c], eax
jne 0x407c38
cmp word [eax + 2], bx
jne 0x407c38
lea eax, [ebp - 0x94]
push eax
call fcn.00403a8d
pop ecx
mov dword [ebp + 0x3c], eax
jmp 0x407c38
push 3
push dword [ebp + 0x68]
push 0x49066c
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x4077be
mov eax, dword [ebp + 0x68]
xor esi, esi
add eax, 6
jmp 0x4076fa
inc esi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x4076f7
cmp esi, 2
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x60], ebx
jge 0x407784
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00414faa
add esp, 0xc
cmp dword [ebp - 0x60], ebx
mov dword [ebp + 0x68], eax
jle 0x407745
push dword [ebp - 0x60]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x110]
call fcn.00433d4a
mov eax, dword [ebp - 0x40]
mov dword [ebp + 0x28], eax
cmp esi, 1
jne 0x407c38
cmp dword [ebp - 0x60], ebx
jle 0x407c38
mov eax, dword [ebp - 0x40]
push esi
lea ecx, [ebp - 0x40]
push ecx
push eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], ebx
call fcn.0046f35f
add esp, 0xc
lea ecx, [ebp - 0x90]
mov dword [ebp + 0x28], eax
call fcn.0042eb98
jmp 0x407c38
push 0x105
lea ecx, [ebp - 0x40]
call fcn.00433c6b
push 0x104
push dword [ebp - 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x4077b3
mov word [eax], bx
mov eax, dword [ebp - 0x40]
mov dword [ebp + 0x28], eax
jmp 0x407c38
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407837
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x64], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x4077f5
add eax, 2
mov dword [ebp - 0x64], eax
mov edi, eax
push 1
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp + 0x24], ebx
call fcn.00414faa
add esp, 0xc
cmp dword [ebp + 0x24], ebx
mov dword [ebp + 0x68], eax
jle 0x407c38
cmp esi, ebx
je 0x407828
cmp dword [0x4a6e10], ebx
je 0x407c38
push dword [ebp + 0x24]
lea ecx, [ebp - 0xe0]
push edi
jmp 0x407c33
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.00435950
add esp, 0xc
test al, al
je 0x407857
mov byte [ebp - 0x23], 1
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x490624
call fcn.00435950
add esp, 0xc
test al, al
je 0x407879
mov dword [ebp - 0xc], 0x10000000
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x49061c
call fcn.00435950
add esp, 0xc
test al, al
je 0x40789b
mov dword [ebp - 0x10], 1
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x490618
call fcn.00435950
add esp, 0xc
test al, al
je 0x4078bb
or byte [ebp + 0x47], 1
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.00435950
add esp, 0xc
test al, al
je 0x4078da
or byte [ebp + 0x47], 3
jmp 0x4072a1
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.00435950
add esp, 0xc
test al, al
je 0x4078fa
mov byte [ebp - 0x29], 1
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x490604
call fcn.00435950
add esp, 0xc
test al, al
je 0x40791a
mov byte [ebp + 0x4b], 1
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.00435950
add esp, 0xc
test al, al
je 0x407939
mov byte [ebp + 0x48], 1
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4905f8
call fcn.00435950
add esp, 0xc
test al, al
je 0x40795c
mov dword [ebp - 0xc], 6
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4905f4
call fcn.00435950
add esp, 0xc
test al, al
je 0x40797f
mov dword [ebp - 0xc], 3
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4905ec
call fcn.00435950
add esp, 0xc
test al, al
je 0x4079a1
mov dword [ebp - 0xc], 1
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4905e4
call fcn.00435950
add esp, 0xc
test al, al
je 0x4079c0
mov byte [ebp - 0x21], 1
jmp 0x4072a1
push 2
lea eax, [ebp + 0x68]
push eax
push 0x4905e0
call fcn.00435950
add esp, 0xc
test al, al
je 0x4079e0
mov byte [ebp - 5], 1
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4905d8
call fcn.00435950
add esp, 0xc
test al, al
je 0x4079fe
mov byte [ebp - 5], bl
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4905d4
call fcn.00435950
add esp, 0xc
test al, al
je 0x407a1e
mov byte [ebp - 0x37], 1
jmp 0x4072a1
push 2
lea eax, [ebp + 0x68]
push eax
push 0x4905d0
call fcn.00435950
add esp, 0xc
test al, al
je 0x407a3e
mov byte [ebp + 0x43], 1
jmp 0x4072a1
push 5
lea eax, [ebp + 0x68]
push eax
push str.incmd
call fcn.00435950
add esp, 0xc
test al, al
je 0x407a5e
mov byte [ebp - 0x2a], 1
jmp 0x4072a1
push 7
lea eax, [ebp + 0x68]
push eax
push str.hidecmd
call fcn.00435950
add esp, 0xc
test al, al
je 0x407a7e
mov byte [ebp + 0xa], 1
jmp 0x4072a1
push 8
lea eax, [ebp + 0x68]
push eax
push str.hidecmd_
call fcn.00435950
add esp, 0xc
test al, al
je 0x407a9d
mov byte [ebp + 0xa], bl
jmp 0x4072a1
push 3
push dword [ebp + 0x68]
push 0x4905b0
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407aef
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x49], 1
jne 0x407c38
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c38
lea ecx, [ebp - 0xcc]
jmp 0x407c2d
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407ba4
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push str.UTF8
call fcn.00435950
add esp, 0xc
test al, al
je 0x407b3a
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x50], 0xfde9
jmp 0x407dc9
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push str.ANSI
call fcn.00435950
add esp, 0xc
test al, al
je 0x407b5d
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x50], ebx
jmp 0x407dc9
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push 0x490594
call fcn.00435950
add esp, 0xc
test al, al
je 0x407b84
mov byte [ebp + 0x77], 2
mov dword [ebp - 0x50], 0x4b0
jmp 0x407dc9
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004369c5
test eax, eax
pop ecx
pop ecx
jle 0x407dc9
mov byte [ebp + 0x77], 1
jmp 0x407dc9
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407bda
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c38
lea ecx, [ebp - 0xa4]
jmp 0x407c2d
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407bf5
mov byte [ebp + 0xb], bl
jmp 0x407c0f
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x407c4a
mov byte [ebp + 0xb], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00404167
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c38
lea ecx, [ebp - 0x88]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00433d4a
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
mov edi, dword [ebp + 0x3c]
pop ecx
jmp 0x4072a1
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.00435950
add esp, 0xc
test al, al
je 0x407c6d
mov dword [ebp + 0x14], 0x100
jmp 0x4072a1
push esi
lea eax, [ebp + 0x68]
push eax
push 0x490568
call fcn.00435950
add esp, 0xc
test al, al
je 0x407c8f
mov dword [ebp + 0x14], 0x80
jmp 0x4072a1
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.00435950
add esp, 0xc
test al, al
je 0x407cb2
mov dword [ebp + 0x14], 0x8000
jmp 0x4072a1
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.00435950
add esp, 0xc
test al, al
je 0x407cd5
mov dword [ebp + 0x14], 0x20
jmp 0x4072a1
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.00435950
add esp, 0xc
test al, al
je 0x407cf8
mov dword [ebp + 0x14], 0x4000
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x490544
call fcn.00435950
add esp, 0xc
test al, al
jne 0x407d48
mov esi, dword [ebp + 0x68]
push 4
push esi
push 0x490538
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x407d54
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.00402b47
test al, al
jne 0x407d3a
cmp cx, bx
jne 0x407d54
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
pop ecx
mov dword [ebp + 0x14], 0x40
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x490534
call fcn.00435950
add esp, 0xc
test al, al
je 0x407d74
mov byte [ebp + 0x4a], 1
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x490530
call fcn.00435950
add esp, 0xc
test al, al
je 0x407d9a
mov byte [ebp + 3], 1
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x50], ebx
jmp 0x4072a1
push 3
lea eax, [ebp + 0x68]
push eax
push 0x49052c
call fcn.00435950
add esp, 0xc
test al, al
je 0x407dba
mov byte [ebp - 0x36], 1
jmp 0x4072a1
mov eax, dword [ebp - 0xa8]
cmp word [eax], 0x2d
mov dword [ebp + 0x68], eax
jne 0x407dd8
lea eax, [ebp + 0x68]
push eax
call fcn.0040418b
pop ecx
jmp 0x4072a1
cmp dword [ebp - 0x50], 0x4b0
jne 0x407de5
mov byte [ebp + 0x77], 2
mov eax, dword [ebp - 0xe4]
cmp eax, ebx
je 0x407e18
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x407e18
cmp dword [ebp + 0x4c], ebx
jne 0x407e18
push 1
push ebx
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0043c245
mov eax, dword [ebp - 0xc8]
mov dword [ebp + 0x68], eax
cmp edi, ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x30], ebx
je 0x407e3c
cmp word [edi], bx
je 0x407e3c
cmp word [ebp - 0x20], bx
je 0x407e3f
mov byte [ebp + 0x4a], bl
cmp edi, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x108], 0x48fe14
je 0x407f2e
cmp word [edi], 0x2a
jne 0x407e6e
inc edi
inc edi
inc dword [ebp - 0x1c]
cmp word [edi], 0x2a
je 0x407e60
mov dword [ebp + 0x3c], edi
cmp word [edi], 0x3f
jne 0x407e9a
inc edi
inc edi
mov dword [ebp + 0x3c], edi
mov dword [ebp - 0x108], edi
jmp 0x407e8c
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x3c], edi
je 0x407e96
mov ax, word [edi]
cmp ax, bx
jne 0x407e81
jmp 0x407e9a
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x407ed6
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x407ed6
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x407ed6
cmp word [edi + 6], 0x3a
jne 0x407ed6
mov dword [ebp + 0xc], 1
add edi, 8
jmp 0x407efa
cmp ax, 0x65
jne 0x407efd
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x407efd
cmp word [edi + 4], 0x3a
jne 0x407efd
mov dword [ebp + 0xc], 0x100
add edi, 6
mov dword [ebp + 0x3c], edi
cmp edi, ebx
je 0x407f2e
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x407f2e
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x407f2e
cmp word [edi + 4], 0x3a
jne 0x407f2e
add edi, 6
mov dword [ebp + 0x2c], 1
mov dword [ebp + 0x3c], edi
cmp byte [ebp + 0x4a], bl
je 0x407f75
cmp edi, ebx
je 0x407f75
cmp word [ebp + 0xc], bx
jne 0x407f75
cmp word [ebp + 0x2c], bx
jne 0x407f75
xor eax, eax
cmp byte [ebp + 0x46], bl
mov ecx, edi
setne al
mov esi, eax
xor eax, eax
mov ax, word [edi]
jmp 0x407f70
cmp ax, 0x22
jne 0x407f6b
inc esi
cmp esi, 2
jl 0x407f6b
cmp word [ecx + 2], bx
je 0x407f6b
mov byte [ebp + 0x4a], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407f56
cmp word [ebp - 0x1c], bx
jne 0x407f87
cmp word [ebp + 0xc], bx
jne 0x407f87
cmp word [ebp + 0x2c], bx
je 0x407f8a
mov byte [ebp + 0x46], bl
cmp byte [ebp + 0x4a], bl
je 0x407fcf
xor eax, eax
cmp word [ebp + 0x2c], bx
sete al
xor ecx, ecx
cmp word [ebp + 0xc], bx
sete cl
test ecx, eax
je 0x407fcf
push 0x2a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x407fbd
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x128]
push eax
push edi
call fcn.004105a1
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0x114]
mov dword [ebp - 0x118], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x168], ebx
lea edi, [ebp - 0x164]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x54], ebx
setne al
cmp byte [ebp + 0x43], bl
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x154], 0xc
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0xf4], ebx
je 0x408070
lea eax, [ebp - 0x22c]
or byte [eax + 0x2d], cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x4a52e4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4a52e8]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4a52e0]
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x5b], bl
je 0x40847c
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp - 0x28], ebx
jne 0x40809e
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x408085
call fcn.00402b47
test al, al
jne 0x408085
mov dword [ebp + 0x24], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x4080db
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042ebab
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4080a1
mov ecx, dword [ebp + 0x24]
cmp word [ecx], bx
mov dl, 1
je 0x4080dd
mov cl, dl
jmp 0x4080e9
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x4080e9
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 0x4c], eax
je 0x4081a8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x6c]
push eax
xor edi, edi
lea eax, [ebp - 0x70]
inc edi
push eax
mov dword [ebp - 0xb4], 0xc
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x408139
mov ecx, dword [ebp + 0x54]
push ebx
push edi
call fcn.0040ce12
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x70]
push esi
call edi
cmp dword [ebp - 0x6c], ebx
mov word [ebp + 0x42], bx
je 0x40817a
push dword [ebp - 0x6c]
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
lea eax, [ebp + 0x42]
push eax
push ecx
push dword [ebp + 0x24]
call fcn.00406e56
cmp dword [ebp - 0x6c], ebx
je 0x40817a
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], ebx
push esi
call edi
mov ecx, dword [ebp - 0x70]
cmp ecx, ebx
je 0x4081a8
lea eax, [ebp - 0x22c]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x18], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x408418
cmp cx, 0x3c
je 0x4081d6
cmp cx, 0x3e
je 0x4081d6
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4081bd
mov cx, word [eax]
cmp cx, bx
je 0x408418
cmp cx, 0x3c
jne 0x4082b1
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042ebab
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4082b1
mov dword [ebp + 0x10], eax
jmp 0x40821f
cmp cx, 0x3c
je 0x408227
cmp cx, 0x3e
je 0x408227
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40820e
sub eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
sar eax, 1
push eax
push dword [ebp + 0x10]
call fcn.0043dde6
lea ecx, [ebp + 0x24]
call fcn.00433c24
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x10]
call fcn.0043c245
mov eax, dword [ebp + 0x24]
push eax
mov dword [ebp + 0x10], eax
call fcn.0040c744
lea eax, [ebp + 0x10]
push eax
call fcn.0042ebab
cmp dword [ebp - 0x44], ebx
pop ecx
pop ecx
je 0x408276
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x154]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
call fcn.004041e7
cmp dword [ebp - 0x44], ebx
jne 0x40829e
mov dword [ebp - 0x44], ebx
lea ecx, [ebp + 0x24]
call fcn.0042eb98
lea ecx, [ebp - 0x4c]
call fcn.0042eb98
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4081b1
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x5b], 1
jne 0x4082d6
mov byte [ebp + 0x5b], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4082e9
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x4082fa
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x5b], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.0042ebab
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4081b1
mov dword [ebp + 0x34], eax
jmp 0x408326
cmp cx, 0x3c
je 0x40832e
cmp cx, 0x3e
je 0x40832e
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408315
sub eax, dword [ebp + 0x34]
lea ecx, [ebp - 0x64]
sar eax, 1
push eax
push dword [ebp + 0x34]
call fcn.0043dde6
lea ecx, [ebp - 4]
call fcn.00433c24
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x34]
call fcn.0043c245
mov eax, dword [ebp - 4]
push eax
mov dword [ebp + 0x34], eax
call fcn.0040c744
lea eax, [ebp + 0x34]
push eax
call fcn.0042ebab
test byte [ebp + 0x5b], 1
pop ecx
pop ecx
je 0x408386
cmp dword [ebp + 0x20], ebx
je 0x408383
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x20], ebx
test byte [ebp + 0x5b], 2
je 0x4083a9
cmp dword [ebp - 0x98], ebx
je 0x4083a0
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x28], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x154]
push eax
push 7
push 0x40000000
push dword [ebp + 0x34]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], ebx
call fcn.004041e7
mov edi, eax
cmp edi, ebx
jne 0x4083ed
lea ecx, [ebp - 4]
call fcn.0042eb98
lea ecx, [ebp - 0x64]
call fcn.0042eb98
mov eax, dword [ebp + 0x5c]
jmp 0x4081ae
cmp esi, ebx
je 0x4083fc
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x408407
mov dword [ebp + 0x20], edi
jmp 0x4083d5
cmp byte [ebp + 0x5b], 3
mov dword [ebp - 0x28], edi
je 0x408402
mov dword [ebp - 0x98], edi
jmp 0x4083d5
mov ecx, dword [ebp - 0x44]
cmp ecx, ebx
mov edx, 0x100
je 0x408433
lea eax, [ebp - 0x22c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x18], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 0x20]
cmp ecx, ebx
je 0x408449
lea eax, [ebp - 0x22c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x18], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x40845f
lea eax, [ebp - 0x22c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x18], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0xf4]
push eax
push dword [ebp + 0x4c]
call fcn.0043c245
mov eax, dword [ebp - 0xf4]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x4084be
cmp ax, 0x2a
je 0x4084be
cmp ax, 0x40
jne 0x4084c7
push str.WinSta0WinLogon
lea ecx, [ebp - 0xc0]
call fcn.0043de8d
mov ecx, dword [ebp - 0xc0]
inc byte [ebp + 0x3b]
lea eax, [ebp - 0x22c]
mov dword [eax + 8], ecx
mov dword [ebp - 0xc], esi
add dword [ebp + 0x68], 2
jmp 0x408484
cmp ax, 0x3d
jne 0x4084d6
mov dword [ebp - 0x10], 1
jmp 0x4084c1
cmp ax, 0x24
jne 0x4084e2
mov byte [ebp + 0x49], 1
jmp 0x4084c1
cmp ax, 0x26
jne 0x4084f1
mov dword [ebp - 0xc], 3
jmp 0x4084c1
cmp ax, 0x5e
jne 0x4084fc
mov dword [ebp - 0xc], edi
jmp 0x4084c1
cmp ax, 0x5f
je 0x4084f7
lea edi, [ebp - 0x22c]
cmp dword [edi + 8], ebx
je 0x408520
test byte [ebp + 0x3b], 1
je 0x408520
call fcn.00403932
cmp eax, 1
jge 0x408520
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x40853b
or byte [edi + 0x2d], 1
mov dword [ebp - 0x10], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp - 0x18], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x49], bl
je 0x40855b
mov eax, dword [ebp - 0xcc]
cmp word [eax], bx
jne 0x40855b
push 0x4904fc
lea ecx, [ebp - 0xcc]
call fcn.0043de31
cmp byte [ebp - 0x21], bl
je 0x4085ac
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x408575
inc edi
inc edi
jmp 0x408578
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp - 0x10], ebx
push 1
setne al
push edi
push 0x4904a0
add eax, 0x80000001
push eax
call fcn.0042f97c
add esp, 0x18
mov ebx, eax
jmp 0x40a55c
lea eax, [ebp + 0x68]
push eax
call fcn.0042ebab
cmp dword [ebp + 0x1c], ebx
pop ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xd4], ebx
je 0x40865f
lea ecx, [ebp - 4]
mov byte [ebp + 0x49], bl
call fcn.00433c24
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x1c]
call fcn.00410811
cmp eax, ebx
je 0x40864d
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x40864d
push eax
lea ecx, [ebp - 4]
call fcn.0043de5f
push dword [ebp + 0x68]
lea ecx, [ebp - 0xd4]
call fcn.0043de8d
push dword [ebp - 0xe0]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 4]
call fcn.00406c0a
mov edi, eax
mov eax, dword [ebp - 0x94]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0xd4]
add esp, 0x14
lea ecx, [ebp - 4]
mov dword [ebp + 0x68], eax
call fcn.0042eb98
cmp edi, ebx
je 0x40865f
mov ebx, edi
jmp 0x40a549
lea ecx, [ebp - 4]
call fcn.0042eb98
mov ebx, 0x80070057
jmp 0x40a549
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x4086b0
push dword [ebp + 0x68]
call fcn.0040ec9c
pop ecx
push eax
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x68], eax
call fcn.0043ddc9
push 0x49049c
lea ecx, [ebp + 0x70]
call fcn.00433c92
push dword [ebp - 0xdc]
lea ecx, [ebp + 0x70]
call fcn.00433c92
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x70]
call fcn.004450f8
mov ebx, eax
lea ecx, [ebp + 0x70]
jmp 0x40a544
cmp byte [ebp - 0x22], bl
je 0x4087fb
lea ecx, [ebp + 0x7c]
call fcn.00433c24
push dword [ebp + 0x68]
mov dword [ebp + 0x70], ebx
call fcn.0040ec9c
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.00433c24
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x30], ebx
call fcn.0046f35f
mov eax, dword [ebp + 0x30]
add esp, 0xc
cmp eax, ebx
jne 0x408705
lea ecx, [ebp + 0x78]
call fcn.0042eb98
lea ecx, [ebp + 0x7c]
jmp 0x408650
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.0043ddc9
push dword [ebp + 0x30]
mov esi, dword [ebp - 0x60]
lea ecx, [ebp + 0x6c]
call fcn.0043ddc9
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x6c]
push esi
call fcn.00405789
add esp, 0x14
cmp dword [ebp + 0x70], ebx
jle 0x40877f
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x408753
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x100]
push dword [ebp - 0x104]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x70], ebx
jle 0x4087db
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x70]
mov dword [ebp + 0x70], esi
call fcn.004103f2
mov eax, dword [ebp + 0x70]
mov word [eax], bx
cmp word [esi], bx
je 0x4087db
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.0043ddc9
push 0x49049c
lea ecx, [ebp + 0x74]
call fcn.00433c92
push esi
lea ecx, [ebp + 0x74]
call fcn.00433c92
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x74]
call fcn.004450f8
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.0042eb98
lea ecx, [ebp + 0x6c]
call fcn.0042eb98
lea ecx, [ebp - 0x60]
call fcn.0042eb98
lea ecx, [ebp + 0x78]
call fcn.0042eb98
lea ecx, [ebp + 0x7c]
jmp 0x40a544
push dword [ebp + 0x68]
lea ecx, [ebp - 0xc4]
call fcn.0043ddc9
cmp byte [ebp - 0x2a], bl
je 0x4088be
push 0x490474
lea ecx, [ebp - 0xc4]
call fcn.0043de8d
push 1
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00414faa
add esp, 0xc
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp + 0x68], eax
call fcn.00433c92
lea eax, [ebp - 0x94]
push eax
call fcn.00403a8d
pop ecx
mov dword [ebp + 0x3c], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x68], eax
je 0x408869
cmp byte [ebp - 0x36], bl
je 0x408873
lea eax, [ebp - 0x22c]
or byte [eax + 0x2c], 0x80
xor edi, edi
inc edi
cmp ecx, ebx
je 0x408887
lea eax, [ebp - 0x22c]
or dword [eax + 0x2c], edi
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x3b]
and al, 3
cmp al, 3
je 0x408895
cmp byte [ebp - 0x23], bl
je 0x40889f
lea eax, [ebp - 0x22c]
or byte [eax + 0x2f], 8
lea eax, [ebp - 0x22c]
cmp dword [eax + 8], ebx
je 0x408b6b
cmp byte [ebp + 0x3b], bl
jle 0x408b6b
mov eax, edi
jmp 0x408b6d
cmp byte [ebp + 0xa], bl
je 0x408850
cmp dword [ebp - 0xc], esi
je 0x408850
mov eax, dword [ebp - 0xc4]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
mov dword [ebp - 0x34], ebx
call fcn.00414faa
mov esi, eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x34], eax
push 3
lea eax, [ebp - 0x34]
push eax
push 0x490470
call fcn.00435950
add esp, 0x18
test al, al
jne 0x4089c2
push 7
lea eax, [ebp - 0x34]
push eax
push str.cmd.exe
call fcn.00435950
add esp, 0xc
test al, al
jne 0x4089c2
cmp dword [0x4a6bc4], ebx
jne 0x40896e
push ebx
push 0x24
lea eax, [ebp - 0x534]
push eax
push ebx
mov word [ebp - 0x534], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x534]
mov edi, 0x4a6bc4
push eax
mov ecx, edi
call fcn.0043de8d
push str.System32cmd.exe
mov ecx, edi
call fcn.00433c92
push dword [0x4a6bc4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x4a6ba8], ax
movsx eax, word [0x4a6ba8]
push eax
push dword [ebp - 0x34]
mov dword [ebp + 0x4c], ebx
push dword [0x4a6bc4]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408a37
movsx eax, word [0x4a6ba8]
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x4089b5
call fcn.00402b47
test al, al
je 0x408a37
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], ecx
call fcn.0040418b
pop ecx
push 2
lea eax, [ebp - 0x34]
push eax
push 0x490440
call fcn.00435950
add esp, 0xc
test al, al
je 0x408a37
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x22
jne 0x408a1d
add eax, 2
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042ebab
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
pop ecx
je 0x408a12
push 4
lea eax, [ebp + 0x7c]
push eax
push str.call
call fcn.00435950
add esp, 0xc
test al, al
je 0x408a1a
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x34], eax
jmp 0x408a1d
mov eax, dword [ebp - 0x34]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00414faa
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x4c], 1
mov eax, esi
sub eax, dword [ebp + 0x68]
and eax, 0xfffffffe
cmp eax, 8
jle 0x408850
push 4
push str..cmd
lea edi, [esi - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x408a73
push 4
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408850
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0x4c], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x4c0]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x68]
stosb byte es:[edi], al
lea ecx, [ebp + 0x24]
lea edi, [ebp - 0x4c0]
mov byte [ebp + 0x7f], bl
mov dword [ebp + 0x24], ebx
call fcn.004041e7
push ebx
lea eax, [ebp - 0xd0]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x408b11
mov al, byte [ebp - 0x4c0]
mov dword [ebp - 0xc], 0x10000000
jmp 0x408af9
cmp al, 0xd
je 0x408b00
cmp al, 0xa
je 0x408b00
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x408aee
jmp 0x408b00
inc edi
movsx ax, byte [edi]
push eax
call fcn.0040b427
add esp, 4
test al, al
jne 0x408aff
cmp dword [ebp + 0x4c], ebx
jne 0x408b41
cmp byte [edi], 0x3a
jne 0x408b26
cmp byte [edi + 1], 0x3a
jne 0x408b26
inc edi
inc edi
jmp 0x408b26
inc edi
cmp byte [edi], 0x40
je 0x408b25
push 7
push edi
push str._pecmd
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x408b41
mov byte [ebp + 0x7f], 1
lea ecx, [ebp + 0x24]
call fcn.00402ac9
cmp byte [ebp + 0x7f], bl
mov ax, word [ebp - 0x4c]
mov word [esi], ax
je 0x408850
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x54]
call fcn.0042065b
mov ebx, eax
jmp 0x40a53e
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp - 0x9c], ebx
je 0x408b87
mov dword [ebp - 0x9c], edi
mov dword [ebp + 0x5c], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00402b60
cmp byte [0x4a6d64], bl
mov esi, dword [ebp + 0x6c]
mov dword [ebp + 0x4c], 0x4a6f08
jne 0x408bbd
cmp esi, ebx
je 0x408bab
cmp byte [esi + 0xa], bl
jne 0x408bbd
cmp byte [ebp - 0x37], bl
mov byte [ebp + 0x7f], bl
je 0x408bc1
cmp esi, ebx
je 0x408bc1
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x24]
call fcn.0043ddc9
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x34], ebx
je 0x408e4f
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x32c]
call fcn.004107b3
cmp esi, ebx
je 0x408c00
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x32c]
push esi
call fcn.00430ba7
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp - 0x48]
mov dword [ebp - 0xa0], edi
call fcn.00433c42
mov eax, dword [ebp - 0x48]
mov dword [ebp + 0x6c], eax
jmp 0x408c9b
mov dword [ebp + 0x7c], edi
jmp 0x408c2e
cmp ax, 0x3d
je 0x408c38
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x408c28
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x408c99
cmp word [edi + 2], bx
je 0x408c94
cmp esi, 0x104
jg 0x408c94
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.0040414f
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x32c]
mov word [eax + esi*2], bx
call fcn.0040c4d0
test eax, eax
jne 0x408c94
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x32c]
call fcn.0040c433
jmp 0x408c94
inc edi
inc edi
cmp word [edi], bx
jne 0x408c92
inc edi
inc edi
cmp word [edi], bx
jne 0x408c23
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x328]
xor eax, eax
cmp ecx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x6c], eax
jle 0x408d58
jmp 0x408cca
mov eax, dword [ebp + 0x6c]
lea edi, [eax + 1]
cmp edi, dword [ebp + 0x7c]
mov dword [ebp + 0x30], eax
mov dword [ebp - 0x8c], edi
jge 0x408d46
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov dword [ebp - 0xa0], eax
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp + 0x4c]
mov ecx, dword [eax + ecx]
mov ecx, dword [ecx]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x408d14
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x4c], esi
inc edi
cmp edi, dword [ebp + 0x7c]
jl 0x408cea
mov eax, dword [ebp + 0x30]
cmp eax, dword [ebp + 0x6c]
je 0x408d46
mov edx, dword [ebp - 0x32c]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp + 0x30]
add eax, edx
mov esi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x32c]
mov dword [eax + ecx], esi
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
jl 0x408cc7
xor edi, edi
cmp dword [ebp + 0x7c], ebx
jle 0x408d96
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + edi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x68]
lea esi, [ecx + eax + 1]
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
cmp edi, dword [ebp + 0x7c]
lea eax, [esi + eax + 3]
mov dword [ebp - 0x68], eax
jl 0x408d5f
mov eax, dword [ebp - 0x68]
add eax, 4
push eax
lea ecx, [ebp + 0x24]
call fcn.00433c6b
mov edi, dword [ebp + 0x24]
xor esi, esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x34], edi
jle 0x408e1b
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x30], eax
push edi
call fcn.0040414f
mov eax, dword [ebp + 0x30]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x30], eax
push edi
call fcn.0040414f
mov eax, dword [ebp + 0x30]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x408db2
mov word [edi], bx
lea ecx, [ebp - 0x48]
mov word [edi + 2], bx
call fcn.0042eb98
push ebx
lea ecx, [ebp - 0x32c]
call fcn.0041f8fd
lea ecx, [ebp - 0x2e8]
call fcn.0042eb98
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x3c]
xor al, al
cmp word [ecx], 0x40
jne 0x408e5e
inc al
jmp 0x408e65
cmp dword [ebp - 0x74], ebx
je 0x408e65
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x408f5b
or byte [ebp + 0x73], 8
neg al
mov dword [ebp - 0x10], edi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.004308d6
push eax
lea eax, [ebp - 0x188]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x408f00
cmp eax, 0xffffffff
je 0x408f00
push 0xffffffffffffffff
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp + 0x7c]
call fcn.0043ddff
push ebx
push ebx
push 3
lea ecx, [ebp - 0x154]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x20]
call fcn.004041e7
lea ecx, [ebp + 0x7c]
call fcn.0042eb98
jmp 0x408f07
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x20]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push esi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x22c]
or byte [eax + 0x2d], 1
test byte [ebp + 0x47], 2
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x18], edi
jne 0x408f4f
cmp byte [ebp + 0x47], bl
jne 0x408f52
mov dword [eax + 0x3c], esi
test byte [ebp + 0x47], 1
je 0x408f71
mov dword [eax + 0x40], esi
cmp dword [ebp - 0x10], ebx
jne 0x408f71
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x34]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], ebx
or dword [ebp + 0x5c], eax
cmp byte [ebp + 0x4b], bl
mov dword [ebp + 4], ebx
mov dword [ebp - 0x28], ebx
je 0x408fa0
or dword [ebp + 0x5c], 4
cmp byte [ebp - 5], bl
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x8c], ebx
je 0x408fc4
lea eax, [ebp - 0xa0]
push eax
call fcn.00403077
pop ecx
mov dword [ebp - 0x8c], eax
cmp byte [ebp + 0x49], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0x3c]
je 0x408fda
cmp edi, ebx
je 0x409a98
cmp byte [ebp - 0x29], bl
je 0x40904b
cmp word [ebp + 0xc], bx
jne 0x40904b
cmp word [ebp + 0x2c], bx
jne 0x40904b
call fcn.00406b79
push dword [ebp + 0x68]
mov dword [ebp - 0xfc], eax
push edi
push dword [ebp + 0x28]
lea eax, [ebp + 0x10]
push eax
call fcn.0040385e
mov esi, eax
push esi
call fcn.00403ab1
add esp, 0x14
test eax, eax
jne 0x40920d
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
push dword [ebp - 0xfc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x18], eax
jmp 0x4099b2
mov eax, dword [ebp - 0xa4]
cmp word [eax], bx
je 0x4091df
cmp word [ebp + 0xc], bx
jne 0x4091df
cmp word [ebp + 0x2c], bx
jne 0x4091df
cmp byte [ebp + 0xb], bl
mov dword [ebp + 0x18], ebx
je 0x409121
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00402b2c
lea ecx, [ebp + 0x7c]
call fcn.00433afb
mov edi, dword [ebp - 0x88]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.0047b210
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
call fcn.00438ecd
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x88]
neg edi
call fcn.00433ce1
mov eax, dword [ebp + 0x6c]
push eax
mov dword [ebp - 0x90], eax
call esi
push eax
push ebx
push dword [ebp - 0x90]
call fcn.0047b210
mov eax, dword [ebp + 0x7c]
add esp, 0xc
push eax
mov dword [ebp - 0x90], eax
call esi
push eax
push ebx
push dword [ebp - 0x90]
call fcn.0047b210
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.0042eb98
lea ecx, [ebp + 0x6c]
call fcn.0042eb98
cmp edi, ebx
je 0x4091a8
mov edi, dword [ebp - 0xa4]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x40913f
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x40914d
mov word [eax], bx
mov esi, dword [ebp - 0xa4]
lea edi, [eax + 2]
jmp 0x409152
mov esi, 0x4903f0
push dword [ebp + 0x68]
lea eax, [ebp + 0x10]
push dword [ebp + 0x3c]
push dword [ebp + 0x28]
push eax
call fcn.0040385e
push eax
mov dword [ebp + 0x28], eax
call fcn.00403ab1
add esp, 0x14
test eax, eax
jne 0x40920d
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
push dword [ebp + 0x3c]
push 1
push dword [ebp - 0x88]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x18], eax
mov edi, dword [ebp - 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0047b210
mov edi, dword [ebp - 0xa4]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0047b210
add esp, 0xc
jmp 0x4099b2
cmp byte [ebp + 0x4a], bl
je 0x40925c
cmp edi, ebx
je 0x4091ee
cmp word [edi], 0x26
je 0x40925c
cmp word [ebp - 0x1c], bx
jne 0x40925c
cmp word [ebp + 0xc], bx
jne 0x40925c
cmp word [ebp + 0x2c], bx
jne 0x40925c
push dword [ebp + 0x28]
call fcn.00403ab1
test eax, eax
pop ecx
je 0x409219
mov dword [ebp + 0x7c], 3
jmp 0x409b77
push dword [ebp - 0x30]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push dword [ebp + 0x68]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call fcn.004726b0
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x18], ecx
jmp 0x4099b2
lea ecx, [ebp - 0x84]
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x7c], edi
mov dword [ebp - 0x68], edi
call fcn.00433afb
cmp word [ebp + 0x2c], bx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x40]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x30], eax
je 0x409337
push 0x22
pop esi
cmp word [edi], si
jne 0x4092ac
add edi, 2
mov dword [ebp + 0x7c], edi
push 0x3a
lea eax, [ebp + 0x7c]
mov dword [ebp - 0x58], edi
call fcn.00433886
mov eax, dword [ebp + 0x7c]
cmp eax, edi
pop ecx
je 0x4092cb
cmp word [eax - 2], si
jne 0x4092cb
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x4092d3
inc eax
inc eax
cmp word [eax], si
mov edi, eax
jne 0x4092ec
lea edi, [eax + 2]
inc eax
inc eax
cmp word [eax], si
jne 0x4092e7
mov word [eax], bx
cmp word [eax], bx
jne 0x4092dd
cmp word [ebp + 0xc], bx
je 0x40930a
push 0x3a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x40930a
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
push ebx
push ebx
push 0x10000
push edi
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x58]
call fcn.0042cf56
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x7c]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x1c], ecx
jmp 0x40951a
cmp edi, ebx
je 0x409404
cmp word [edi], 0x26
jne 0x4093eb
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040c4d0
mov esi, eax
cmp esi, ebx
jne 0x4093b3
lea ecx, [ebp + 0x40]
call fcn.0042eb98
lea ecx, [ebp - 0x84]
call fcn.0042eb98
lea ecx, [ebp + 0x14]
call fcn.0042eb98
lea ecx, [ebp - 0x28]
call fcn.0042eb98
lea ecx, [ebp + 4]
call fcn.0042eb98
lea ecx, [ebp + 0x10]
call fcn.0042eb98
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x24]
call fcn.0042eb98
lea ecx, [ebp - 0x4c]
call fcn.004104f0
mov ebx, 0x80070057
jmp 0x40a53e
mov eax, dword [esi + 0xc]
and eax, 0x3fffffff
mov dword [ebp - 0x80], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0x84]
call fcn.00433b3f
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x80]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0x84]
call fcn.0047b530
add esp, 0xc
jmp 0x40951a
mov al, byte [ebp + 0x46]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043add9
pop ecx
pop ecx
mov dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], ebx
mov dword [ebp - 0x10c], ebx
jne 0x409479
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x40941f
cmp word [eax], 0x2a
jne 0x40941f
inc dword [ebp - 0x1c]
cmp byte [ebp + 0x4a], bl
je 0x409427
mov dword [ebp - 0x1c], ebx
cmp word [ebp + 0xc], bx
je 0x4099cb
push 0x3a
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x6c], esi
je 0x409470
mov word [esi], bx
inc esi
inc esi
mov dword [ebp + 0x6c], esi
je 0x409470
push dword [ebp - 0x68]
lea ecx, [ebp + 0x40]
mov dword [ebp - 0xd8], 2
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x30], ebx
call fcn.0043de31
jmp 0x409549
cmp dword [ebp + 0x3c], ebx
je 0x4099cb
cmp word [ebp + 0xc], bx
mov edi, dword [ebp + 0x3c]
je 0x40949b
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x40949b
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
add dword [ebp + 0x3c], 2
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0043ad27
mov si, word [edi]
pop ecx
mov dword [ebp - 0x58], eax
mov eax, dword [0x4a6e00]
mov word [edi], bx
pop ecx
mov ecx, dword [ebp - 0x68]
mov dword [ebp + 0x4c], 0x20
cmp word [ecx], bx
mov dword [ebp + 0x7c], ebx
je 0x4094de
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
mov word [edi], si
je 0x40950c
lea ecx, [ebp + 0x4c]
push ecx
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x58]
mov dword [ebp + 0x4c], 0x20
push dword [ebp - 0x10c]
push eax
call fcn.004108f8
add esp, 0x14
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x7c], ebx
je 0x40951a
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x80], ebx
je 0x409997
cmp dword [ebp + 0x1c], ebx
je 0x409997
cmp word [ebp - 0x1c], bx
mov dword [ebp - 0xd8], 1
ja 0x409546
cmp word [ebp + 0xc], bx
je 0x4098cc
mov esi, dword [ebp + 0x6c]
cmp dword [ebp + 0x30], ebx
mov eax, dword [ebp - 0x108]
jne 0x409559
mov eax, 0x48fe14
push eax
push str.exedat
push dword [ebp - 0x30]
lea eax, [ebp - 0x54]
push dword [ebp + 0x30]
push eax
call fcn.004042ae
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp + 4]
call fcn.0043de5f
mov edi, dword [ebp - 0x48]
lea eax, [ebp + 0x40]
mov dword [ebp + 0x30], eax
lea eax, [ebp - 0x48]
cmp edi, ebx
mov dword [ebp - 0x30], eax
setne al
cmp al, bl
mov dword [ebp - 0xd0], ebx
je 0x4095c0
push ebx
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0x80]
push dword [ebp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.00431eb4
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4095cd
cmp dword [ebp - 0xd8], 1
jle 0x409997
cmp esi, ebx
push dword [ebp - 0x54]
mov byte [ebp + 0x7f], bl
je 0x409727
mov eax, dword [ebp + 0x40]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x40], ebx
call fcn.0043de8d
push str..ex
lea ecx, [ebp + 0x40]
call fcn.00433c92
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 4]
call fcn.0043de5f
cmp word [esi], 0x5c
je 0x409613
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp + 0xc], 1
jne 0x40966c
push 0x4903c0
lea ecx, [ebp + 0x2c]
call fcn.0043ddc9
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x2c]
call fcn.00433c92
push 0x4903b8
lea ecx, [ebp + 0x2c]
call fcn.00433c92
push dword [ebp + 0x40]
lea ecx, [ebp + 0x2c]
call fcn.00433c92
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x54]
call fcn.0042350b
lea ecx, [ebp + 0x2c]
call fcn.0042eb98
jmp 0x409708
cmp word [ebp + 0xc], 0x100
jne 0x409708
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x28c], 0x44
mov dword [ebp - 0x288], ebx
lea edi, [ebp - 0x284]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb8], ebx
lea edi, [ebp - 0xb4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x28c]
push eax
push dword [ebp + 4]
mov dword [ebp - 0x260], 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4903b0
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xb8], ebx
je 0x4096f4
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xb4], ebx
je 0x409708
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x40]
call fcn.00433c92
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x10]
call fcn.0043de5f
lea ecx, [ebp + 0x4c]
call fcn.0042eb98
jmp 0x40972f
lea ecx, [ebp + 4]
call fcn.0043de8d
mov edx, dword [ebp + 0x68]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x409740
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x4097cd
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x40975e
mov edi, dword [ebp + 0x40]
lea esi, [eax + 4]
jmp 0x4097a2
cmp cx, 0x5c
jne 0x4097cd
cmp di, 0x22
je 0x40979f
mov eax, dword [ebp + 4]
mov edi, 0x104
push edi
lea ecx, [ebp + 4]
mov dword [ebp + 0x4c], eax
mov dword [ebp + 4], ebx
call fcn.00433c6b
mov eax, dword [ebp + 4]
push edi
mov word [eax], bx
push dword [ebp + 4]
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x4c]
call fcn.0042eb98
mov edx, dword [ebp + 0x68]
mov edi, dword [ebp + 4]
cmp word [edx], 0x22
jne 0x4097b5
push 0x4902e8
lea ecx, [ebp - 0x28]
call fcn.0043de8d
push edi
lea ecx, [ebp - 0x28]
call fcn.00433c92
push esi
lea ecx, [ebp - 0x28]
call fcn.00433c92
mov edx, dword [ebp - 0x28]
mov dword [ebp + 0x68], edx
cmp dword [ebp + 0x6c], ebx
je 0x409821
cmp word [ebp - 0x1c], bx
ja 0x4097fa
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
mov dword [ebp + 0x6c], ebx
call fcn.004105a1
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
je 0x40981e
mov byte [ebp + 0x7f], 1
jmp 0x40989d
cmp byte [ebp + 0x49], bl
je 0x409821
cmp dword [ebp + 0x28], ebx
jne 0x40980a
mov eax, dword [ebp + 4]
mov dword [ebp + 0x28], eax
cmp word [ebp - 0x1c], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x7f], 2
jb 0x409a7d
jmp 0x40989d
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov esi, dword [ebp + 0x40]
je 0x409832
cmp word [eax], bx
jne 0x409832
xor esi, esi
mov eax, dword [ebp + 0x28]
cmp eax, ebx
jne 0x40983c
mov eax, dword [ebp + 4]
push edx
push dword [ebp + 0x40]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.0040385e
push eax
mov dword [ebp + 0x28], eax
call fcn.00403ab1
add esp, 0x14
test eax, eax
jne 0x4099eb
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.0047ac8d
add esp, 0x28
cmp byte [ebp - 0x1c], 2
mov dword [ebp + 0x18], eax
jl 0x409997
cmp word [ebp + 0xc], bx
jne 0x409997
cmp byte [ebp + 0x7f], 1
jne 0x4098a8
or eax, 0xffffffff
jmp 0x4098b1
lea eax, [ebp - 0x148]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x54]
call fcn.00402c6b
cmp byte [ebp + 0x7f], 1
mov eax, dword [ebp - 0x54]
pop ecx
pop ecx
mov word [eax], bx
jne 0x4099c2
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x22
mov edi, eax
jne 0x4098da
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x4c], ebx
jne 0x409901
cmp word [eax + 2], 0x5c
jne 0x409901
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x409901
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x4c], ax
mov word [edi], 0x22
push dword [ebp + 0x28]
call fcn.00403ab1
test eax, eax
pop ecx
jne 0x4099eb
push ebx
lea esi, [ebp - 0x148]
push esi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x80]
push dword [ebp + 0x1c]
call fcn.004726b0
add esp, 0x28
cmp word [ebp + 0x4c], bx
mov dword [ebp - 0x58], eax
je 0x40994c
mov ax, word [ebp + 0x4c]
mov word [edi], ax
cmp dword [ebp - 0x58], ebx
jl 0x409546
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x409546
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x409546
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x58], ebx
setg al
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x54]
cmp eax, ebx
je 0x409997
cmp word [eax], bx
jne 0x40989d
lea ecx, [ebp + 0x40]
call fcn.0042eb98
lea ecx, [ebp - 0x84]
call fcn.0042eb98
lea ecx, [ebp + 0x14]
call fcn.0042eb98
cmp dword [ebp + 0x18], ebx
je 0x409b69
xor eax, eax
jmp 0x409b6f
cmp byte [ebp + 0x7f], 2
jmp 0x409a77
push dword [ebp + 0x68]
lea eax, [ebp + 0x10]
push edi
push dword [ebp + 0x28]
push eax
call fcn.0040385e
push eax
mov dword [ebp + 0x28], eax
call fcn.00403ab1
add esp, 0x14
test eax, eax
je 0x409a12
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x7c], 3
call fcn.0042eb98
lea ecx, [ebp - 0x84]
call fcn.0042eb98
lea ecx, [ebp + 0x14]
call fcn.0042eb98
jmp 0x409b77
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
call fcn.0047ac8d
add esp, 0x28
cmp eax, ebx
mov dword [ebp + 0x18], eax
jne 0x409997
push eax
push dword [ebp + 0x68]
push str._CreateProcess__s__d_r_n
push 0x4a6f08
call fcn.0040c8e2
add esp, 0x10
cmp byte [ebp + 0x49], bl
jne 0x409997
cmp edi, ebx
jne 0x409997
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x409997
lea ecx, [ebp + 0x40]
call fcn.0042eb98
lea ecx, [ebp - 0x84]
call fcn.0042eb98
lea ecx, [ebp + 0x14]
call fcn.0042eb98
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x19c]
mov dword [ebp - 0x1a4], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 0x1a0], 0x4540
jne 0x409ac3
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x28]
cmp eax, ebx
je 0x409ade
cmp word [eax], bx
je 0x409ade
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x194], eax
cmp word [eax], 0x22
jne 0x409b36
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.00414faa
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0xf8]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.00433d4a
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], esi
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x16c]
lea esi, [ebp - 0x148]
push eax
mov dword [esi], eax
mov dword [ebp - 0x16c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
jmp 0x4099b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0x64]
call fcn.00402ac9
cmp dword [ebp - 0x8c], ebx
je 0x409b93
push dword [ebp - 0xa0]
call fcn.00403088
pop ecx
lea esi, [ebp - 0x6c]
mov eax, dword [esi]
cmp eax, ebx
je 0x409ba3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xec]
mov dword [esi], ebx
cmp word [eax], bx
je 0x409bc5
push eax
lea eax, [ebp - 0x148]
push dword [eax + 8]
push dword [ebp + 0x54]
call fcn.00435eb7
add esp, 0xc
cmp byte [ebp + 0x4b], bl
je 0x409be8
lea esi, [ebp - 0x148]
cmp dword [esi], ebx
je 0x409be8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x78], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea esi, [ebp - 0x148]
push dword [esi + 8]
push dword [ebp + 0x54]
call fcn.00435eb7
push str.__LastTID
push dword [esi + 0xc]
push dword [ebp + 0x54]
call fcn.00435eb7
add esp, 0x18
cmp dword [ebp - 0x9c], ebx
je 0x409c2a
push dword [esi]
push 4
push str.SeDebugPrivilege
call fcn.0040f07b
add esp, 0xc
test byte [ebp + 0x5c], 4
je 0x409c3e
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x409c3e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x28]
call fcn.0042eb98
lea ecx, [ebp + 4]
call fcn.0042eb98
lea ecx, [ebp + 0x10]
call fcn.0042eb98
mov eax, 0x4a7658
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x24]
call fcn.0042eb98
lea ecx, [ebp - 0x4c]
call fcn.004104f0
lea edi, [ebp - 0x20]
mov eax, dword [edi]
cmp eax, ebx
je 0x409c82
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x70]
mov eax, dword [edi]
cmp eax, ebx
je 0x409c94
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x44]
mov eax, dword [edi]
cmp eax, ebx
je 0x409ca6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp + 0x20]
mov eax, dword [edi]
cmp eax, ebx
je 0x409cb8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
lea edi, [ebp - 0x98]
mov eax, dword [edi]
cmp eax, ebx
je 0x409ccd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x18], ebx
mov dword [edi], ebx
je 0x40a455
mov eax, dword [esi]
cmp eax, ebx
jne 0x409ce1
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x5c]
inc dword [ebp - 0x5c]
mov dword [ebp + ecx*4 - 0x118], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x409cfc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x48], bl
mov dword [esi + 4], ebx
je 0x409d1a
mov ecx, dword [ebp + 0x54]
push ebx
push 0x3e8
call fcn.0040ce12
push dword [esi]
call fcn.0040dab0
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x40a46b
mov al, byte [0x4a5290]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x34], edi
xor esi, esi
call fcn.00433b18
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x18], eax
mov dword [ebp - 0x58], ecx
mov byte [ebp + 0x7f], bl
jne 0x409dfe
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x18], ecx
cmp byte [ebp - 0x35], bl
je 0x409dbd
mov ecx, dword [ebp + 0x54]
push ebx
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x18]
mov dword [ebp + 0x4c], ebx
call fcn.0043b757
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x5c]
call fcn.00433bac
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea edi, [esi + 0x3ff]
and edi, 0xfffffc00
add edi, 0x100000
lea eax, [edi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x34], edi
call fcn.00433b3f
lea ecx, [ebp + 0x4c]
call fcn.0042eb98
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x40a117
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
cmp ax, 0x40
je 0x409e10
cmp byte [ebp + 3], bl
je 0x409e10
cmp ax, 0x26
je 0x409df8
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x409e10
mov byte [ebp + 0x48], 1
jmp 0x409e13
cmp dword [ebp - 0x74], ebx
je 0x409d62
mov byte [ebp + 0x7f], 2
jmp 0x409d62
mov byte [ebp + 0x48], bl
push ebx
mov dword [ebp - 0xd0], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x14]
mov edi, dword [eax]
lea eax, [ebp - 0x168]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xd8], esi
je 0x409e48
mov eax, dword [ebp + 0x34]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409e4f
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0xbc], ebx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp + 0x30], ebx
jg 0x409e91
mov dword [ebp - 0xbc], 0x3e8
lea ecx, [ebp - 0x48]
mov byte [ebp + 0x4b], bl
call fcn.00433c24
mov al, byte [0x4a5290]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x40a10a
mov ecx, dword [ebp + 0x54]
push 0x4ff
push dword [ebp - 0xbc]
lea eax, [ebp - 0x118]
push ebx
push eax
push dword [ebp - 0x5c]
call fcn.0040ec0a
cmp eax, ebx
mov dword [ebp - 0x90], eax
jne 0x409f5e
lea eax, [ebp - 0x14]
mov edi, dword [eax]
push ebx
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x168]
push eax
push edi
mov dword [ebp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x1c], ebx
jle 0x409f0c
mov eax, dword [ebp + 0x2c]
cmp dword [ebp + 0x1c], eax
jle 0x409f03
mov dword [ebp + 0x1c], eax
add esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x34]
jl 0x409f2d
add dword [ebp + 0x34], 0x100000
mov eax, dword [ebp + 0x34]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.00433b3f
cmp byte [ebp + 0x7f], bl
je 0x409f3c
mov eax, dword [ebp + 0x34]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409f43
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x409f95
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4c], eax
sub eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xbc]
jge 0x40a04f
cmp esi, dword [ebp + 0x30]
je 0x40a101
cmp eax, 0x14
jl 0x40a101
jmp 0x40a04f
mov eax, dword [ebp - 0x5c]
cmp eax, 1
jle 0x409fc1
dec eax
cmp eax, dword [ebp - 0x90]
jne 0x409fc1
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x4b], 1
je 0x40a10a
cmp esi, dword [ebp + 0x30]
je 0x40a10a
jmp 0x40a04f
test byte [ebp + 0x73], 1
je 0x409fe1
mov eax, dword [ebp - 0xd8]
jmp 0x409fdd
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x40a10a
inc eax
cmp eax, esi
jl 0x409fcf
push 5
pop edi
dec edi
js 0x409e9c
cmp byte [0x4a5290], bl
jle 0x409e9c
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x409e9c
cmp dword [ebp - 0x244], 0x12
je 0x40a036
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x409fe4
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x4b], 1
je 0x409e9c
cmp esi, dword [ebp + 0x30]
je 0x409e9c
cmp byte [ebp + 0x48], bl
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x30], esi
mov dword [ebp - 0x9c], ecx
jne 0x40a08b
cmp dword [ebp - 0x50], 0x4b0
je 0x40a07e
push dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
push esi
push eax
call fcn.00433ce1
mov eax, dword [ebp - 0x48]
jmp 0x40a08b
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x40a0a8
mov ecx, dword [ebp + 0x54]
push eax
push eax
push 0x496134
push dword [ebp + 0x18]
push dword [ebp + 0x18]
call fcn.0043105f
jmp 0x40a0d2
cmp byte [ebp + 0x48], bl
je 0x40a0c6
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x3c]
push dword [ebp + 0x54]
call fcn.00442eae
add esp, 0x18
jmp 0x40a0d2
mov ecx, dword [ebp + 0x54]
push eax
push dword [ebp + 0x18]
call fcn.004335ed
cmp dword [ebp - 0x74], ebx
je 0x40a101
push dword [ebp - 0x74]
lea ecx, [ebp - 0x8c]
call fcn.0043ddc9
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp - 0x8c]
call fcn.00424fb6
lea ecx, [ebp - 0x8c]
call fcn.0042eb98
cmp byte [ebp + 0x4b], bl
je 0x409f95
lea ecx, [ebp - 0x48]
call fcn.0042eb98
jmp 0x40a1fd
cmp dword [ebp - 0x10], 0xffffff9c
je 0x40a1fd
jmp 0x40a1ed
mov ecx, dword [ebp + 0x54]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x5c]
call fcn.0040ec0a
mov ecx, dword [ebp - 0x5c]
dec ecx
cmp ecx, eax
je 0x40a1fd
cmp dword [ebp - 0x5c], 1
jle 0x40a1e5
cmp eax, ebx
jne 0x40a1e5
lea eax, [esi + 0x100000]
cmp eax, edi
jl 0x40a17d
add edi, 0x100000
lea eax, [edi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00433b3f
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
lea eax, [ebp - 0x14]
push dword [eax]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a1e5
cmp dword [ebp + 0x7c], ebx
jbe 0x40a1e5
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x40a1e5
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a1ed
cmp dword [ebp - 0x180], 0x12
je 0x40a1ed
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4a5290], bl
jg 0x40a1ac
mov al, byte [0x4a5290]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x40a126
cmp dword [ebp - 0x10], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp - 0x30], ebx
je 0x40a22e
cmp byte [ebp + 0x6f], bl
jle 0x40a22e
push ebx
lea eax, [ebp - 0x148]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x148]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x40a407
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x40a279
cmp byte [ebp + 3], bl
je 0x40a279
cmp ax, 0x26
je 0x40a273
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x40a279
mov byte [ebp + 0x7b], 1
jmp 0x40a27c
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0xb4]
call fcn.00433afb
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
jne 0x40a3a3
cmp byte [ebp + 0x77], 2
jne 0x40a2ae
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x40a310
cmp byte [ebp + 0x77], 1
lea ecx, [ebp - 0xb4]
jne 0x40a2c8
push dword [ebp - 0x50]
push esi
push dword [ebp + 0x5c]
call fcn.00433ce1
jmp 0x40a314
lea eax, [esi + 0x18]
push eax
call fcn.00433c6b
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0xac], esi
push dword [ebp - 0xb4]
mov dword [ebp - 0xb0], esi
call fcn.0047b530
mov eax, dword [ebp - 0xb4]
push 0x10
add eax, esi
push ebx
push eax
call fcn.0047b210
lea eax, [ebp - 0xb4]
push ebx
push eax
call fcn.00472a56
add esp, 0x20
cmp edi, ebx
jne 0x40a31a
mov edi, dword [ebp - 0xb4]
test byte [ebp + 0x73], 4
je 0x40a34b
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x40a344
mov ax, word [edi]
cmp ax, 0xd
je 0x40a33f
cmp ax, 0xa
jne 0x40a3a3
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x7c]
jae 0x40a330
jmp 0x40a3a3
test byte [ebp + 0x73], 1
jne 0x40a36a
test byte [ebp + 0x73], 2
je 0x40a3a3
jmp 0x40a39b
mov ax, word [edi]
cmp ax, 0xd
je 0x40a36f
cmp ax, 0xa
je 0x40a36f
inc edi
inc edi
cmp word [edi], bx
jne 0x40a359
mov word [edi], bx
jmp 0x40a3a3
cmp ax, 0xd
je 0x40a384
cmp ax, 0xa
je 0x40a384
inc edi
inc edi
jmp 0x40a39b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.0047b870
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x40a374
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x40
jne 0x40a3cd
push dword [ebp - 0xb4]
mov ecx, dword [ebp + 0x54]
push dword [ebp - 0xb4]
push 0x496134
push dword [ebp - 0x58]
push dword [ebp - 0x58]
call fcn.0043105f
jmp 0x40a3f9
cmp byte [ebp + 0x7b], bl
je 0x40a3ea
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x54]
call fcn.00442eae
add esp, 0x18
jmp 0x40a3f9
push dword [ebp - 0xb4]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.004335ed
lea ecx, [ebp - 0xb4]
call fcn.0042eb98
mov eax, dword [ebp - 0x30]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x288]
push 0x490348
push eax
mov word [ebp - 0x288], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x288]
push eax
push 0x49032c
call fcn.004335ed
cmp dword [ebp - 0x78], ebx
je 0x40a44b
push 1
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.0042eb98
jmp 0x40a46b
mov eax, dword [ebp - 0x3c]
cmp word [eax], bx
je 0x40a46b
mov ecx, dword [ebp + 0x54]
push 0x496134
push eax
call fcn.004335ed
mov ecx, dword [ebp - 0x54]
cmp ecx, ebx
je 0x40a488
cmp word [ecx], bx
je 0x40a488
lea eax, [ebp - 0x148]
push dword [eax + 8]
push ecx
call fcn.00402c6b
pop ecx
pop ecx
lea edi, [ebp - 0x148]
mov eax, dword [edi]
cmp eax, ebx
je 0x40a49b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x44]
mov eax, dword [esi]
cmp eax, ebx
mov dword [edi], ebx
je 0x40a4ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp + 0x20]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x98]
cmp dword [esi], ebx
je 0x40a4d2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x20]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x14]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0xa8]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a50b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x158], ebx
mov dword [esi], ebx
je 0x40a521
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40a52f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x54]
push ebx
mov dword [edi + 4], ebx
call fcn.004453fa
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0xc4]
call fcn.0042eb98
lea ecx, [ebp - 0xd4]
call fcn.0042eb98
lea ecx, [ebp - 0x64]
call fcn.00402ac9
lea ecx, [ebp - 0xf4]
call fcn.0042eb98
lea ecx, [ebp - 0x6c]
call fcn.00402ac9
lea ecx, [ebp - 0x70]
call fcn.00402ac9
lea ecx, [ebp - 0x98]
call fcn.00402ac9
lea ecx, [ebp + 0x20]
call fcn.00402ac9
lea ecx, [ebp - 0x44]
call fcn.00402ac9
lea ecx, [ebp - 0xa8]
call fcn.00402ac9
lea ecx, [ebp - 0x20]
call fcn.00402ac9
lea ecx, [ebp - 0x14]
call fcn.00402ac9
lea ecx, [ebp - 0x54]
call fcn.0042eb98
lea ecx, [ebp - 0x128]
call fcn.0042eb98
lea ecx, [ebp - 0xc8]
call fcn.0042eb98
lea ecx, [ebp - 0x40]
call fcn.0042eb98
lea ecx, [ebp - 0xf8]
call fcn.0042eb98
lea ecx, [ebp - 0xcc]
call fcn.0042eb98
lea ecx, [ebp - 0xec]
call fcn.0042eb98
lea ecx, [ebp - 0x94]
call fcn.0042eb98
lea ecx, [ebp - 0x78]
call fcn.00402ac9
lea ecx, [ebp - 0xfc]
call fcn.00402ac9
lea ecx, [ebp - 0xc0]
call fcn.0042eb98
lea ecx, [ebp - 0x11c]
call fcn.0042eb98
lea ecx, [ebp - 0x88]
call fcn.0042eb98
lea ecx, [ebp - 0xa4]
call fcn.0042eb98
lea ecx, [ebp - 0x3c]
call fcn.0042eb98
lea ecx, [ebp - 0xe0]
call fcn.0042eb98
lea ecx, [ebp - 0xdc]
call fcn.0042eb98
lea ecx, [ebp - 0xe8]
call fcn.0042eb98
lea ecx, [ebp - 0xf0]
call fcn.0042eb98
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18