Function at 0x40bd60
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Create tcp socket
Delete file
Encode data using xor
Enumerate gui resources
Enumerate processes
Extract resource via kernel32 functions
Initialize winsock library
Inspect load icon resource
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5656d1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1328
call fcn.00548050
mov eax, dword [0x5c6fc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x12c0], esi
mov dword [ebp - 0x12a4], esi
sub esp, 8
mov dword [ebp - 0x12c8], esi
call fcn.00401f10
mov dword [ebp - 4], 0
mov dword [esi], vtable.CYundunDlg.2.0
mov dword [esi + 0xa8], vtable.CYundunDlg.1.0
mov dword [esi + 0xb8], vtable.CYundunDlg.0
mov dword [esi + method.CMenu.virtual_0], vtable.CMenu.0
mov dword [esi + 0x18c], 0
mov byte [ebp - 4], 1
mov ecx, esi
push 0
call fcn.00418e78
call fcn.0041c89b
call fcn.0041c89b
push 0xdf
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x5cfc48
mov dword [esi + 0x180], eax
mov dword [esi + 0x178], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov dword [ebp - 0x12a8], esi
call edi
push 0x5a8488
push eax
call fcn.0054915a
add esp, 8
test eax, eax
je 0x40beda
mov dword [0x5d0444], 1
call edi
push 0x5a8490
push eax
call fcn.0054915a
add esp, 8
test eax, eax
je 0x40beda
movq xmm0, qword [eax + 6]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0x5d4514
push 0
movq qword [0x5d4514], xmm0
mov eax, dword [eax + 0xe]
push 1
mov dword [0x5d451c], eax
call esi
push 0
push 0
push eax
push str.1qaz2w
push 0xffffffffffffffff
push 0x5d4514
push 0
push 1
call esi
mov esi, dword [ebp - 0x12a8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7ff
push 0x5d3510
push 0
call edi
push 0x2e
push 0x5d3510
call fcn.005493c5
add esp, 8
test eax, eax
je 0x40c022
cmp word [eax + 2], 0x75
jne 0x40c022
cmp word [eax + 4], 0x70
jne 0x40c022
cmp word [eax + 6], 0x64
jne 0x40c022
push 0xc8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1000
lea eax, [ebp - 0x1018]
push 0
push eax
call fcn.0054a720
add esp, 0xc
lea eax, [ebp - 0x1018]
push 0x7ff
push eax
push 0
call edi
lea eax, [ebp - 0x1018]
push 0x2e
push eax
call fcn.00410a90
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
mov dword [eax + 2], 0x780065
mov dword [eax + 6], 0x65
lea eax, [ebp - 0x1018]
push eax
call edi
test eax, eax
jne 0x40ca05
push eax
push 2
mov dword [ebp - 0x12a0], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40bfc1
push 0
push 0x5a8498
push 0x5a84a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40c9de
lea eax, [ebp - 0x12a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40c9d7
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea edx, [ebp - 0x127c]
lea ecx, [ebp - 0x1018]
call fcn.004109b0
test eax, eax
je 0x40c00e
push dword [ebp - 0x1298]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x12a0]
push eax
push esi
call edi
test eax, eax
je 0x40c9d1
jmp 0x40bfe0
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40c042
push str.KERNEL32.DLL
call edi
mov esi, eax
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40c058
push str.Advapi32.dll
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5a84d4
push esi
call edi
push 0x5a84e4
push esi
mov dword [0x5cfc40], eax
call edi
push 0x5a7ab4
push 0xd2
push 0
mov dword [0x5cfc3c], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40c4ea
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40c4e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x12b0], edx
test edx, edx
je 0x40c4e4
xor ecx, ecx
add edi, 0xfffffff6
mov dword [ebp - 0x12ac], ecx
mov dword [ebp - 0x12bc], edi
je 0x40c4e4
mov eax, dword [ebp - 0x12bc]
lea edi, [edx + 0x1a]
mov dword [ebp - 0x12c4], edi
mov dword [ebp - 0x12a4], 8
nop word [eax + eax]
cmp byte [edi - 0x1a], 0x63
jne 0x40c339
cmp byte [edi - 0x19], 0x68
jne 0x40c339
cmp byte [edi - 0x18], 0x75
jne 0x40c339
cmp byte [edi - 0x17], 0x79
jne 0x40c354
cmp byte [edi - 0x16], 0xef
jne 0x40c354
cmp byte [edi - 0x15], 0xef
jne 0x40c354
cmp byte [edi - 0x14], 0xef
jne 0x40c354
cmp byte [edi - 0x13], 1
jne 0x40c354
mov al, byte [edi - 0x12]
mov byte [0x5c7840], al
mov esi, dword [edi]
mov dword [0x5d0434], esi
lea eax, [esi + 2]
push eax
call fcn.0054e885
mov ecx, eax
lea eax, [esi + 1]
push eax
lea eax, [edi + 4]
mov dword [ebp - 0x12b8], ecx
push eax
push ecx
call fcn.0054aa40
mov edx, dword [ebp - 0x12b8]
add esp, 0x10
mov esi, dword [0x5d0434]
mov ch, byte [edx]
inc edx
movsx eax, ch
mov dword [ebp - 0x12b8], edx
mov dword [0x5d0438], edx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movaps xmmword [ebp - 0x12e0], xmm0
test esi, esi
je 0x40c2bb
cmp esi, 8
jb 0x40c2bb
cmp dword [0x5cf358], 2
jl 0x40c2bb
movaps xmm3, xmmword [0x5a8ca0]
movaps xmm4, xmmword [0x5a8cb0]
movd xmm2, dword [ebp - 0x12a4]
mov dword [ebp - 0x12b4], esi
and dword [ebp - 0x12b4], 0xfffffff8
nop dword [eax + eax]
movd xmm0, dword [eax + edx]
pmovzxbd xmm1, xmm0
xorps xmm0, xmm0
paddd xmm1, xmm3
pcmpgtd xmm0, xmm1
pand xmm0, xmm4
paddd xmm0, xmm1
psrad xmm0, xmm2
pslld xmm0, xmm2
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x5a8cd0]
movd xmm0, dword [ebp - 0x12e0]
packuswb xmm1, xmm1
pxor xmm1, xmm0
movd dword [eax + edx], xmm1
movd xmm0, dword [eax + edx + 4]
pmovzxbd xmm1, xmm0
xorps xmm0, xmm0
paddd xmm1, xmm3
pcmpgtd xmm0, xmm1
pand xmm0, xmm4
paddd xmm0, xmm1
psrad xmm0, xmm2
pslld xmm0, xmm2
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x5a8cd0]
movd xmm0, dword [ebp - 0x12e0]
packuswb xmm1, xmm1
pxor xmm1, xmm0
movd dword [eax + edx + 4], xmm1
add eax, 8
cmp eax, dword [ebp - 0x12b4]
jb 0x40c200
cmp eax, esi
jae 0x40c2d0
nop
mov cl, byte [eax + edx]
add cl, 0x10
xor cl, ch
mov byte [eax + edx], cl
inc eax
cmp eax, esi
jb 0x40c2c0
xor ecx, ecx
test esi, esi
je 0x40c2f9
mov edx, dword [0x5d0430]
mov edi, dword [ebp - 0x12b8]
movzx eax, byte [ecx + edi]
inc ecx
xor edx, eax
cmp ecx, esi
jb 0x40c2e2
mov edi, dword [ebp - 0x12c4]
mov dword [0x5d0430], edx
mov eax, dword [ebp - 0x12ac]
mov edx, dword [ebp - 0x12b0]
add eax, esi
mov ecx, dword [eax + edx + 0x1f]
cmp ecx, 0x400
jae 0x40c32d
add edx, 0x23
push ecx
add eax, edx
push eax
push 0x5cfc60
call fcn.0054aa40
mov edx, dword [ebp - 0x12b0]
add esp, 0xc
mov eax, dword [ebp - 0x12bc]
mov ecx, dword [ebp - 0x12ac]
inc ecx
inc edi
mov dword [ebp - 0x12ac], ecx
mov dword [ebp - 0x12c4], edi
cmp ecx, eax
jb 0x40c100
jmp 0x40c4e4
cmp byte [edi - 0x18], 0x75
jne 0x40c339
cmp byte [edi - 0x17], 0x79
jne 0x40c339
cmp byte [edi - 0x16], 0xef
jne 0x40c339
cmp byte [edi - 0x15], 0xef
jne 0x40c339
cmp byte [edi - 0x14], 0xef
jne 0x40c339
cmp byte [edi - 0x13], 2
jne 0x40c339
mov eax, dword [ecx + edx + 8]
mov dword [str.1qaz2w], eax
mov ax, word [ecx + edx + 0xc]
mov word [0x5c7914], ax
mov esi, dword [ecx + edx + 0x26]
mov eax, dword [ecx + edx + 0xe]
mov dword [0x5d4510], eax
mov dword [0x5d0428], esi
lea eax, [esi + 1]
push eax
call fcn.0054e885
mov edi, dword [ebp - 0x12ac]
mov ecx, eax
mov eax, dword [ebp - 0x12b0]
add eax, 0x2a
mov dword [0x5d042c], ecx
push esi
add eax, edi
push eax
push ecx
call fcn.0054aa40
add esp, 0x10
xor ecx, ecx
test esi, esi
je 0x40c449
mov edx, dword [0x5d042c]
cmp esi, 0x40
jb 0x40c43a
movaps xmm2, xmmword [0x5a8cf0]
mov eax, esi
and eax, 0xffffffc0
mov dword [ebp - 0x12a4], eax
lea eax, [edx + 0x20]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp ecx, dword [ebp - 0x12a4]
jb 0x40c3f6
cmp ecx, esi
jae 0x40c449
nop
xor byte [ecx + edx], 0xaa
inc ecx
cmp ecx, esi
jb 0x40c440
push 0x5000
call fcn.0054e885
mov ecx, dword [ebp - 0x12b0]
mov dword [ebp - 0x12a4], eax
add ecx, 0x2a
lea eax, [esi + edi]
mov esi, dword [ebp - 0x12a4]
push 0x5000
add eax, ecx
push eax
push esi
call fcn.0054aa40
movaps xmm2, xmmword [0x5a8cf0]
lea eax, [esi + 0x20]
add esp, 0x10
mov ecx, 0x140
nop dword [eax + eax]
lea eax, [eax + 0x40]
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x60]
pxor xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
sub ecx, 1
jne 0x40c490
mov eax, dword [esi]
sub esi, 0x9ffc
mov dword [0x5d0064], eax
mov dword [0x5d0424], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7ff
push 0x5d2510
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x5d2510
call fcn.005493c5
add esp, 8
test eax, eax
je 0x40c547
lea ecx, [eax + 2]
mov edx, 0x5d0448
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40c520
push 0x2e
push 0x5d0448
call fcn.005493c5
add esp, 8
test eax, eax
je 0x40c547
xor ecx, ecx
mov dword [eax], ecx
cmp byte [0x5c7840], 3
mov ecx, 0x5d0448
mov edx, 0x5c7818
cmovne edx, dword [0x5c7814]
mov dword [0x5c7814], edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c570
sub ecx, esi
sar ecx, 1
cmp word [ecx*2 + 0x5d0442], 0x5b
jne 0x40c608
mov eax, 0x76fe
cmp word [ecx*2 + 0x5d0444], ax
jne 0x40c608
cmp word [ecx*2 + 0x5d0446], 0x5d
jne 0x40c608
lea ecx, [ecx*2 - 6]
cmp ecx, 0xc8
jae 0x40cad1
xor eax, eax
mov word [ecx + 0x5d0448], ax
mov ecx, 0x5d0448
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c5d0
sub ecx, esi
sar ecx, 1
cmp word [ecx*2 + 0x5d0442], 0x5b
jne 0x40c608
mov eax, 0x76fe
cmp word [ecx*2 + 0x5d0444], ax
jne 0x40c608
cmp word [ecx*2 + 0x5d0446], 0x5d
je 0x40cab0
call fcn.0040f790
push 0x5b
push 0x5d2510
call fcn.005493c5
mov edx, eax
add esp, 8
test edx, edx
je 0x40c685
mov ecx, 0x5d2510
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c630
sub ecx, esi
mov eax, edx
sub eax, 0x5d2510
sar ecx, 1
sar eax, 1
sub ecx, eax
add ecx, ecx
push ecx
push 0
push edx
call fcn.0054a720
mov ecx, 0x5d2510
add esp, 0xc
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x40c660
mov eax, dword [str..exe]
mov dword [ecx], eax
mov eax, dword [0x5a846c]
mov dword [ecx + 4], eax
mov ax, word [0x5a8470]
mov word [ecx + 8], ax
xor cl, cl
call fcn.0040bba0
mov ecx, 0x5d3510
call fcn.0040b8b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x5a8534
push eax
call fcn.0054915a
add esp, 8
push 0x64
push dword [ebp - 0x12a8]
test eax, eax
je 0x40c71b
mov dword [0x5cfc44], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x30
lea eax, [ebp - 0x105c]
push 0
push eax
call fcn.0054a720
add esp, 0xc
mov byte [ebp - 0x1030], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x105c], eax
xor ecx, ecx
nop
movzx eax, word [ecx + str.CYYunDun]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x105a], ax
test ax, ax
jne 0x40c6f0
lea eax, [ebp - 0x105c]
push eax
push 0x40ee90
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40c78e
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x30
lea eax, [ebp - 0x105c]
push 0
push eax
call fcn.0054a720
add esp, 0xc
mov byte [ebp - 0x1030], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x105c], eax
xor ecx, ecx
nop dword [eax]
movzx eax, word [ecx + str.CYYunDun]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x105a], ax
test ax, ax
jne 0x40c750
lea eax, [ebp - 0x105c]
push eax
push 0x40ee90
call dword [sym.imp.USER32.dll_EnumWindows]
mov cl, byte [0x5c7840]
cmp cl, 1
je 0x40c7bb
cmp cl, 2
je 0x40c7bb
cmp cl, 3
je 0x40c7bb
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x12c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005478fb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
cmp dword [0x5d042c], 0
je 0x40c7c9
call fcn.0040bcf0
push 0x5d1510
call dword [0x5cfc40]
test eax, eax
jne 0x40c7f7
mov cl, 1
call fcn.0040bba0
call fcn.0040bcf0
push 0x5d1510
call dword [0x5cfc40]
test eax, eax
je 0x40cad6
push str.AddSelfWindowsFireWall
push eax
call edi
test eax, eax
je 0x40c805
call eax
lea eax, [ebp - 0x1208]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c885
mov eax, 2
push str.127.1.1.254
mov word [ebp - 0x1028], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0xe2e0
mov dword [ebp - 0x1024], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1026], ax
lea eax, [ebp - 0x1028]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40c882
push 0xa
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x40c885
push esi
call edi
push esi
call edi
push 0x7ff
push 0x5d3510
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5d3510
lea ecx, [edx - 2]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40c8a2
mov eax, dword [str.__a]
mov esi, 0x5d4514
mov dword [ecx], eax
mov eax, dword [0x5a85b4]
mov dword [ecx + 4], eax
mov ax, word [0x5a85b8]
mov word [ecx + 8], ax
mov ecx, esi
mov dword [ebp - 0x12c0], ecx
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c8d4
sub esi, ecx
lea edi, [edx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c8e4
mov ecx, esi
mov dword [ebp - 0x12a4], esi
mov esi, dword [ebp - 0x12c0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x12a4]
and ecx, 3
add edx, 0xfffffffe
rep movsb byte es:[edi], byte [esi]
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x40c911
mov eax, dword [str.__d]
xorps xmm0, xmm0
mov dword [edx], eax
mov eax, dword [0x5a85c0]
mov dword [edx + 4], eax
mov ax, word [0x5a85c4]
mov word [edx + 8], ax
lea eax, [ebp - 0x1338]
push eax
lea eax, [ebp - 0x1328]
movlpd qword [ebp - 0x1324], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5d3510
push 0
movlpd qword [ebp - 0x131c], xmm0
movlpd qword [ebp - 0x1314], xmm0
movlpd qword [ebp - 0x130c], xmm0
movlpd qword [ebp - 0x1304], xmm0
movlpd qword [ebp - 0x12fc], xmm0
movlpd qword [ebp - 0x12f4], xmm0
movlpd qword [ebp - 0x12ec], xmm0
movups xmmword [ebp - 0x1338], xmm0
mov dword [ebp - 0x1328], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40caf2
push 0x2710
push dword [ebp - 0x12a8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.0054e86f
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1018]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x96
push dword [ebp - 0x12a8]
call esi
lea eax, [ebp - 0x1018]
push eax
call edi
jmp 0x40ca0b
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0x1018]
push eax
push 0x5d3510
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x96
push dword [ebp - 0x12a8]
call esi
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1070], 0x44
push eax
lea eax, [ebp - 0x1070]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1018]
movlpd qword [ebp - 0x106c], xmm0
push eax
movlpd qword [ebp - 0x1064], xmm0
movlpd qword [ebp - 0x105c], xmm0
movlpd qword [ebp - 0x1054], xmm0
movlpd qword [ebp - 0x104c], xmm0
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1028], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call fcn.0054e86f
mov ecx, dword [0x5d4568]
push 0
push edx
push 0x5a84f0
call fcn.004109a0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0054e86f
call fcn.00547a5f
push 0
push dword [0x5c7814]
push 0x5a8540
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0054e86f
push 0
push dword [0x5c7814]
push 0x5a85c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0054e86f
int3