Function at 0x40da30
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1000
mov edx, str.TEMPonefile_PID_TIME
push edi
push esi
push ebx
sub esp, 0x32c
mov eax, dword [sym.imp.msvcrt.dll___wargv]
mov eax, dword [eax]
mov dword [esp + 0x4c], eax
mov eax, 0x43b0a0
call fcn.00407c40
test al, al
je 0x40e985
mov dword [esp + 4], 1
mov dword [esp], 0x408820
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40e9ae
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [0x43b090], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov ebp, eax
mov dword [0x43b088], eax
mov eax, dword [0x43b090]
mov dword [0x43b08c], 0
cmp byte [eax], 0x4b
lea edi, [eax + 3]
movzx ecx, byte [eax + 2]
setne dl
cmp byte [eax + 1], 0x41
mov dword [0x43b090], edi
setne al
or dl, al
jne 0x40ea07
cmp cl, 0x59
jne 0x40ea07
mov dword [esp], 0x20000
mov dword [0x43e0a8], 0
call sub.msvcrt.dll_malloc
mov dword [0x43e0b4], eax
test eax, eax
je 0x40e97b
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40e971
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x40e944
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x43e0a4], esi
mov dword [0x43e0a8], edi
mov dword [0x43e0b0], 0
mov dword [0x43e0ac], ebp
mov byte [0x43b080], 1
mov ebp, 0x43a880
mov ebx, dword [0x43e0b8]
mov edi, dword [0x43e0bc]
mov dword [esp + 0x48], ebp
nop
lea eax, [esp + 0x220]
xor edx, edx
mov esi, 2
mov dword [esp + 0x38], eax
lea esi, cs:[esi]
lea esi, [esi]
mov eax, ebx
sub eax, edi
jne 0x40dd0d
mov ebp, dword [0x43e0b0]
mov ecx, dword [0x43e0ac]
cmp ebp, ecx
setb al
or dl, al
je 0x40dd70
mov eax, dword [0x43e0a4]
mov dword [0x43e0bc], 0
mov dword [0x43e0b8], 0x20000
call fcn.0040c6e0
mov ebx, dword [0x43e0bc]
cmp dword [0x43e0b8], ebx
sete dl
cmp eax, 0xffffff88
ja 0x40dd78
xor edi, edi
mov eax, ebx
mov dword [0x43e0b8], ebx
mov dword [0x43e0bc], 0
sub eax, edi
je 0x40dca6
cmp eax, esi
mov byte [esp + 0x3c], dl
cmova eax, esi
mov ebp, eax
mov eax, dword [0x43e0b4]
mov dword [esp + 8], ebp
add eax, edi
add edi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x38], ebp
sub esi, ebp
movzx edx, byte [esp + 0x3c]
mov dword [0x43e0bc], edi
jne 0x40dca0
movzx eax, word [esp + 0x220]
mov esi, dword [esp + 0x48]
mov word [esi], ax
test ax, ax
je 0x40dd88
add esi, 2
mov dword [esp + 0x48], esi
jmp 0x40dc80
cmp ebp, ecx
je 0x40dca0
mov eax, str.Error__couldnt_decode_attached_data.
call fcn.004084d0
lea esi, [esi]
movzx ecx, word [0x43a880]
test cx, cx
je 0x40dff0
movzx edx, word [0x43b0a0]
xor esi, esi
mov eax, 2
mov word [0x438880], si
test dx, dx
jne 0x40ddce
jmp 0x40e8af
add eax, 2
cmp eax, 0x2002
je 0x40ea4b
mov word [eax + 0x43887e], dx
movzx edx, word [eax + 0x43b0a0]
test dx, dx
jne 0x40ddc0
add eax, 0x438880
xor ebx, ebx
mov word [eax], bx
cmp word [0x438880], 0
je 0x40e8c7
mov edx, 0x1000
mov eax, 0x438880
lea esi, cs:[esi]
lea esi, cs:[esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40de10
test edx, edx
je 0x40ea4b
mov dword [eax], 0x5c
mov edx, 0x1000
mov eax, 0x438880
cmp word [0x438880], 0
je 0x40de4c
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40de40
mov ebx, 0x43a880
lea esi, cs:[esi]
lea esi, [esi]
test edx, edx
je 0x40ea4b
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40de60
xor ecx, ecx
cmp word [0x438080], 0
mov word [eax], cx
je 0x40df8e
mov edx, 8
lea eax, [esp + 0x220]
call fcn.0040d940
mov eax, 0x438880
mov esi, dword [esp + 0x220]
mov edi, dword [esp + 0x224]
call fcn.00408610
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x438880
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40df77
jmp 0x40e9d6
xor eax, eax
mov edx, 0x8000
mov ecx, eax
cmp edx, esi
sbb ecx, edi
cmovae eax, edi
cmovae edx, esi
mov dword [esp + 0x44], eax
mov eax, 0x41c040
mov dword [esp + 0x40], edx
call fcn.0040d940
lea eax, [esp + 0x220]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x220], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41c040
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x40ea18
sub esi, dword [esp + 0x40]
sbb edi, dword [esp + 0x44]
mov eax, esi
or eax, edi
jne 0x40df08
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40dc6a
movzx edx, word [0x438880]
mov eax, 2
test dx, dx
jne 0x40dfce
jmp 0x40e98f
add eax, 2
cmp eax, 0x2002
je 0x40ea4b
mov word [eax + 0x43807e], dx
movzx edx, word [eax + 0x438880]
test dx, dx
jne 0x40dfc0
add eax, 0x438080
xor edx, edx
mov word [eax], dx
jmp 0x40de8f
mov ebx, dword [0x43e0a4]
test ebx, ebx
je 0x40e0b6
mov eax, dword [ebx + 0x7380]
test eax, eax
jne 0x40e0b6
mov eax, dword [ebx + 0x7374]
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov dword [esp + 0x38], eax
test esi, esi
je 0x40e05e
mov eax, dword [esi]
mov ebp, dword [esi + 0x6ab4]
mov edx, dword [esi + 0x6ab8]
test eax, eax
je 0x40e92e
test ebp, ebp
je 0x40ea36
mov dword [esp], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 4], eax
call ebp
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], edx
call ebp
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x40e958
test edi, edi
je 0x40e999
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call edi
mov dword [ebx + 0x73a0], 0
mov eax, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [0x43e0b4]
mov esi, pe_nt_image_headers32
lea ebx, [esp + 0x220]
lea edi, [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x4170fc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1a0]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call fcn.00401a60
xor eax, eax
mov word [esp + 0x220], ax
movzx eax, byte [esp + 0x1a0]
test al, al
je 0x40e18a
mov byte [esp + 0x50], al
lea eax, [esp + 0x5c]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x51], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x40ea4b
cmp word [ebx], 0
movzx ecx, word [esp + 0x5c]
mov edx, esi
mov eax, ebx
je 0x40e15c
lea esi, cs:[esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e150
test edx, edx
je 0x40ea4b
xor ebp, ebp
mov word [eax], cx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], bp
mov eax, 1
sub eax, esi
movzx eax, byte [esp + eax + 0x220]
test al, al
je 0x40e18a
mov esi, edx
jmp 0x40e112
xor eax, eax
mov esi, 0x28
lea ebx, [esp + 0x150]
mov word [esp + 0x150], ax
lea edi, [esp + 0x52]
mov eax, 0x4e
mov byte [esp + 0x52], al
lea eax, [esp + 0x60]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x53], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x40ea4b
cmp word [ebx], 0
movzx ecx, word [esp + 0x60]
mov edx, esi
mov eax, ebx
je 0x40e1fc
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e1f0
test edx, edx
je 0x40ea4b
mov word [eax], cx
xor ecx, ecx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], cx
mov eax, 1
sub eax, esi
movzx eax, byte [eax + 0x417350]
test al, al
je 0x40e229
mov esi, edx
jmp 0x40e1a9
lea eax, [esp + 0x220]
mov dword [esp + 4], eax
lea eax, [esp + 0x150]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 0x38], eax
call eax
sub esp, 8
cmp word [0x424040], 0
je 0x40e8d1
xor eax, eax
mov esi, 0x28
lea ebx, [esp + 0x100]
mov word [esp + 0x100], ax
lea edi, [esp + 0x54]
mov eax, 0x4e
mov byte [esp + 0x54], al
lea eax, [esp + 0x64]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x55], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x40ea4b
cmp word [ebx], 0
movzx ecx, word [esp + 0x64]
mov edx, esi
mov eax, ebx
je 0x40e2cc
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e2c0
test edx, edx
je 0x40ea4b
xor ebp, ebp
mov word [eax], cx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], bp
mov eax, 1
sub eax, esi
movzx eax, byte [eax + 0x417366]
test al, al
je 0x40e2f9
mov esi, edx
jmp 0x40e279
lea eax, [esp + 0x100]
mov dword [esp + 4], 0x424040
mov esi, 0x28
mov dword [esp], eax
mov eax, dword [esp + 0x38]
call eax
xor ecx, ecx
sub esp, 8
mov eax, dword [esp + 0x4c]
lea ebx, [esp + 0xb0]
lea edi, [esp + 0x56]
mov edx, dword [eax]
mov word [esp + 0xb0], cx
mov eax, 0x4e
mov ebp, edx
mov byte [esp + 0x56], al
lea eax, [esp + 0x68]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x57], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x40ea4b
cmp word [ebx], 0
movzx ecx, word [esp + 0x68]
mov edx, esi
mov eax, ebx
je 0x40e38c
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e380
test edx, edx
je 0x40ea4b
xor edx, edx
mov word [eax], cx
add ebx, 2
mov word [eax + 2], dx
mov eax, 1
lea edx, [esi - 1]
sub eax, esi
movzx eax, byte [eax + 0x41737c]
test al, al
je 0x40e3b9
mov esi, edx
jmp 0x40e33b
lea eax, [esp + 0xb0]
mov dword [esp + 4], ebp
xor ebp, ebp
mov dword [esp], eax
mov eax, dword [esp + 0x38]
call eax
xor eax, eax
mov ecx, 0x11
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 8
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov dword [esp], 0xfffffff6
mov dword [esp + 0x98], 0x100
call ebx
sub esp, 4
mov dword [esp + 0xa4], eax
mov dword [esp], 0xfffffff5
call ebx
sub esp, 4
mov dword [esp + 0xa8], eax
mov dword [esp], 0xfffffff4
call ebx
sub esp, 4
mov dword [esp + 0xac], eax
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x58]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
mov esi, eax
mov word [0x428060], bp
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x426060
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x40ea4b
mov edi, dword [esp + 0x58]
mov dword [esi], 0x426060
xor ebx, ebx
test edi, edi
jle 0x40e5a9
mov edi, dword [esi + ebx*4]
mov ebp, str.__t_n_v_
mov eax, 0x20
jmp 0x40e4b0
movzx eax, word [ebp + 2]
add ebp, 2
test ax, ax
je 0x40e789
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_wcschr
test eax, eax
je 0x40e4a0
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40e4f4
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e4e0
test edx, edx
je 0x40ea4b
mov edx, dword [esi + ebx*4]
mov dword [eax], 0x22
mov dword [esp + 0x38], esi
movzx ebp, word [edx]
cmp bp, 0x5c
jne 0x40e6fd
nop
xor eax, eax
lea esi, cs:[esi]
lea esi, [esi]
mov ecx, edx
movzx ebp, word [edx + 2]
add edx, 2
mov edi, eax
add eax, 1
cmp bp, 0x5c
je 0x40e520
test bp, bp
je 0x40e821
cmp bp, 0x22
je 0x40e77c
xor esi, esi
test eax, eax
jle 0x40e6af
lea esi, cs:[esi]
lea esi, [esi]
cmp word [0x428060], 0
mov ebp, 0x8000
mov eax, 0x428060
je 0x40e594
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub ebp, 1
cmp word [eax], 0
jne 0x40e580
test ebp, ebp
je 0x40ea4b
mov dword [eax], 0x5c
lea eax, [esi + 1]
cmp edi, esi
je 0x40e6ab
mov esi, eax
jmp 0x40e560
lea eax, [esp + 0x220]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x428060
mov dword [esp], 0x438080
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40e9b8
mov eax, dword [esp + 0x224]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x220]
mov dword [esp + 0x1a0], 0
mov dword [0x438060], eax
test eax, eax
je 0x40e692
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x1a0]
mov dword [esp + 4], eax
mov eax, dword [0x438060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x40e67b
mov dword [esp + 0x1a0], 1
mov eax, dword [0x438060]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [0x438060], 0
call fcn.004086d0
mov eax, dword [esp + 0x1a0]
add esp, 0x32c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
movzx ebp, word [ecx + 2]
cmp word [0x428060], 0
je 0x40e772
mov ecx, 0x8000
mov eax, 0x428060
lea esi, cs:[esi]
nop
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40e6d0
test ecx, ecx
je 0x40ea4b
xor ecx, ecx
add edx, 2
mov word [eax], bp
mov word [eax + 2], cx
movzx ebp, word [edx]
cmp bp, 0x5c
je 0x40e510
test bp, bp
je 0x40e968
cmp bp, 0x22
jne 0x40e6af
mov esi, 1
xor edi, edi
lea esi, cs:[esi]
lea esi, cs:[esi]
cmp word [0x428060], 0
mov ecx, 0x8000
mov eax, 0x428060
je 0x40e754
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40e740
test ecx, ecx
je 0x40ea4b
add edi, 1
mov dword [eax], 0x5c
cmp edi, esi
jl 0x40e720
cmp word [0x428060], 0
movzx ebp, word [edx]
jne 0x40e6bd
mov eax, 0x428060
jmp 0x40e6e4
lea esi, [eax + eax + 1]
test esi, esi
jg 0x40e711
jmp 0x40e6af
mov ecx, dword [esi + ebx*4]
mov edx, 0x8000
mov eax, 0x428060
cmp word [0x428060], 0
je 0x40e7d4
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e7a0
movzx edi, word [ecx]
test di, di
je 0x40e7dc
lea esi, cs:[esi]
lea esi, [esi]
test edx, edx
je 0x40ea4b
mov word [eax], di
add eax, 2
add ecx, 2
sub edx, 1
movzx edi, word [ecx]
test di, di
jne 0x40e7c0
xor edx, edx
mov word [eax], dx
add ebx, 1
cmp ebx, dword [esp + 0x58]
jge 0x40e5a9
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40e816
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e802
test edx, edx
je 0x40ea4b
mov dword [eax], 0x20
jmp 0x40e490
add eax, eax
mov esi, dword [esp + 0x38]
test eax, eax
jle 0x40e871
xor edi, edi
lea esi, [esi]
cmp word [0x428060], 0
mov ecx, 0x8000
mov edx, 0x428060
je 0x40e864
lea esi, cs:[esi]
lea esi, [esi]
add edx, 2
sub ecx, 1
cmp word [edx], 0
jne 0x40e850
test ecx, ecx
je 0x40ea4b
add edi, 1
mov dword [edx], 0x5c
cmp edi, eax
jne 0x40e830
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40e8a4
lea esi, cs:[esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40e890
test edx, edx
je 0x40ea4b
mov dword [eax], 0x22
jmp 0x40e7e1
xor ebx, ebx
mov eax, 0x438880
mov word [eax], bx
cmp word [0x438880], 0
jne 0x40ddf9
mov eax, 0x438880
jmp 0x40de24
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0x424040
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x424040
sub esp, 0xc
cmp word [0x424040], 0
jne 0x40e91b
jmp 0x40e924
cmp eax, 0x426042
je 0x40ea4b
add eax, 2
cmp word [eax], 0
jne 0x40e910
xor edx, edx
mov word [eax], dx
jmp 0x40e25a
test ebp, ebp
je 0x40ea3e
mov dword [esp + 4], esi
mov dword [esp], edx
call ebp
jmp 0x40e05e
mov eax, 7
cpuid
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x40dc0f
test edi, edi
jne 0x40e0a9
jmp 0x40e9a1
mov esi, dword [esp + 0x38]
jmp 0x40e871
mov dword [0x43e0a4], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.004084d0
mov eax, str.TEMPonefile_PID_TIME
call fcn.00408420
mov eax, 0x438080
jmp 0x40dfe6
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40e0b6
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.004084d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_launch_child
call fcn.00408450
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp], 2
call dword [0x416054]
mov dword [esp + 8], 0x438880
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401a30
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__couldnt_find_attached_data_header.
call fcn.004084d0
lea esi, [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_unpack_file_to_target_path.
call fcn.00408450
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40e05e
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 8
jmp 0x40ea9e
mov eax, dword [0x416004]
mov eax, dword [eax]
call eax
mov eax, dword [0x416004]
add eax, 4
mov dword [0x416004], eax
mov eax, dword [0x416004]
mov eax, dword [eax]
test eax, eax
jne 0x40ea88
nop
nop
leave
ret