Function at 0x413510
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Hide graphical window
Link many functions at runtime
Log keystrokes
Log keystrokes via application hook
Move file
Resume thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x380], edx
mov dword [ebp - 0x384], edx
mov dword [ebp - 0x388], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x414b94
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406b0c
mov eax, dword [ebp - 4]
fstp qword [eax + 0x204]
wait
push 0x414ba4
mov eax, dword [0x41a810]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
push eax
push 1
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x204]
fnstsw ax
sahf
jae 0x4135c7
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x250]
call fcn.00403668
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403668
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x414b61
cmp byte [0x41a79c], 0
je 0x4135f2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x250]
call fcn.00403668
push eax
push 0x414bb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov byte [0x41a79c], 0
mov eax, dword [ebp - 4]
call fcn.004133ec
test al, al
je 0x414b61
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1d8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c0], edx
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x19c]
lea eax, [ebp - 0x380]
mov edx, 0x414c04
call fcn.004034f0
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x414b57
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x384]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x384]
lea edx, [ebp - 0x380]
call fcn.004060cc
mov eax, dword [ebp - 0x380]
call fcn.004061d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
sub eax, 1
jb 0x4136ed
je 0x41371d
dec eax
je 0x413729
jmp 0x413733
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x414c14
call fcn.00410f8c
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x211]
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x212], al
jmp 0x413733
mov eax, dword [ebp - 4]
mov byte [eax + 0x212], 0
jmp 0x413733
mov eax, dword [ebp - 4]
mov byte [eax + 0x212], 1
lea eax, [ebp - 0x149]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x384]
lea edx, [ebp - 0x149]
mov ecx, 0x105
call fcn.00403454
mov eax, dword [ebp - 0x384]
push eax
lea eax, [ebp - 0x380]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
mov ecx, 0x414c28
call fcn.0040bdb8
mov edx, dword [ebp - 0x380]
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.0040327c
lea eax, [ebp - 0x380]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004034a4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
mov ecx, 1
call fcn.004036a8
mov eax, dword [ebp - 0x380]
mov edx, 0x414c48
call fcn.004035b4
je 0x4137e5
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 0x414c48
call fcn.004034ac
mov eax, dword [ebp - 4]
add eax, 0x24c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040327c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov ecx, 0x414c54
call fcn.004034f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x21c], edx
push 0x414c5c
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x413857
push 0x15b3
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, 0xffffff7f
je 0x413857
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21c], 0
jge 0x4139d6
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
mov esi, ebx
mov dword [eax + 0x21c], esi
lea edx, [ebp - 0x380]
mov eax, esi
call fcn.00405d28
mov ecx, dword [ebp - 0x380]
mov eax, dword [ebp - 4]
add eax, 0x220
mov edx, 0x414c78
call fcn.004034f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
lea eax, [ebp - 0x380]
mov edx, 0x414c88
call fcn.004034f0
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4139f4
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
dec ebx
cmp ebx, 0x80000036
jne 0x41386a
jmp 0x4139f4
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x413928
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1a8]
lea eax, [ebp - 0x380]
mov edx, 0x414ca8
call fcn.004034f0
mov ecx, dword [ebp - 0x380]
mov dl, 1
mov eax, dword [0x4050cc]
call fcn.00407514
call fcn.00402d40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00413218
test al, al
je 0x413993
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x414cc4
call fcn.004034f0
lea eax, [ebp - 0x37c]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x378], 3
mov eax, dword [ebp - 8]
call fcn.00403668
mov dword [ebp - 0x374], eax
mov word [ebp - 0x36c], 0x414
lea eax, [ebp - 0x37c]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4139d6
mov eax, dword [ebp - 4]
inc dword [eax + 0x21c]
mov eax, dword [ebp - 4]
push dword [eax + 0x24c]
push 0x414c54
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
call fcn.00405d28
push dword [ebp - 0x380]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 3
call fcn.00403564
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00403668
push eax
call sub.kernel32.dll_CreateDirectoryA_1
test eax, eax
je 0x4138ec
mov eax, dword [ebp - 4]
add eax, 0x220
mov edx, 0x414c78
call fcn.0040327c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21c], 0
je 0x413a39
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
call fcn.00405d28
mov edx, dword [ebp - 0x380]
mov eax, dword [ebp - 4]
add eax, 0x220
call fcn.004034ac
cmp dword [ebp - 0x40], 0
je 0x413a4d
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x40], eax
call fcn.0040263c
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 0x414c48
call fcn.004034ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
add eax, 0x30
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040327c
mov eax, dword [ebp - 4]
add eax, 0x240
call fcn.00403228
mov eax, dword [ebp - 4]
add eax, 0x244
call fcn.00403228
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.00403228
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x25c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x414c14
call fcn.00410f8c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
jne 0x413b14
call fcn.00402de0
jmp 0x414b61
call fcn.00406b0c
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1a0]
fnstsw ax
sahf
jbe 0x413b53
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x250]
call fcn.00403668
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403668
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.00412498
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov edx, 0x414c88
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
lea eax, [ebp - 0x380]
call fcn.004034f0
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0x2884
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x413bb7
call fcn.00402de0
jmp 0x414b61
push 0x174
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1d8], ebx
test ebx, ebx
jne 0x413be7
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.004034f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00403668
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x413cbe
lea eax, [ebp - 0xc]
call fcn.00403228
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00405ea8
test al, al
je 0x413c4e
lea eax, [ebp - 0xc]
mov edx, 0x414cd0
call fcn.004032c0
push 0
lea edx, [ebp - 0x380]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0x414cec
push dword [ebp - 0xc]
push 0x414d04
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x388]
call fcn.00406b30
push dword [ebp - 0x388]
lea eax, [ebp - 0x384]
mov edx, 4
call fcn.00403564
mov eax, dword [ebp - 0x384]
call fcn.00403668
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00402de0
jmp 0x414b61
push 0x414d14
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x413cdc
call fcn.00402de0
jmp 0x414b61
push 0x414d1c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x413cfa
call fcn.00402de0
jmp 0x414b61
push 0x414d24
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x413d18
call fcn.00402de0
jmp 0x414b61
push 0x414d2c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x413d34
call fcn.00402de0
jmp 0x414b61
push 0x414d34
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x413d50
call fcn.00402de0
jmp 0x414b61
push 0x414d3c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x413d6c
call fcn.00402de0
jmp 0x414b61
push 0x414d44
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x413d88
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
xor ecx, ecx
mov edx, 0x174
call fcn.004027ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov dword [eax + 0x58], 1
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413dce
call fcn.00402de0
jmp 0x414b61
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xba]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov byte [eax + 0x4a], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x9a]
mov byte [eax + 0x49], dl
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x413e10
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x32]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d8]
mov byte [edx + 0x3f], al
mov edx, dword [ebp - 4]
cmp byte [edx + 0x12a], 0
jne 0x413e58
mov edx, dword [ebp - 4]
cmp byte [edx + 0x13a], 0
jne 0x413e58
mov edx, dword [ebp - 4]
cmp byte [edx + 0xca], 0
je 0x413e54
mov edx, dword [ebp - 4]
cmp byte [edx + 0xda], 0
jne 0x413e58
xor edx, edx
jmp 0x413e5a
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x15a]
mov byte [eax + 0x52], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x17a]
mov byte [eax + 0x62], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x16a]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x22]
xor dl, 1
mov byte [eax + 0x3e], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x14a]
mov byte [eax + 0x54], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x3f], 0
jne 0x413ebd
cmp byte [eax + 0x3e], 0
jne 0x413ebd
cmp byte [eax + 0x54], 0
je 0x413ede
push 0
mov eax, dword [ebp - 0x10]
push eax
push edi
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x413ede
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1d8]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x258]
mov byte [ebx + 0x61], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x45], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x10a]
mov byte [ebx + 0x50], al
xor eax, eax
mov byte [ebx + 0x3c], al
test al, al
je 0x413f82
push 0xfffffffffffffff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowRect
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x4c], eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
lea eax, [ebp - 0x380]
mov edx, 0x414d54
call fcn.004034f0
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1bc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1bc], 0
jne 0x413fdb
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
cmp dword [eax + 0x240], 0
jne 0x413ff1
call fcn.00402de0
jmp 0x414b61
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x240]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
call fcn.004034f0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0
je 0x414036
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x244]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x244
call fcn.004034f0
lea eax, [ebp - 0x149]
mov edx, dword [ebp - 8]
call fcn.00406270
lea eax, [ebp - 0x190]
xor ecx, ecx
mov edx, 0x44
call fcn.004027ec
mov word [ebp - 0x160], 0
mov dword [ebp - 0x164], 0x81
lea edx, [ebp - 0x380]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0x414d6c
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x380]
call fcn.00405d28
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0x414d84
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405d28
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
push 0x414d98
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405d28
mov eax, dword [ebp - 0x380]
call fcn.00403668
push eax
lea edx, [ebp - 0x388]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x388]
lea edx, [ebp - 0x384]
call fcn.00406128
mov eax, dword [ebp - 0x384]
call fcn.00403668
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x212], 0
je 0x41413b
lea eax, [ebp - 0x44]
call fcn.004061a8
jmp 0x41414c
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.004032c0
lea eax, [ebp - 0x380]
push eax
mov eax, dword [ebp - 0x44]
call fcn.004034a4
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0x44]
call fcn.004036a8
mov eax, dword [ebp - 0x380]
mov edx, 0x414c48
call fcn.004035b4
jne 0x414193
mov eax, dword [ebp - 0x44]
call fcn.004034a4
mov edx, eax
lea eax, [ebp - 0x44]
mov ecx, 1
call fcn.004036e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
add eax, 0x74
mov edx, dword [ebp - 0x44]
mov ecx, 0xff
call fcn.00403480
push dword [ebp - 0x44]
push 0x414c48
mov eax, dword [ebp - 4]
push dword [eax + 0x240]
lea eax, [ebp - 0x380]
mov edx, 3
call fcn.00403564
mov eax, dword [ebp - 0x380]
push eax
lea eax, [ebp - 0x384]
lea edx, [ebp - 0x149]
mov ecx, 0x105
call fcn.00403454
mov eax, dword [ebp - 0x384]
pop edx
call fcn.004121a4
test al, al
je 0x41422c
push dword [ebp - 0x44]
push 0x414c48
mov eax, dword [ebp - 4]
push dword [eax + 0x240]
lea eax, [ebp - 0x380]
mov edx, 3
call fcn.00403564
mov edx, dword [ebp - 0x380]
lea eax, [ebp - 0x149]
call fcn.00406270
mov eax, dword [ebp - 4]
add eax, 0x1c0
push eax
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00403668
push eax
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
push 0
lea eax, [ebp - 0x149]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4146c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x414298
xor eax, eax
call fcn.00412e68
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
call fcn.00412eb0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1d0], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1dc], 0
jne 0x4142d5
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x204]
fnstsw ax
sahf
jb 0x4142d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1dc], 0
jne 0x4142f5
push 0x2b67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.00406b0c
fstp qword [ebp - 0x30]
wait
jmp 0x41432b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1dc], 0
jne 0x41434c
push 0x16
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
push eax
push 0x412c28
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
push eax
call sub.user32.dll_EnumThreadWindows
call fcn.00406b0c
fsub qword [ebp - 0x30]
fld xword [0x414dac]
fcompp
fnstsw ax
sahf
jbe 0x41434c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d0], 0
je 0x414300
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d0], 0
jne 0x414364
mov eax, dword [ebp - 4]
mov byte [eax + 0x1dc], 1
jmp 0x414397
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x254], 0
je 0x41438f
mov eax, dword [ebp - 4]
call fcn.004170f0
mov eax, dword [ebp - 4]
call fcn.00412808
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1dc], 0
jne 0x4146c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d8]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4143e6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4143c8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x37
call sub.kernel32.dll_Sleep
call fcn.00411f58
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8a], 0
je 0x41443b
push 0x44
mov eax, dword [0x41c6a4]
push eax
mov eax, dword [0x41c6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x41445e
push 0x54
mov eax, dword [0x41c6a4]
push eax
mov eax, dword [0x41c6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov dword [eax + 0x64], 1
jmp 0x414698
push 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x63], 0
je 0x4144c9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4144c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4144c9
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1dc], 0
jne 0x4146b4
cmp byte [0x41c6a8], 0
je 0x41451f
push 0x14
mov eax, dword [0x41c6a4]
push eax
mov eax, dword [0x41c6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_InvalidateRect
mov byte [0x41c6a8], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x41455e
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x41455e
cmp byte [0x41c6ab], 0
je 0x41455e
push 0x13
push 0
push 0
push 0
push 0
push 1
push 0
push 0x414db8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetWindowPos
call fcn.00411f58
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x8a]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d8]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1dd]
test al, al
je 0x41458b
cmp dword [ebp - 0x20], 0
test al, al
je 0x414670
cmp word [0x41c692], 0
jne 0x41464e
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11a], 0
jne 0x4145ed
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x414607
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x414607
cmp byte [0x41c6ab], 0
je 0x414607
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x41461f
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
call fcn.00411f58
push 0
push 0
push 0x406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x414653
call fcn.00411f58
mov eax, dword [ebp - 4]
mov byte [eax + 0x1de], 1
mov eax, dword [ebp - 4]
mov dword [0x41c694], eax
mov dword [0x41c690], 0x414dd8
cmp byte [0x41a794], 0
je 0x414690
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_PostMessageA
jmp 0x414698
mov eax, dword [ebp - 4]
call fcn.004134c0
push 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41447f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414b61
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19c]
call fcn.00403668
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20c]
push eax
push 0xffff
call sub.user32.dll_PostMessageA
mov ax, word [ebp - 0x3c]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp dword [ebp - 0x40], 0
je 0x41471b
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0
je 0x41479a
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c904
cmp al, 2
jne 0x41475f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c6d8
call fcn.00411f58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c59c
call fcn.00411f58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x244]
call fcn.00403668
mov edx, eax
lea eax, [ebp - 0x380]
call fcn.004033dc
mov eax, dword [ebp - 0x380]
call fcn.00405f9c
mov eax, dword [ebp - 8]
call fcn.00403668
mov edx, eax
lea eax, [ebp - 0x380]
call fcn.004033dc
mov eax, dword [ebp - 0x380]
call fcn.00405f9c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x25c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x41480f
inc ebx
xor esi, esi
lea ecx, [ebp - 0x384]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x25c]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x384]
call fcn.00403668
mov edx, eax
lea eax, [ebp - 0x380]
call fcn.004033dc
mov eax, dword [ebp - 0x380]
call fcn.00405f9c
inc esi
dec ebx
jne 0x4147d2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x414828
mov eax, dword [ebp - 0x38]
call fcn.00412eb0
mov eax, dword [ebp - 0x34]
call fcn.00412e68
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x414843
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c0], 0
je 0x41485e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [0x41c690], eax
mov dword [0x41c694], eax
cmp dword [ebp - 0x14], 0
je 0x41488d
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x18], 0
je 0x41489c
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x1c], 0
je 0x4148c8
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4148b6
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4148bd
push 0
call sub.user32.dll_MessageBeep
call fcn.00411f58
cmp dword [ebp - 0x1c], 0
jne 0x4148a2
cmp dword [ebp - 0x20], 0
je 0x4148d7
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_UnhookWindowsHookEx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4148f2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x24], 0
je 0x414901
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x10], 0
je 0x414910
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d8], 0
je 0x41495c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x30], edx
xor edx, edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x38], edx
mov byte [eax + 0x3c], 0
mov byte [eax + 0x3d], 0
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x28], 0
je 0x41496b
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
call fcn.00412228
mov eax, dword [ebp - 4]
call fcn.00412390
call fcn.00411f58
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00403668
mov edx, eax
lea eax, [ebp - 0x380]
call fcn.004033dc
mov eax, dword [ebp - 0x380]
call fcn.00405f9c
test al, al
jne 0x4149fb
cmp dword [ebp - 0x28], 6
jne 0x4149e3
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00403668
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x4149ed
push 0x22b
call sub.kernel32.dll_Sleep
call fcn.00411f58
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jne 0x414999
mov eax, dword [ebp - 4]
push dword [eax + 0x1a8]
push 0x414dd0
push 0x414cc4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403564
lea eax, [ebp - 0x37c]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x378], 3
mov eax, dword [ebp - 8]
call fcn.00403668
mov dword [ebp - 0x374], eax
mov word [ebp - 0x36c], 0x414
lea eax, [ebp - 0x37c]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004034a4
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.00403778
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00402778
call fcn.0040263c
test eax, eax
je 0x414b56
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x414cc4
call fcn.004034f0
lea eax, [ebp - 0x37c]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x378], 3
mov eax, dword [ebp - 8]
call fcn.00403668
mov dword [ebp - 0x374], eax
mov word [ebp - 0x36c], 0x414
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea eax, [ebp - 0x37c]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
test ebx, ebx
je 0x414afc
push 0x6f
call sub.kernel32.dll_Sleep
test ebx, ebx
je 0x414b13
call sub.kernel32.dll_GetTickCount
sub eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x8ae
jle 0x414ae3
test ebx, ebx
je 0x414b56
lea eax, [ebp - 0x37c]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x378], 3
mov eax, dword [ebp - 8]
call fcn.00403668
mov dword [ebp - 0x374], eax
mov word [ebp - 0x36c], 0x454
lea eax, [ebp - 0x37c]
push eax
call sub.shell32.dll_SHFileOperationA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414b9b
lea eax, [ebp - 0x388]
mov edx, 3
call fcn.0040324c
lea eax, [ebp - 0x44]
call fcn.00403228
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040324c
ret