Function at 0x403120
Capabilities:
Check mutex on windows
Delete file
Extract resource via kernel32 functions
Get disk size
Get token privileges
Move file
Read .ini file
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4210bf
mov eax, dword fs:[0]
push eax
sub esp, 0x79c
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
or edi, 0xffffffff
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x734], eax
xor eax, eax
mov dword [ebp - 0x668], edi
mov dword [ebp - 0x544], edi
movups xmmword [ebp - 0x6b8], xmm0
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x5fc], 7
mov word [ebp - 0x610], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5cc], 7
mov word [ebp - 0x5e0], ax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], 7
mov word [ebp - 0x5ac], ax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], 7
mov word [ebp - 0x5f8], ax
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x5b0], 7
mov word [ebp - 0x5c4], ax
mov word [ebp - 0x1c0], ax
mov word [ebp - 0x100], ax
mov word [ebp - 0x240], ax
mov word [ebp - 0x180], ax
lea eax, [ebp - 0x67c]
push 0x103
push eax
movups xmmword [ebp - 0x69c], xmm0
movups xmmword [ebp - 0x68c], xmm0
movq qword [ebp - 0x67c], xmm0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x6c8], eax
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x6cc], esi
movq qword [ebp - 0x6c4], xmm0
mov dword [ebp - 0x6bc], 0
movups xmmword [ebp - 0x6dc], xmm0
mov dword [ebp - 0x35c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4052f5
movzx eax, byte [ebp - 0x358]
shl ax, 8
movzx ecx, ax
movzx eax, byte [ebp - 0x354]
or ecx, eax
movzx eax, byte [ebp - 0x248]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, byte [ebp - 0x246]
or ecx, eax
cmp ecx, 0x6000000
jb 0x403425
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x664]
mov dword [ebp - 0x664], 0
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40531d
mov edi, dword [ebp - 0x664]
mov dword [ebp - 0x730], edi
lea eax, [ebp - 0x660]
mov byte [ebp - 4], 6
push eax
push 0
push 0
push 0x19
push edi
mov dword [ebp - 0x660], 0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x660]
xor ecx, ecx
shr eax, 3
mov edx, 8
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040f3d3
mov esi, eax
add esp, 4
mov dword [ebp - 0x57c], esi
lea eax, [ebp - 0x660]
mov byte [ebp - 4], 7
push eax
push dword [ebp - 0x660]
push esi
push 0x19
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x405345
mov eax, dword [esi]
push eax
mov dword [ebp - 0x548], eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40536d
push dword [ebp - 0x548]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx eax, byte [eax]
dec eax
push eax
push dword [ebp - 0x548]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x544], eax
call fcn.0040f3dc
add esp, 4
mov byte [ebp - 4], 5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x544], 0x3000
jae 0x403422
push 0x52f
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, 0x3ef
call fcn.00401e40
or edi, 0xffffffff
xor esi, esi
jmp 0x405045
or edi, 0xffffffff
mov dword [ebp - 4], 4
push 0
lea eax, [ebp - 0x6a0]
mov dword [ebp - 0x6a0], 0
push eax
push 0x44c
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0x6a0]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x664], esi
test esi, esi
je 0x4034d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4034d6
push 0x420
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebp - 0x548]
mov dword [ebp - 0x548], 0
push eax
push 0x44d
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp - 0x548]
call fcn.004016b0
test al, al
jne 0x405045
mov ecx, 0x44e
call fcn.00401e00
mov ecx, eax
call fcn.004016b0
jmp 0x405045
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call fcn.004078c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x560]
xor eax, eax
mov dword [ebp - 0x550], 0
push 0x40
mov dword [ebp - 0x54c], 7
mov word [ebp - 0x560], ax
mov dword [ebp - 0x660], 2
call fcn.004056a0
xor edi, edi
movzx esi, byte [ebp + edi - 0x38]
mov ecx, dword [ebp - 0x550]
mov eax, esi
shr eax, 4
movzx edx, word [eax*2 + 0x428de8]
cmp ecx, dword [ebp - 0x54c]
jae 0x40356d
cmp dword [ebp - 0x54c], 8
lea eax, [ecx + 1]
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
mov word [eax + ecx*2], dx
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x403587
push edx
mov byte [ebp - 0x544], 0
push dword [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x560]
call fcn.00402c30
mov ecx, dword [ebp - 0x550]
and esi, 0xf
movzx edx, word [esi*2 + 0x428de8]
mov esi, dword [ebp - 0x54c]
cmp ecx, esi
jae 0x4035c8
lea eax, [ecx + 1]
cmp esi, 8
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
mov word [eax + ecx*2], dx
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x4035e2
push edx
mov byte [ebp - 0x66c], 0
push dword [ebp - 0x66c]
push ecx
lea ecx, [ebp - 0x560]
call fcn.00402c30
inc edi
cmp edi, 0x20
jb 0x403523
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x5fc]
mov dword [ebp - 0x660], 1
cmp edx, 8
jb 0x40363d
mov ecx, dword [ebp - 0x610]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x403633
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405395
push edx
push ecx
call fcn.0040f24e
add esp, 8
movups xmm1, xmmword [ebp - 0x560]
cmp dword [ebp - 0x54c], 8
lea ecx, [ebp - 0x610]
movq xmm0, qword [ebp - 0x550]
movd eax, xmm1
movups xmmword [ebp - 0x610], xmm1
cmovae ecx, eax
movq qword [ebp - 0x600], xmm0
push ecx
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call fcn.00406dd0
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x588], edx
call fcn.00406dd0
mov dword [ebp - 0x544], edx
mov dword [ebp - 0x580], edx
mov dl, al
mov dword [ebp - 0x584], eax
and dl, 0x3f
mov ecx, dword [ebp - 0x586]
or dl, 0x80
and ecx, 0xfff
mov byte [ebp - 0x584], dl
or ecx, 0x4000
mov word [ebp - 0x586], cx
mov byte [ebp - 4], 0xa
sub esp, 8
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x584]
shr eax, 0x10
mov dword [ebp - 0x670], eax
mov eax, ecx
shr eax, 8
movzx esi, al
movzx eax, dl
shl eax, 8
or esi, eax
mov dword [ebp - 0x550], 0
mov eax, ecx
mov dword [ebp - 0x66c], esi
shr eax, 0x10
movzx eax, al
shl ax, 8
movzx edi, ax
shr ecx, 0x18
or edi, ecx
mov dword [ebp - 0x54c], 7
mov ecx, dword [ebp - 0x544]
mov eax, ecx
shr eax, 8
movzx eax, al
shl edi, 0x10
or edi, eax
movzx eax, byte [ebp - 0x580]
shl ax, 8
movzx eax, ax
or edi, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl ax, 8
movzx esi, ax
xor eax, eax
shr ecx, 0x18
or esi, ecx
mov word [ebp - 0x560], ax
lea ecx, [ebp - 0x560]
call fcn.0040bac0
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
movzx ecx, word [ebp - 0x588]
cmovae eax, dword [ebp - 0x560]
push esi
push edi
push dword [ebp - 0x66c]
mov dword [ebp - 0x660], 5
push dword [ebp - 0x670]
push ecx
push dword [ebp - 0x674]
push str._08lx__04x__04x__04x__08x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x550]
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x544], ecx
cmp esi, ecx
ja 0x4037ee
cmp dword [ebp - 0x54c], 8
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x550], esi
cmovae ecx, dword [ebp - 0x560]
xor eax, eax
mov word [ecx + esi*2], ax
jmp 0x403856
mov edi, dword [ebp - 0x54c]
mov edx, esi
mov eax, edi
sub edx, ecx
sub eax, ecx
cmp edx, eax
ja 0x40383b
cmp edi, 8
mov dword [ebp - 0x550], esi
lea esi, [ebp - 0x560]
cmovae esi, dword [ebp - 0x560]
lea edi, [esi + ecx*2]
test edx, edx
je 0x403830
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x544]
lea eax, [ecx + edx]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x403856
push ecx
push edx
mov byte [ebp - 0x544], 0
lea ecx, [ebp - 0x560]
push dword [ebp - 0x544]
push edx
call fcn.0040b940
mov edx, dword [ebp - 0x5cc]
cmp edx, 8
jb 0x403896
mov ecx, dword [ebp - 0x5e0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40388c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40539a
push edx
push ecx
call fcn.0040f24e
add esp, 8
movups xmm1, xmmword [ebp - 0x560]
lea ecx, [ebp - 0x5e0]
movq xmm0, qword [ebp - 0x550]
movd eax, xmm1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x54c], 8
movups xmmword [ebp - 0x5e0], xmm1
cmovae ecx, eax
lea eax, [ebp - 0x68c]
movq qword [ebp - 0x5d0], xmm0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edi, dword [ebp - 0x734]
lea ecx, [ebp - 0x588]
push str._cookie
mov edx, edi
call fcn.00401fd0
add esp, 4
cmp byte [ebp - 0x580], 0
je 0x403923
mov eax, dword [ebp - 0x584]
cmp eax, 0x40
jae 0x403923
inc eax
push eax
push dword [ebp - 0x588]
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x403a2e
push 0xa
push str.EDAT_ECOO
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x403a28
push edi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0x400000
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x66c], edi
test edi, edi
je 0x403a28
cmp edi, 0x40
jae 0x403a28
test esi, esi
je 0x403a28
lea eax, [edi + esi]
xor edx, edx
cmp esi, eax
lea ecx, [ebp - 0x180]
cmova edi, edx
test edi, edi
je 0x403a18
cmp edi, 0x20
jb 0x403a02
lea eax, [esi - 1]
mov edx, ecx
add eax, edi
cmp edx, eax
mov edx, 0
ja 0x4039b2
lea eax, [ebp + edi*2 - 0x182]
cmp eax, esi
jae 0x403a02
mov eax, edi
and eax, 0xffffffe0
nop word [eax + eax]
movq xmm1, qword [esi]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
add edx, 0x20
movups xmmword [ecx], xmm1
movq xmm1, qword [esi + 8]
punpcklbw xmm1, xmm0
movups xmmword [ecx + 0x10], xmm1
movq xmm1, qword [esi + 0x10]
punpcklbw xmm1, xmm0
movups xmmword [ecx + 0x20], xmm1
movq xmm1, qword [esi + 0x18]
add esi, 0x20
punpcklbw xmm1, xmm0
movups xmmword [ecx + 0x30], xmm1
add ecx, 0x40
cmp edx, eax
jne 0x4039c0
cmp edx, edi
je 0x403a18
movzx eax, byte [esi]
lea ecx, [ecx + 2]
inc edx
mov word [ecx - 2], ax
lea esi, [esi + 1]
cmp edx, edi
jne 0x403a06
mov eax, dword [ebp - 0x66c]
xor ecx, ecx
mov word [ebp + eax*2 - 0x180], cx
mov edi, dword [ebp - 0x734]
cmp word [ebp - 0x180], 0
je 0x403a4c
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x548], 0
push eax
lea eax, [ebp - 0x548]
xor ecx, ecx
push eax
lea edx, [ebp - 0x100]
call fcn.00401ec0
add esp, 8
cmp word [ebp - 0x100], 0
je 0x403a92
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [ebp - 0x548]
mov eax, 0xf
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
movups xmm0, xmmword [ebp - 0x69c]
lea eax, [ebp - 0x548]
mov dword [ebp - 0x548], 0
push eax
push 0
movups xmmword [ebp - 0x704], xmm0
lea eax, [ebp - 0x704]
movups xmm0, xmmword [ebp - 0x68c]
push eax
push 0x402df0
movups xmmword [ebp - 0x6f4], xmm0
push 0
movq xmm0, qword [ebp - 0x67c]
movq qword [ebp - 0x6e4], xmm0
push 0
mov dword [ebp - 0x6e0], str.microstub_start
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x548], 0
je 0x403b26
lock inc dword [0x42d508]
lea eax, [ebp - 0x548]
mov dword [ebp - 0x548], 0
push eax
push 0
lea eax, [ebp - 0x704]
push eax
push 0x402f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x548], 0
je 0x403b66
lock inc dword [0x42d508]
push str._silent
mov edx, edi
lea ecx, [ebp - 0x588]
call fcn.00401fd0
add esp, 4
mov al, byte [eax + 8]
test al, al
jne 0x403ba3
push 0
push 0
lea eax, [ebp - 0x6cc]
push eax
push 0x401490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc0]
call fcn.00401d00
test al, al
jne 0x403bda
push 3
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x405039
push 4
push 0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0xc0]
push eax
push 0x402530
push 0xa
push 0x400000
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x35c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40539f
movzx eax, byte [ebp - 0x358]
shl ax, 8
movzx ecx, ax
movzx eax, byte [ebp - 0x354]
or ecx, eax
movzx eax, byte [ebp - 0x248]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, byte [ebp - 0x246]
or ecx, eax
push 0
cmp ecx, 0x6010000
jb 0x403d3e
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0
push eax
push 0x7d1
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x738], 0
mov eax, dword fs:[0xc0]
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 0
mov ecx, 0x8fc
mov eax, 0x898
mov dword [ebp - 0x6a8], 0
cmovne eax, ecx
lea ecx, [ebp - 0x6a8]
push 0
push ecx
add eax, esi
push eax
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x548], 0
mov eax, dword fs:[0xc0]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
mov ecx, 0xce4
mov eax, 0xc80
mov dword [ebp - 0x660], 0
cmovne eax, ecx
lea ecx, [ebp - 0x660]
push 0
push ecx
add eax, esi
push eax
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x660]
jmp 0x403dc7
lea eax, [ebp - 0x674]
mov dword [ebp - 0x674], 0
push eax
push 0x7d2
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x674]
lea ecx, [ebp - 0x670]
push 0
mov dword [ebp - 0x544], eax
lea eax, [esi + 0x834]
push ecx
push eax
push 0x400000
mov dword [ebp - 0x670], 0
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x670]
lea ecx, [ebp - 0x668]
push 0
mov dword [ebp - 0x66c], eax
lea eax, [esi + 0xc80]
push ecx
push eax
push 0x400000
mov dword [ebp - 0x668], 0
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x668]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x540]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x540]
push 0
push 0x80
push 2
push 0
push 1
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x668], edi
cmp edi, 0xffffffff
jne 0x403e35
push 2
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40503f
push 4
push 0
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x403f1f
cmp dword [ebp - 0x614], 0
ja 0x403f1f
jb 0x403e96
cmp dword [ebp - 0x618], 0x6400000
jae 0x403f1f
push 0x70
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebp - 0x670]
mov dword [ebp - 0x670], 0
push eax
push 0x3e9
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [ebp - 0x670]
lea eax, [ebp - 0x674]
push 0
push eax
push 0x3ed
push 0x400000
mov dword [ebp - 0x674], 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x409
push 0x10
push esi
push dword [ebp - 0x674]
push dword [ebp - 0x6c4]
call dword [sym.imp.USER32.dll_MessageBoxExW]
jmp 0x40503f
mov edx, dword [ebp - 0x734]
lea ecx, [ebp - 0x588]
push str._cust_ini
call fcn.00401fd0
add esp, 4
cmp byte [ebp - 0x580], 0
je 0x4045f7
push dword [ebp - 0x584]
xor eax, eax
mov dword [ebp - 0x550], 0
push dword [ebp - 0x588]
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x54c], 7
mov word [ebp - 0x560], ax
call fcn.004028c0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x560]
cmp dword [ebp - 0x54c], 8
lea ecx, [ebp - 0x560]
mov edx, dword [ebp - 0x560]
mov esi, dword [ebp - 0x550]
cmovae eax, edx
cmovae ecx, edx
mov dword [ebp - 0x660], esi
lea eax, [eax + esi*2]
mov dword [ebp - 0x57c], eax
lea eax, [ebp - 0x560]
cmovae eax, edx
lea edi, [eax + esi*2]
cmp ecx, edi
je 0x404011
cmp word [ecx], 0x22
je 0x403fce
add ecx, 2
cmp ecx, edi
jne 0x403fc1
cmp ecx, edi
je 0x404011
lea eax, [ecx + 2]
mov esi, edi
sub esi, eax
xor edx, edx
inc esi
shr esi, 1
cmp eax, edi
cmova esi, edx
test esi, esi
je 0x404005
movzx edi, word [eax]
cmp edi, 0x22
je 0x403ff5
mov word [ecx], di
add ecx, 2
inc edx
add eax, 2
cmp edx, esi
jne 0x403fe7
mov esi, dword [ebp - 0x550]
jmp 0x40400b
mov esi, dword [ebp - 0x660]
mov edx, dword [ebp - 0x560]
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, edx
mov edx, ecx
sub edx, eax
sar edx, 1
cmp esi, edx
jb 0x4053c7
mov edi, dword [ebp - 0x57c]
mov eax, esi
sub edi, ecx
sub eax, edx
sar edi, 1
cmp eax, edi
cmovb edi, eax
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
sub esi, edi
mov dword [ebp - 0x550], esi
sub esi, edx
lea ecx, [eax + edx*2]
lea eax, [esi*2 + 2]
push eax
lea eax, [ecx + edi*2]
push eax
push ecx
call fcn.004107a0
add esp, 0xc
lea eax, [ebp - 0x560]
cmp dword [ebp - 0x54c], 8
cmovae eax, dword [ebp - 0x560]
push eax
push 0
push str.Enabled
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x4045ad
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0
push str.ProxyType
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x4045ad
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0x100
lea eax, [ebp - 0x440]
push eax
push 0x427eb8
push 0x428404
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x5ac]
call fcn.004028c0
mov ecx, dword [ebp - 0x59c]
mov edx, dword [ebp - 0x598]
cmp ecx, edx
jae 0x404152
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x59c], eax
lea eax, [ebp - 0x5ac]
cmovae eax, dword [ebp - 0x5ac]
mov dword [eax + ecx*2], 0x3a
jmp 0x40416d
push 0x3a
mov byte [ebp - 0x57c], 0
push dword [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x5ac]
call fcn.00402c30
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0
push str.Port
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, ax
lea esi, [ebp - 0x16]
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x4041a0
mov word [ebp - 0x594], dx
mov eax, 7
lea edx, [ebp - 0x16]
mov dword [ebp - 0x584], ecx
mov dword [ebp - 0x580], eax
cmp esi, edx
je 0x4041fe
mov eax, edx
lea ecx, [ebp - 0x594]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.004028c0
mov ecx, dword [ebp - 0x584]
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x660], 0x19
cmp eax, 8
mov byte [ebp - 4], 0xc
mov esi, dword [ebp - 0x59c]
lea edx, [ebp - 0x594]
cmovae edx, dword [ebp - 0x594]
mov eax, dword [ebp - 0x598]
sub eax, esi
mov dword [ebp - 0x57c], esi
cmp ecx, eax
ja 0x404270
cmp dword [ebp - 0x598], 8
lea edi, [ecx + esi]
lea eax, [ecx + ecx]
mov dword [ebp - 0x59c], edi
push eax
mov eax, dword [ebp - 0x57c]
lea esi, [ebp - 0x5ac]
cmovae esi, dword [ebp - 0x5ac]
push edx
lea eax, [esi + eax*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x40428b
push ecx
push edx
mov byte [ebp - 0x57c], 0
push dword [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x5ac]
call fcn.00402a20
mov ecx, dword [ebp - 0x594]
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x580]
cmp eax, 8
jb 0x4042cf
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4042c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4053cc
push edx
push ecx
call fcn.0040f24e
add esp, 8
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0x100
lea eax, [ebp - 0x440]
push eax
push 0x427eb8
push str.User
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x5f8]
call fcn.004028c0
cmp dword [ebp - 0x54c], 8
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0x100
lea eax, [ebp - 0x440]
push eax
push 0x427eb8
push str.Password
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x404532
xorps xmm0, xmm0
mov dword [ebp - 0x580], 0
movq qword [ebp - 0x588], xmm0
push 0
push 0
lea eax, [ebp - 0x548]
mov byte [ebp - 4], 0xd
push eax
push 0
push 1
push 0
lea eax, [ebp - 0x440]
mov dword [ebp - 0x548], 0
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov eax, dword [ebp - 0x548]
test eax, eax
je 0x4053d1
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x580], 0
push eax
lea ecx, [ebp - 0x588]
movq qword [ebp - 0x588], xmm0
call fcn.00406ec0
push 0
push 0
lea eax, [ebp - 0x548]
mov dword [ebp - 0x660], 0x39
push eax
push dword [ebp - 0x588]
lea eax, [ebp - 0x440]
push 1
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x4053f9
cmp dword [ebp - 0x5b0], 8
lea ecx, [ebp - 0x5c4]
mov eax, dword [ebp - 0x5b4]
cmovae ecx, dword [ebp - 0x5c4]
mov esi, dword [ebp - 0x584]
mov edi, dword [ebp - 0x588]
mov dword [ebp - 0x20], 0
lea eax, [ecx + eax*2]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x730], eax
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x5c4]
cmovae eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x57c], eax
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, esi
sub eax, edi
push eax
call fcn.004056a0
push dword [ebp - 0x5c8]
lea ecx, [ebp - 0x30]
push esi
push edi
call fcn.004054b0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x5c4]
mov ecx, dword [ebp - 0x57c]
mov edx, dword [ebp - 0x730]
push dword [ebp - 0x20]
sub edx, ecx
sar edx, 1
cmp dword [ebp - 0x5b0], 8
cmovae eax, dword [ebp - 0x5c4]
sub ecx, eax
lea eax, [ebp - 0x30]
sar ecx, 1
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
push edx
push ecx
lea ecx, [ebp - 0x5c4]
call fcn.00405900
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x4044f4
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4044ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405421
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x588]
test ecx, ecx
je 0x404532
mov edx, dword [ebp - 0x580]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x404528
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405426
push edx
push ecx
call fcn.0040f24e
add esp, 8
cmp dword [ebp - 0x598], 8
lea eax, [ebp - 0x5ac]
cmovae eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0x5e4], 8
mov dword [ebp - 0x6dc], eax
lea eax, [ebp - 0x5f8]
cmovae eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0x5b0], 8
mov dword [ebp - 0x6d4], eax
lea eax, [ebp - 0x5c4]
cmovae eax, dword [ebp - 0x5c4]
cmp dword [ebp - 0x54c], 8
mov dword [ebp - 0x6d0], eax
lea eax, [ebp - 0x560]
cmovae eax, dword [ebp - 0x560]
push eax
push 0
push str.AuthorizationType
push str.ProxySettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x6d8], eax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x54c]
cmp edx, 8
jb 0x4045f1
mov ecx, dword [ebp - 0x560]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4045e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40542b
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edi, dword [ebp - 0x668]
mov edx, dword [ebp - 0x66c]
lea eax, [ebp - 0x6dc]
mov ecx, dword [ebp - 0x544]
push eax
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x6c0]
push eax
push edi
call fcn.00401bd0
add esp, 0x10
test al, al
jne 0x4046ba
push 0x8ca
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 0x3e9
push 0x400000
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [ebp - 0x544]
lea eax, [ebp - 0x66c]
push 0
push eax
push 0x3ee
push 0x400000
mov dword [ebp - 0x66c], 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x409
push 0x10
push esi
push dword [ebp - 0x66c]
push dword [ebp - 0x6c4]
call dword [sym.imp.USER32.dll_MessageBoxExW]
jmp 0x40503f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 3
push 0
push 1
push 1
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x668], edi
cmp edi, 0xffffffff
jne 0x40470f
push 0x6e
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40503f
xor edx, edx
mov ecx, edi
call fcn.00406960
test al, al
jne 0x404757
mov edx, 1
mov ecx, edi
call fcn.00406960
test al, al
jne 0x404757
push 0x6fe
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40503f
xor esi, esi
push esi
push esi
push esi
push 0x1000002
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
jne 0x404779
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4047cf
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x730], eax
test eax, eax
jne 0x40479c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4047c8
push 0
push 0
lea edx, [ebp - 0x1c0]
mov ecx, eax
call fcn.00401ec0
add esp, 8
test al, al
jne 0x4047bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x730]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x4047ee
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
movups xmm0, xmmword [ebp - 0x69c]
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 0
movups xmmword [ebp - 0x72c], xmm0
lea eax, [ebp - 0x72c]
movups xmm0, xmmword [ebp - 0x68c]
push eax
push 0x402df0
movups xmmword [ebp - 0x71c], xmm0
push 0
movq xmm0, qword [ebp - 0x67c]
movq qword [ebp - 0x70c], xmm0
push 0
mov dword [ebp - 0x708], str.microstub_download
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x544], 0
je 0x404864
lock inc dword [0x42d508]
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 0
lea eax, [ebp - 0x72c]
push eax
push 0x402f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x544], 0
je 0x4048a4
lock inc dword [0x42d508]
push 1
xor eax, eax
mov dword [ebp - 0x550], 0
push 0x428470
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x54c], 7
mov word [ebp - 0x560], ax
call fcn.004028c0
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x560]
call fcn.00402ba0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
movq qword [ebp - 0x20], xmm0
mov word [eax], cx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
cmp ecx, edx
jae 0x404934
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
mov dword [eax + ecx*2], 0x22
jmp 0x40494c
push 0x22
mov byte [ebp - 0x730], 0
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00402c30
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ebp - 0x578], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x568], xmm0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x54c]
cmp edx, 8
jb 0x4049a8
mov ecx, dword [ebp - 0x560]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40499e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405430
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edx, dword [ebp - 0x734]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x54c], 7
mov word [ebp - 0x560], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4049d0
sub ecx, esi
sar ecx, 1
je 0x404abe
mov ecx, dword [ebp - 0x568]
mov esi, dword [ebp - 0x564]
cmp ecx, esi
jae 0x404a17
lea eax, [ecx + 1]
cmp esi, 8
mov dword [ebp - 0x568], eax
lea eax, [ebp - 0x578]
cmovae eax, dword [ebp - 0x578]
mov dword [eax + ecx*2], 0x20
jmp 0x404a38
push 0x20
mov byte [ebp - 0x730], 0
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402c30
mov edx, dword [ebp - 0x734]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404a40
mov eax, dword [ebp - 0x564]
sub ecx, esi
mov esi, dword [ebp - 0x568]
sub eax, esi
sar ecx, 1
mov dword [ebp - 0x730], esi
cmp ecx, eax
ja 0x404aa3
cmp dword [ebp - 0x564], 8
lea edi, [ecx + esi]
lea eax, [ecx + ecx]
mov dword [ebp - 0x568], edi
push eax
mov eax, dword [ebp - 0x730]
lea esi, [ebp - 0x578]
cmovae esi, dword [ebp - 0x578]
push edx
lea eax, [esi + eax*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404abe
push ecx
push edx
mov byte [ebp - 0x730], 0
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402a20
cmp dword [ebp - 0x684], 0
je 0x404bbe
mov edx, dword [ebp - 0x564]
mov eax, edx
mov ecx, dword [ebp - 0x568]
sub eax, ecx
cmp eax, 9
jb 0x404b14
cmp edx, 8
lea esi, [ebp - 0x578]
push 0x12
cmovae esi, dword [ebp - 0x578]
lea edi, [ecx + 9]
push 0x428474
mov dword [ebp - 0x568], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404b35
push 9
push 0x428474
mov byte [ebp - 0x730], 0
lea ecx, [ebp - 0x578]
push dword [ebp - 0x730]
push 9
call fcn.00402a20
mov edx, dword [ebp - 0x684]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404b40
mov eax, dword [ebp - 0x564]
sub ecx, esi
mov esi, dword [ebp - 0x568]
sub eax, esi
sar ecx, 1
mov dword [ebp - 0x730], esi
cmp ecx, eax
ja 0x404ba3
cmp dword [ebp - 0x564], 8
lea edi, [ecx + esi]
lea eax, [ecx + ecx]
mov dword [ebp - 0x568], edi
push eax
mov eax, dword [ebp - 0x730]
lea esi, [ebp - 0x578]
cmovae esi, dword [ebp - 0x578]
push edx
lea eax, [esi + eax*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404bbe
push ecx
push edx
mov byte [ebp - 0x730], 0
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402a20
mov edx, dword [ebp - 0x564]
mov eax, edx
mov ecx, dword [ebp - 0x568]
sub eax, ecx
cmp eax, 0xe
jb 0x404c07
cmp edx, 8
lea esi, [ebp - 0x578]
push 0x1c
cmovae esi, dword [ebp - 0x578]
lea edi, [ecx + 0xe]
push str.__ga_clientid:
mov dword [ebp - 0x568], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404c28
push 0xe
push str.__ga_clientid:
mov byte [ebp - 0x730], 0
lea ecx, [ebp - 0x578]
push dword [ebp - 0x730]
push 0xe
call fcn.00402a20
mov edx, dword [ebp - 0x68c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c33
mov eax, dword [ebp - 0x564]
sub ecx, esi
mov esi, dword [ebp - 0x568]
sub eax, esi
sar ecx, 1
mov dword [ebp - 0x730], esi
cmp ecx, eax
ja 0x404c96
cmp dword [ebp - 0x564], 8
lea edi, [ecx + esi]
lea eax, [ecx + ecx]
mov dword [ebp - 0x568], edi
push eax
mov eax, dword [ebp - 0x730]
lea esi, [ebp - 0x578]
cmovae esi, dword [ebp - 0x578]
push edx
lea eax, [esi + eax*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404cb1
push ecx
push edx
mov byte [ebp - 0x730], 0
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402a20
mov edx, dword [ebp - 0x564]
mov eax, edx
mov ecx, dword [ebp - 0x568]
sub eax, ecx
cmp eax, 0xb
jb 0x404cfa
cmp edx, 8
lea esi, [ebp - 0x578]
push 0x16
cmovae esi, dword [ebp - 0x578]
lea edi, [ecx + 0xb]
push str.__edat_dir:
mov dword [ebp - 0x568], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404d1b
push 0xb
push str.__edat_dir:
mov byte [ebp - 0x730], 0
lea ecx, [ebp - 0x578]
push dword [ebp - 0x730]
push 0xb
call fcn.00402a20
lea ecx, [ebp - 0xc0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d24
mov eax, dword [ebp - 0x564]
sub ecx, edx
mov edx, dword [ebp - 0x568]
sub eax, edx
sar ecx, 1
cmp ecx, eax
ja 0x404d81
cmp dword [ebp - 0x564], 8
lea eax, [ecx + ecx]
push eax
lea esi, [ebp - 0x578]
cmovae esi, dword [ebp - 0x578]
lea eax, [ebp - 0xc0]
push eax
lea edi, [ecx + edx]
mov dword [ebp - 0x568], edi
lea eax, [esi + edx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404da2
push ecx
lea eax, [ebp - 0xc0]
mov byte [ebp - 0x730], 0
push eax
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402a20
cmp word [ebp - 0x240], 0
je 0x404ea1
mov edx, dword [ebp - 0x564]
mov eax, edx
mov ecx, dword [ebp - 0x568]
sub eax, ecx
cmp eax, 0xe
jb 0x404df9
cmp edx, 8
lea esi, [ebp - 0x578]
push 0x1c
cmovae esi, dword [ebp - 0x578]
lea edi, [ecx + 0xe]
push str.__sub_edition:
mov dword [ebp - 0x568], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404e1a
push 0xe
push str.__sub_edition:
mov byte [ebp - 0x730], 0
lea ecx, [ebp - 0x578]
push dword [ebp - 0x730]
push 0xe
call fcn.00402a20
lea ecx, [ebp - 0x240]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404e23
mov eax, dword [ebp - 0x564]
sub ecx, edx
mov edx, dword [ebp - 0x568]
sub eax, edx
sar ecx, 1
cmp ecx, eax
ja 0x404e80
cmp dword [ebp - 0x564], 8
lea eax, [ecx + ecx]
push eax
lea esi, [ebp - 0x578]
cmovae esi, dword [ebp - 0x578]
lea eax, [ebp - 0x240]
push eax
lea edi, [ecx + edx]
mov dword [ebp - 0x568], edi
lea eax, [esi + edx*2]
push eax
call fcn.004107a0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404ea1
push ecx
lea eax, [ebp - 0x240]
mov byte [ebp - 0x730], 0
push eax
push dword [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x578]
call fcn.00402a20
push 0x40
lea eax, [ebp - 0x658]
mov dword [ebp - 0x65c], 0x44
push 0
push eax
call fcn.00410550
add esp, 0xc
lea ecx, [ebp - 0x6b8]
cmp dword [ebp - 0x564], 8
lea eax, [ebp - 0x578]
cmovae eax, dword [ebp - 0x578]
push ecx
lea ecx, [ebp - 0x65c]
push ecx
lea ecx, [ebp - 0xc0]
push ecx
push 0
push 0x404
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404f37
push 0x23f
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebp - 0x578]
call fcn.00402d90
jmp 0x405039
push dword [ebp - 0x6b0]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x6b4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x404f8a
push 0x236
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebp - 0x578]
call fcn.00402d90
jmp 0x405039
mov eax, dword [ebp - 0x6c4]
test eax, eax
je 0x404fa4
push 0
push 0
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x6b8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x5c8]
push eax
push dword [ebp - 0x6b8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x404fdc
push dword [ebp - 0x5c8]
lea eax, [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 0x564]
cmp edx, 8
jb 0x40501c
mov ecx, dword [ebp - 0x578]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405012
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405435
push edx
push ecx
call fcn.0040f24e
add esp, 8
xor eax, eax
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x564], 7
mov word [ebp - 0x578], ax
mov edi, dword [ebp - 0x668]
mov esi, dword [ebp - 0x664]
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 0
lea eax, [ebp - 0x69c]
push eax
push 0x402df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x544], 0
je 0x405085
lock inc dword [0x42d508]
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 0
lea eax, [ebp - 0x69c]
push eax
push 0x402f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x544], 0
je 0x4050c5
lock inc dword [0x42d508]
cmp edi, 0xffffffff
je 0x4050d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6b4]
test eax, eax
je 0x4050e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6b8]
test eax, eax
je 0x4050f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x405105
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp dword [0x42d508], 0
je 0x405121
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x4b0
jb 0x405107
mov edx, dword [ebp - 0x5b0]
cmp edx, 8
jb 0x405161
mov ecx, dword [ebp - 0x5c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405157
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40543a
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edx, dword [ebp - 0x5e4]
xor eax, eax
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5b0], 7
mov word [ebp - 0x5c4], ax
cmp edx, 8
jb 0x4051be
mov ecx, dword [ebp - 0x5f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4051b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40543f
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edx, dword [ebp - 0x598]
xor eax, eax
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 0x5e4], 7
mov word [ebp - 0x5f8], ax
cmp edx, 8
jb 0x40521b
mov ecx, dword [ebp - 0x5ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405211
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405444
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edx, dword [ebp - 0x5cc]
xor eax, eax
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x598], 7
mov word [ebp - 0x5ac], ax
cmp edx, 8
jb 0x405278
mov ecx, dword [ebp - 0x5e0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40526e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405449
push edx
push ecx
call fcn.0040f24e
add esp, 8
mov edx, dword [ebp - 0x5fc]
xor eax, eax
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x5cc], 7
mov word [ebp - 0x5e0], ax
cmp edx, 8
jb 0x4052d5
mov ecx, dword [ebp - 0x610]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4052cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40544e
push edx
push ecx
call fcn.0040f24e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ed1d
mov esp, ebp
pop ebp
ret 0x10
push str.Unable_to_determine_the_operating_system_version_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x7a8]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x7a8]
push eax
call fcn.004106aa
push str.Unable_to_open_process_token_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x798]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x798]
push eax
call fcn.004106aa
push str.Unable_to_retrieve_process_mandatory_label_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x788]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x788]
push eax
call fcn.004106aa
push str.Unable_to_verify_mandatory_label_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x778]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x778]
push eax
call fcn.004106aa
call fcn.004131d8
call fcn.004131d8
push str.Unable_to_determine_the_operating_system_version_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x748]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x748]
push eax
call fcn.004106aa
call fcn.00405aa0
call fcn.004131d8
push str.Unable_to_decode_base64_string_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x758]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x758]
push eax
call fcn.004106aa
push str.Unable_to_decode_base64_string_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x768]
call fcn.00405b20
push 0x42a650
lea eax, [ebp - 0x768]
push eax
call fcn.004106aa
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
call fcn.004131d8
int3