Function at 0x571370
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Create process suspended
Encode data using xor
Get file size
Read file on windows
Resume thread
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x10b4
call fcn.00693490
push ebx
mov ebx, ecx
push ebp
push esi
mov al, byte [ebx]
push edi
test al, al
jne 0x572bc4
call fcn.00572fc0
mov byte [ebx + 0x1269], al
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [ebx + 0x11fc], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ecx, dword [esp + 0x10c8]
mov dword [0xf672d0], eax
lea eax, [ebx + 0x1200]
push 0x20
push ecx
push eax
call fcn.00695642
add esp, 0xc
mov ecx, ebx
mov byte [ebx + 0x121f], 0
push 0x104
push 0xf66fac
call fcn.00573060
push 0
push 0xf66fac
call fcn.00697128
add esp, 8
cmp eax, 0xffffffff
jne 0x571439
push 0
push 0xf66fac
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
jne 0x571439
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
call esi
push eax
push 0x71a1bc
call fcn.005865b0
add esp, 4
add ebx, 0x20
push eax
push ebx
call fcn.00572d80
add esp, 0xc
mov eax, 0x6f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x71a1b8
push 0xf66fac
call esi
push 0x71a1a8
call fcn.005865b0
add esp, 4
push eax
push 0xf66fac
call esi
mov eax, dword [ebx + 0x20]
lea ebp, [ebx + 0x20]
cmp eax, 0xffffffff
jne 0x5716a3
mov edi, 0xf66fac
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x1030], 0
mov dword [ebp + 0x1034], 0x3e8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x5714ce
cmp byte [0xf66fad], 0x3a
je 0x5714ce
lea edx, [esp + 0x1b8]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x1b8]
push 0x5c
push eax
call fcn.00694817
add esp, 8
lea edx, [eax + 1]
test eax, eax
jne 0x5714d5
lea edx, [esp + 0x1b8]
mov edi, 0xf66fac
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80000080
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1cc]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
je 0x5716a3
lea esi, [ebp + 0x101c]
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
xor edx, edx
xor eax, eax
mov dx, word [ebp + 0x102a]
mov ax, word [ebp + 0x1028]
push edx
xor ecx, ecx
mov cx, word [ebp + 0x1026]
xor edx, edx
mov dx, word [ebp + 0x1024]
push eax
push ecx
xor eax, eax
mov ax, word [ebp + 0x1022]
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x101e]
mov dx, word [esi]
push eax
push ecx
push edx
push 0x71a158
lea edi, [ebp + 0x1c]
call fcn.00586540
add esp, 4
push eax
push edi
call fcn.006935d4
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x1034]
not ecx
dec ecx
cmp eax, 0x3e7
mov esi, ecx
mov dword [esp + 0x10], esi
jne 0x5715af
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0x1030]
test eax, eax
je 0x5715f6
test esi, esi
jle 0x571698
mov edi, 0xffffffe4
lea eax, [ebp + 0x1c]
sub edi, ebp
mov ecx, 2
mov edx, dword [ebp + 0x1030]
add edx, ecx
mov dword [ebp + 0x1030], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [edi + eax]
cmp edx, esi
jl 0x5715d0
push 0
lea edx, [esp + 0x38]
jmp 0x57192d
xor esi, esi
lea edi, [ebp + 0x102c]
mov si, word [ebp + 0x102a]
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x1028]
mov dx, word [ebp + 0x1026]
add ecx, esi
push 0
add ecx, eax
xor eax, eax
mov ax, word [ebp + 0x1022]
add edx, ecx
xor ecx, ecx
mov cx, word [ebp + 0x101e]
imul eax, ecx
xor ecx, ecx
mov cx, word [ebp + 0x101c]
imul eax, ecx
imul eax, esi
inc eax
imul edx, eax
and edx, 0xffffff
mov eax, dword [ebp]
or edx, 0x1a000000
mov dword [edi], edx
lea edx, [esp + 0x20]
push edx
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x571698
mov edx, 0xffffffe4
lea eax, [ebp + 0x1c]
sub edx, ebp
mov ecx, dword [edi]
lea ecx, [ecx + ecx*2 + 1]
mov dword [edi], ecx
add cl, 0x65
xor byte [eax], cl
inc eax
lea ecx, [eax + edx]
cmp ecx, esi
jl 0x571683
push 0
lea edx, [esp + 0x38]
jmp 0x57192d
push 0x2e
push 0xf66fac
call fcn.00694817
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x18], esi
je 0x57193d
mov eax, 1
mov dword [esp + 0x10], eax
push eax
push 0x71a14c
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.006935d4
mov eax, dword [ebp]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x57179d
mov edi, 0xf66fac
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x1030], 0
mov dword [ebp + 0x1034], 0x3e8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x57174c
cmp byte [0xf66fad], 0x3a
je 0x57174c
lea ecx, [esp + 0x1b8]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x1b8]
push 0x5c
push edx
call fcn.00694817
add esp, 8
lea edx, [eax + 1]
test eax, eax
jne 0x571753
lea edx, [esp + 0x1b8]
mov edi, 0xf66fac
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80000080
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1cc]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
jne 0x5717b8
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jge 0x57193d
mov esi, dword [esp + 0x18]
jmp 0x5716c9
lea esi, [ebp + 0x101c]
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
xor edx, edx
xor eax, eax
mov dx, word [ebp + 0x102a]
mov ax, word [ebp + 0x1028]
push edx
xor ecx, ecx
mov cx, word [ebp + 0x1026]
xor edx, edx
mov dx, word [ebp + 0x1024]
push eax
push ecx
xor eax, eax
mov ax, word [ebp + 0x1022]
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x101e]
mov dx, word [esi]
push eax
push ecx
push edx
push 0x71a158
lea edi, [ebp + 0x1c]
call fcn.00586540
add esp, 4
push eax
push edi
call fcn.006935d4
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x1034]
not ecx
dec ecx
cmp eax, 0x3e7
mov esi, ecx
mov dword [esp + 0x10], esi
jne 0x571844
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0x1030]
test eax, eax
je 0x571885
test esi, esi
jle 0x571927
mov edi, 0xffffffe4
lea eax, [ebp + 0x1c]
sub edi, ebp
mov ecx, 2
mov edx, dword [ebp + 0x1030]
add edx, ecx
mov dword [ebp + 0x1030], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [edi + eax]
cmp edx, esi
jl 0x571865
jmp 0x571927
xor esi, esi
lea edi, [ebp + 0x102c]
mov si, word [ebp + 0x102a]
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x1028]
mov dx, word [ebp + 0x1026]
add ecx, esi
push 0
add ecx, eax
xor eax, eax
mov ax, word [ebp + 0x1022]
add edx, ecx
xor ecx, ecx
mov cx, word [ebp + 0x101e]
imul eax, ecx
xor ecx, ecx
mov cx, word [ebp + 0x101c]
imul eax, ecx
imul eax, esi
inc eax
imul edx, eax
and edx, 0xffffff
mov eax, dword [ebp]
or edx, 0x1a000000
mov dword [edi], edx
lea edx, [esp + 0x38]
push edx
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x571927
mov edx, 0xffffffe4
lea eax, [ebp + 0x1c]
sub edx, ebp
mov ecx, dword [edi]
lea ecx, [ecx + ecx*2 + 1]
mov dword [edi], ecx
add cl, 0x65
xor byte [eax], cl
inc eax
lea ecx, [eax + edx]
cmp ecx, esi
jl 0x571912
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [ebp + 0x1c]
push esi
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x71a130
push 0x2e
push 0x71a104
call fcn.00586540
add esp, 4
push eax
push ebp
call fcn.00572d80
mov ecx, dword [esp + 0x10d8]
mov edx, dword [ebx + 0x11fc]
add esp, 0x10
push fcn.005710f0
push ecx
push edx
push 0x71a0c4
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x14
call fcn.00573df0
call fcn.00573ed0
mov al, byte [ebx + 0x127c]
test al, al
je 0x5719a4
push 1
call fcn.005757d0
add esp, 4
push 0x251c
mov ecx, ebx
call fcn.00573740
test eax, eax
jne 0x5719dd
push 0x71a0a8
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0x73
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0
mov ecx, ebx
call fcn.00573850
test eax, eax
jne 0x571a78
push 0x71a094
call fcn.005865b0
add esp, 4
push eax
push 0
push 0x100002
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
mov esi, eax
test esi, esi
jne 0x571a21
pop edi
pop esi
pop ebp
mov eax, 0x6e
pop ebx
add esp, 0x10b4
ret 4
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x571a3f
push esi
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x251c
mov ecx, ebx
call fcn.00573850
test eax, eax
jne 0x571a61
pop edi
pop esi
pop ebp
mov eax, 0x6e
pop ebx
add esp, 0x10b4
ret 4
push 0x71a074
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
and eax, 0xfff00000
mov dword [esp + 0x18], eax
push 0
push 0
lea eax, [esp + 0x44]
push 0
push eax
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 1
call esi
test eax, eax
mov dword [ebx + 0x1278], eax
jne 0x571ace
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
call esi
push eax
push 0x71a050
jmp 0x571b1b
push 0
push 0
lea ecx, [esp + 0x44]
push 1
push ecx
call esi
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x571af4
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
call esi
push eax
push 0x71a02c
jmp 0x571b1b
push 0
push 0
lea edx, [esp + 0x44]
push 0
push edx
call esi
test eax, eax
mov dword [ebx + 0x1274], eax
jne 0x571b3f
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
call esi
push eax
push 0x71a008
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0xab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x71a000
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
lea eax, [esp + 0xb4]
mov ecx, ebx
push 0x104
push eax
call fcn.005730b0
mov edi, 0x71a1b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x719fec
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005865b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xbc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00697128
add esp, 0xc
cmp eax, 0xffffffff
jne 0x571c1a
lea ecx, [esp + 0xb4]
push ecx
push 0x719fd8
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0x99
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
lea edx, [esp + 0xb4]
push 1
lea ecx, [ebx + 0x11b4]
push edx
mov byte [esp + 0x1e], 0
call fcn.00585660
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test al, al
jne 0x571de9
mov eax, dword [ebx + 0x11f8]
mov byte [esp + 0x17], 0
cmp eax, 8
jne 0x571c60
call esi
cmp eax, 0x80090006
jne 0x571c60
mov byte [esp + 0x17], 1
call esi
mov edi, dword [ebx + 0x11f8]
lea eax, [esp + 0xb4]
push eax
call esi
push eax
push edi
push 0x719fbc
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x14
lea ecx, [esp + 0xb4]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x571cd6
lea edx, [esp + 0xb4]
push edx
call esi
push eax
push 0x719fa4
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x10
jmp 0x571d44
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
push 0x719f94
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
push 2
push 0
push 0xfffffffffffffffc
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [esp + 0x34]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x10]
push edx
push 0x719f84
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [esp + 0x17]
test al, al
je 0x571dc0
mov al, byte [ebx + 0x1269]
test al, al
jne 0x571d8a
call fcn.00574d40
test al, al
je 0x571d8a
lea eax, [esp + 0xb4]
push 1
push eax
lea ecx, [ebx + 0x11b4]
call fcn.00585660
test al, al
jne 0x571da1
cmp dword [ebx + 0x11f8], 8
jne 0x571d9c
call esi
cmp eax, 0x80090006
jne 0x571d9c
pop edi
pop esi
pop ebp
mov eax, 0x9b
pop ebx
add esp, 0x10b4
ret 4
mov byte [esp + 0x16], 1
push 0x719f6c
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov al, byte [esp + 0x1e]
add esp, 8
test al, al
je 0x571de9
push 0x719f48
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0x7c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719f40
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x58]
mov edx, dword [0xf672ec]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov eax, dword [ebx + 0x11fc]
mov dword [esp + 0x28], ecx
add esp, 8
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x28], ecx
push edx
mov edx, dword [ebx + 0x1278]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebx + 0x18]
push eax
push ecx
lea eax, [ebx + 0x1200]
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
push 0x719f28
call fcn.005865b0
add esp, 4
lea ecx, [esp + 0x2d8]
push eax
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x20
lea edx, [esp + 0x2c0]
push edx
push 0x719f20
push ebp
call fcn.00572d80
lea eax, [esp + 0x2cc]
push eax
call fcn.005864a0
mov dword [esp + 0x20], eax
lea edi, [esp + 0x2d0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea esi, [esp + 0xcc4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push 0x719f18
push ebp
call fcn.00572d80
lea eax, [edi + 4]
add esp, 0xc
test eax, eax
jle 0x571eec
mov edi, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
xor eax, eax
mov al, byte [edi]
inc edi
push eax
push 0x719f10
push esi
call dword [sym.imp.user32.dll_wsprintfA]
add esi, eax
mov eax, dword [esp + 0x28]
add esp, 0xc
dec eax
mov dword [esp + 0x1c], eax
jne 0x571eca
lea ecx, [esp + 0xcc4]
mov byte [esi], 0
push ecx
push 0x719f08
push ebp
call fcn.00572d80
add esp, 0xc
lea edx, [esp + 0x20]
lea eax, [esp + 0x50]
lea ecx, [esp + 0xcc4]
push edx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0xd4]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x571f75
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [esp + 0xb8]
push eax
push ecx
push 0x719ee0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x14
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719ed8
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov edx, dword [ebx + 0x1278]
mov eax, dword [esp + 0x28]
add esp, 8
lea ecx, [esp + 0x48]
mov dword [esp + 0x30], 0
mov dword [esp + 0x48], edx
push 0xffffffffffffffff
push 0
push ecx
push 2
mov dword [esp + 0x5c], eax
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
test eax, eax
je 0x57202e
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
jne 0x571fed
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x719eb4
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov ecx, dword [esp + 0x30]
push ecx
push 0x719e90
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 0xc
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719e88
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
lea ecx, [esp + 0x28]
push ecx
call fcn.00574820
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 0xc
mov dword [esp + 0x18], eax
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
lea ecx, [esp + 0x3c0]
push 0x104
push ecx
mov ecx, ebx
call fcn.00573060
mov edi, 0x71a1b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x719e7c
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0x1200]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005865b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c0]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x3c0]
push 1
push eax
lea ecx, [ebx + 0x11b4]
call fcn.00585660
test al, al
jne 0x57216b
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
mov ebx, dword [ebx + 0x11f8]
call esi
push eax
push ebx
push 0x719e64
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x10
mov eax, 0x78
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
mov ecx, dword [0x719a84]
push ecx
call fcn.005865b0
add esp, 4
add eax, 5
lea edx, [esp + 0x4c4]
lea ecx, [ebx + 0x11b4]
push eax
push 0x7ff
lea eax, [esp + 0x3c8]
push edx
push eax
call fcn.00585a70
test al, al
jne 0x5721dd
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
mov ebx, dword [ebx + 0x11f8]
call esi
push eax
push ebx
push 0x719e44
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x10
mov eax, 0x82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719e38
call fcn.00586540
add esp, 4
lea ecx, [esp + 0x4c4]
lea edx, [esp + 0x94]
mov esi, eax
push ecx
push 0x20
push edx
push 0x719e2c
call fcn.00586540
add esp, 4
push eax
push 0x719e1c
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586800
lea eax, [ebx + 0x1200]
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.00696fdd
add esp, 0x20
test eax, eax
je 0x572264
push 0x719e04
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0x8e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
lea ecx, [esp + 0x4c4]
push ecx
push 1
push 0x719df8
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
lea edx, [esp + 0x4c4]
mov dword [0x719a88], eax
push edx
push 0x186a0
push 0x719de8
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
mov dword [0xf672d4], eax
lea eax, [esp + 0x4c4]
push eax
push 0
push 0x719dd8
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
lea ecx, [esp + 0x4c4]
mov dword [0xf672d8], eax
push ecx
push 0
push 0x719dc8
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
lea edx, [esp + 0x4c4]
mov dword [esp + 0x1c], eax
push edx
push 0
push 0x719dbc
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x4c4]
push eax
push 0
push 0x719da8
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
lea ecx, [esp + 0x4c4]
shr eax, 1
not al
push ecx
and al, 1
push 0x3e8
push 0x719d90
mov byte [ebx + 0x1e], al
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
add esp, 0x10
mov dword [ebx + 0x126c], eax
lea edx, [esp + 0x4c4]
push edx
push 0
push 0x719d7c
call fcn.005865b0
add esp, 4
push eax
push esi
call fcn.00586790
mov dword [ebx + 0x1270], eax
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x4d4]
rep stosd dword es:[edi], eax
push 0x719d74
call fcn.005865b0
add esp, 0x14
push eax
push ebp
call fcn.00572d80
add esp, 8
mov ecx, ebx
push 0x104
push 0xf671c0
call fcn.00573060
mov edi, 0x71a1b8
or ecx, 0xffffffff
xor eax, eax
push 0x719d64
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0xf671c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005865b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0xf671c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0xf672fc]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x5724d1
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 3]
push ecx
xor ecx, ecx
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
mov dl, byte [eax + 1]
xor ecx, ecx
mov cl, byte [eax]
push edx
push ecx
push 0x719d40
call fcn.005865b0
mov edx, dword [0xf672fc]
add esp, 4
add edx, 0x20
push eax
push edx
call fcn.00572d80
mov eax, dword [0xf672fc]
add esp, 0x1c
test eax, eax
je 0x5724d1
mov eax, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 3]
push ecx
xor ecx, ecx
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
mov dl, byte [eax + 1]
xor ecx, ecx
mov cl, byte [eax]
push edx
push ecx
push 0x719d1c
call fcn.005865b0
mov edx, dword [0xf672fc]
add esp, 4
add edx, 0x20
push eax
push edx
call fcn.00572d80
add esp, 0x1c
push 0x719d14
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
push 0
push 0xf671c0
call fcn.00697128
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5725b0
push 0x104
push 0xf671c0
mov ecx, ebx
call fcn.00573060
mov edi, 0x71a1b8
or ecx, 0xffffffff
xor eax, eax
push 0x719d04
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0xf671c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005865b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0xf671c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0xf671c0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00697128
add esp, 0xc
cmp eax, 0xffffffff
jne 0x5725b0
push 0xf671c0
push 0x719ce8
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0x9a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 1
push 0xf671c0
lea ecx, [ebx + 0x11b4]
call fcn.00585660
test al, al
jne 0x572606
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
mov ebx, dword [ebx + 0x11f8]
push 0xf671c0
call esi
push eax
push ebx
push 0x719fbc
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x14
mov eax, 0x7a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719ce0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
lea ecx, [ebx + 0x105c]
call fcn.00585020
test al, al
jne 0x572655
push 0x719ccc
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719cc4
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, eax
mov eax, dword [esp + 0x1c]
and esi, 0xfff00000
cmp eax, 0x2e
jae 0x572695
pop edi
pop esi
pop ebp
mov eax, 0x78
pop ebx
add esp, 0x10b4
ret 4
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x1278]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x1278]
mov ecx, dword [ebx + 0x1274]
push edx
push eax
lea eax, [ebx + 0x1200]
lea edi, [ebx + 0x105c]
push ecx
push eax
mov ecx, edi
call fcn.00584da0
push eax
mov ecx, edi
call fcn.00584d90
xor edx, edx
push eax
mov dl, byte [ebx + 0x1269]
mov eax, dword [ebx + 0x11fc]
push edx
push eax
push esi
push 0x719c9c
call fcn.005865b0
add esp, 4
lea ecx, [esp + 0x2e4]
push eax
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edx, [esp + 0x2ec]
push edx
call fcn.005864a0
mov dword [esp + 0x40], eax
lea edi, [esp + 0x2f0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
lea esi, [esp + 0xcc4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + 4]
test eax, eax
jle 0x572781
mov edi, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
xor eax, eax
mov al, byte [edi]
inc edi
push eax
push 0x719f10
push esi
call dword [sym.imp.user32.dll_wsprintfA]
add esi, eax
mov eax, dword [esp + 0x28]
add esp, 0xc
dec eax
mov dword [esp + 0x1c], eax
jne 0x57275f
push 0x719c94
mov byte [esi], 0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov eax, dword [0xf672ec]
add esp, 8
test eax, eax
jne 0x57282e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x50]
push eax
push ecx
push 0
push 0
push 4
push 1
push 0
lea edx, [esp + 0xce0]
push 0
push edx
push 0xf671c0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x572812
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0xf671c0
push 0x719ee0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0x14
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
mov ecx, dword [esp + 0x28]
push ecx
push 0x719c88
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, dword [0xf672d8]
test eax, eax
mov dword [0xf672e8], eax
jne 0x57285d
mov edx, dword [esp + 0x18]
push edx
push 0x719c74
push 0xf671c0
call fcn.00574610
add esp, 0xc
and eax, 0xff
mov dword [0xf672e8], eax
push 0x719c6c
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
lea edi, [ebx + 0x105c]
add esp, 8
mov ecx, edi
call fcn.00585160
test eax, eax
jne 0x5728b9
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
call esi
push eax
push 0x719c58
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push eax
push 0x719c28
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov eax, dword [0xf672ec]
add esp, 0xc
test eax, eax
jne 0x572998
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [ebx + 0x1274]
mov eax, dword [0xf672d4]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push 2
mov dword [esp + 0x48], edx
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
test eax, eax
je 0x5729e8
push 0x719c14
call fcn.005865b0
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
test eax, eax
je 0x572968
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [0xf672d4]
mov eax, dword [ebx + 0x1274]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x5729e8
mov ecx, dword [0xf672d4]
push ecx
push 0x719bf8
jmp 0x5729c4
mov edx, dword [0xf672d4]
push edx
push 0x719be0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
mov eax, 0xcccccccd
mul dword [0xf672d4]
mov eax, dword [ebx + 0x1274]
shr edx, 3
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x5729e8
mov ecx, dword [0xf672d4]
push ecx
push 0x719be0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719bd0
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov edx, dword [ebx + 0x1278]
add esp, 8
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x572a3b
push 0x719bb8
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719c14
call fcn.005865b0
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
test eax, eax
je 0x572a7a
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x719bac
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
jmp 0x572a8d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov dword [0xf672f0], eax
mov dword [0xf672f4], ecx
push 0x719ba4
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov eax, dword [0xf672e8]
add esp, 8
test eax, eax
jne 0x572abf
pop edi
pop esi
pop ebp
mov eax, 0x7a
pop ebx
add esp, 0x10b4
ret 4
call fcn.00575840
call fcn.005740d0
mov esi, eax
test esi, esi
jne 0x572adc
push 0xb
push 0x62d
push edi
call fcn.005739c0
push esi
push 0x719b8c
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 0xc
call fcn.00574400
mov esi, eax
test esi, esi
jne 0x572b12
push 0xd
push 0x630
push 0x8b1
mov ecx, edi
call fcn.00584f20
push esi
push 0x719b74
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov al, byte [ebx + 0x1e]
add esp, 0xc
test al, al
je 0x572b65
mov ecx, ebx
call fcn.005733e0
test al, al
jne 0x572b65
push 0x719b58
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov eax, 0xdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10b4
ret 4
push 0x719b50
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
mov edx, dword [ebx + 0x11fc]
add esp, 8
mov ecx, edi
push edx
push 0x611
push 0x8b1
call fcn.00584f20
mov eax, dword [esp + 0x18]
mov ecx, edi
push eax
push 0x617
push 0x8b1
call fcn.00584f20
push 0x719b30
call fcn.005865b0
add esp, 4
push eax
push ebp
call fcn.00572d80
add esp, 8
mov byte [ebx], 1
pop edi
pop esi
pop ebp
mov eax, 0x755
pop ebx
add esp, 0x10b4
ret 4