Function at 0x42ee2a
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
mov eax, dword [ebp + 0x7c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp + 0x58], ecx
mov dword [ebp + 0x48], eax
mov byte [ebp + 0x5f], bl
call fcn.0040f957
mov eax, dword [ebp + 0x7c]
mov byte [0x4d7c3a], bl
cmp word [eax], 0x2a
lea eax, [ebp + 0x7c]
push eax
sete byte [ebp + 0x67]
call fcn.00408ddd
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
cmp word [eax], 0x2d
pop ecx
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x6f], 0x2a
jne 0x42ee7d
mov byte [ebp + 0x6f], 0x2d
xor esi, esi
inc esi
mov dword [ebp + 0x4c], eax
push 5
lea eax, [ebp + 0x7c]
push eax
push 0x4c2314
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x42ef29
push 2
lea eax, [ebp + 0x7c]
push eax
push 0x4c24a4
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x42ef29
mov eax, dword [ebp + 0x4c]
movsx ecx, byte [ebp + 0x6f]
movzx edx, word [eax]
cmp ecx, edx
jne 0x42ef34
movzx edx, word [eax + 2]
cmp ecx, edx
jne 0x42ef34
add eax, 4
mov dword [ebp + 0x4c], eax
push 4
lea eax, [ebp + 0x4c]
push eax
push 0x4c249c
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x42ef1b
push esi
lea eax, [ebp + 0x4c]
push eax
push 0x4c231c
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x42ef1b
push 4
lea eax, [ebp + 0x4c]
push eax
push 0x4bde74
call fcn.00445f31
add esp, 0xc
test al, al
je 0x42ef34
mov byte [ebp + 0x5f], 1
jmp 0x42ef1e
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x7c], eax
jmp 0x42ee80
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x68], esi
jmp 0x42ee80
cmp dword [ebp + 0x68], ebx
je 0x42ef42
mov dword [ebp + 0x54], 0x4be9a4
jmp 0x42ef4a
mov eax, dword [0x4d6304]
mov dword [ebp + 0x54], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x2c], 0xc
mov dword [ebp + 0x34], ebx
call fcn.0044070a
cmp dword [ebp + 0x68], ebx
pop ecx
mov eax, 0x4c0278
jne 0x42ef89
mov eax, 0x4c2488
push eax
push esi
lea eax, [ebp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp esi, ebx
je 0x42efb1
mov ecx, 0xb7
cmp eax, ecx
jne 0x42efb1
mov eax, ecx
jmp 0x42f760
cmp dword [ebp + 0x68], ebx
je 0x42efbf
mov byte [0x4d7c0a], 0x20
jmp 0x42efcf
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
setne al
add al, 0x10
mov byte [0x4d7c0a], al
cmp dword [ebp + 0x68], ebx
push 0xd
pop ecx
mov esi, 0x4c2450
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x42efe9
mov word [ebp - 0x12], 0x55
cmp dword [0x4d7cf8], ebx
mov edi, 0x4d80e8
jne 0x42f011
lea eax, [ebp - 0x2e]
push eax
call fcn.004a980e
test eax, eax
pop ecx
je 0x42f011
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
call fcn.0041bffb
movsx eax, byte [0x4d7c0a]
push eax
push dword [ebp + 0x48]
push 0x4c2428
push edi
call fcn.00410981
push dword [0x4d8260]
push 0x4c23e0
push edi
call fcn.00410981
add esp, 0x1c
call fcn.004189ed
cmp byte [ebp + 0x67], bl
je 0x42f04c
mov byte [0x4d7c08], 1
cmp dword [ebp + 0x68], ebx
mov esi, 0x80000002
jne 0x42f1d6
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
je 0x42f1f2
mov dword [ebp + 0x70], ebx
call fcn.0040f957
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4bf2a8
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], eax
je 0x42f0a2
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x60], 0x3fd
je 0x42f0b8
push 0x4bed04
push esi
call fcn.0044e0a6
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4bed04
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
je 0x42f0ea
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4bf208
push esi
mov byte [0x4d8185], 1
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], eax
je 0x42f125
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x60], 0x3fd
je 0x42f13b
push 0x4bf268
push esi
call fcn.0044e0a6
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4bf268
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
je 0x42f16d
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x50]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4bdb60
push esi
mov dword [ebp + 0x50], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x50], ebx
je 0x42f19e
push dword [ebp + 0x50]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 0x2d90
push 0x4c1fdc
push edi
call fcn.00410a74
push 0x2d92
push 0x4c1fdc
push edi
call fcn.00410a74
call fcn.0040f80c
push 0x2d94
push 0x4c1fdc
push edi
call fcn.00410a74
add esp, 0x24
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
je 0x42f1f2
mov ecx, dword [ebp + 0x58]
push ebx
push 0x24
push ebx
push 0x4bca0c
call fcn.00420c1c
mov eax, dword [ebp + 0x7c]
xor ecx, ecx
mov cx, word [eax]
cmp cx, 0x2a
mov dword [ebp + 0x44], ecx
jne 0x42f214
add eax, 2
cmp word [eax], 0x23
je 0x42f214
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
call fcn.0040f369
mov eax, 0x4bca0c
push eax
push eax
call sym.PECMD.exe_LoadEnvi
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x42f231
mov byte [0x4d8494], 1
call fcn.0043e4a8
call fcn.0042a5e5
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 4
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push 4
push 0x4c23c0
push 0x4bdb60
push esi
call fcn.0043ed6b
push 0x2d9e
push 0x4c1fdc
push edi
call fcn.00410a74
push ebx
push 0x4d80e8
call fcn.0049a4aa
mov eax, dword [ebp + 0x58]
add esp, 0x2c
cmp dword [eax + 0x44], ebx
jne 0x42f2f4
test byte [0x4d81a8], 1
jne 0x42f2a3
or dword [0x4d81a8], 1
push 0x4bb960
mov dword [0x4d81a4], ebx
call fcn.004aa356
pop ecx
mov ecx, dword [ebp + 0x58]
push 0x10000
mov dword [ecx + 0x44], 0x4d81a4
call fcn.00442712
lea ecx, [ebp + 0x60]
call fcn.00443f5b
push dword [ebp + 0x60]
mov ecx, 0x4d81a4
call fcn.00474b4e
mov eax, dword [0x4d81a4]
mov ecx, dword [ebp + 0x58]
push 1
push dword [ebp + 0x48]
mov dword [ebp + 0x60], ebx
mov eax, dword [eax]
mov dword [ecx + 0x48], eax
call fcn.0044fb36
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x60]
mov dword [eax + 0x50], ebx
call fcn.0043db4f
push 0x2daa
push 0x4c1fdc
push edi
call fcn.00410a74
add esp, 0xc
cmp dword [ebp + 0x68], ebx
jne 0x42f32f
mov al, byte [0x4d7c0a]
push 1
mov byte [ebp + 0x67], al
lea eax, [ebp + 0x67]
push eax
push 3
push 0x4c23b0
push 0x4bdb60
push esi
call fcn.0043ed6b
add esp, 0x18
push 0x2dae
push 0x4c1fdc
push edi
call fcn.00410a74
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], bx
je 0x42f34f
call fcn.004126aa
push 4
push 0x4d7fa4
push 4
push dword [ebp + 0x54]
push 0x4bdb60
push esi
call fcn.0043ed6b
add esp, 0x18
cmp word [ebp + 0x44], bx
jne 0x42f374
cmp dword [ebp + 0x68], ebx
je 0x42f379
call fcn.00421336
mov ecx, dword [ebp + 0x58]
call fcn.004184da
push 0x8000
call fcn.004520ce
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
pop ecx
jne 0x42f399
cmp dword [ebp + 0x68], ebx
je 0x42f3e0
push 0x2db9
push 0x4c1fdc
push edi
call fcn.00410a74
push ebx
push 0x4d7c20
push 0x10000
push 0x80000
push ebx
push 0x42eb0a
call fcn.0043dc3f
add esp, 0x24
jmp 0x42f3dd
lea ecx, [eax + 2]
cmp word [ecx], 0x23
je 0x42f3e6
mov dword [ebp + 0x7c], ecx
lea ecx, [ebp + 0x7c]
call fcn.0040f369
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
je 0x42f3c9
cmp word [eax], bx
je 0x42f728
push 0x2dc1
push 0x4c1fdc
push edi
call fcn.00410a74
add esp, 0xc
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 0x5c8
push eax
lea ecx, [ebp + 0x48]
call fcn.00443f79
mov eax, dword [ebp + 0x48]
mov word [eax], bx
mov edi, dword [ebp + 0x48]
push 0x104
add edi, 0x280
mov dword [ebp + 0x38], eax
push edi
lea eax, [edi + 0x488]
push ebx
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.DLL_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x60], eax
jne 0x42f457
mov dword [ebp + 0x60], edi
jmp 0x42f45b
add dword [ebp + 0x60], 2
push dword [ebp + 0x7c]
call fcn.00411d91
test eax, eax
pop ecx
lea ecx, [ebp + 0x54]
je 0x42f4ab
push dword [ebp + 0x7c]
call fcn.0044cd74
push 4
push dword [ebp + 0x7c]
push 0x4c23a8
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x42f490
mov byte [0x4d8035], 1
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push dword [ebp + 0x54]
call fcn.00433455
lea ecx, [ebp + 0x54]
call fcn.0043db4f
jmp 0x42f720
mov eax, dword [ebp + 0x7c]
mov byte [ebp + 0x6f], bl
mov dword [ebp + 0x70], eax
call fcn.00443f5b
mov ecx, dword [ebp + 0x58]
push ebx
push 0x1000
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.00438c4b
push 0x400
lea ecx, [ebp + 0x50]
call fcn.00443f79
mov eax, dword [ebp + 0x50]
push ebx
push ebx
push 3
push ebx
push 7
mov word [eax], bx
mov eax, dword [ebp + 0x50]
push 0x80000000
push dword [ebp + 0x54]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x40], ebx
call fcn.0040569f
push ebx
lea eax, [ebp + 0x44]
push eax
push 0x7fe
push dword [ebp + 0x50]
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp + 0x70]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp + 0x70]
cmp word [eax], 0xfeff
jne 0x42f535
add dword [ebp + 0x70], 2
push 7
push dword [ebp + 0x70]
push 0x4c2398
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x42f5a7
add dword [ebp + 0x70], 0xe
jmp 0x42f599
lea eax, [ebp + 0x70]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x70]
pop ecx
mov cx, word [eax]
cmp cx, 0x20
je 0x42f56b
cmp cx, 9
jne 0x42f572
inc eax
inc eax
mov dword [ebp + 0x70], eax
jmp 0x42f55c
movzx eax, word [eax]
push eax
call fcn.00402d55
add esp, 4
test al, al
jne 0x42f5a7
push 0xd
lea eax, [ebp + 0x70]
push eax
push 0x4c237c
call fcn.0043dbdf
add esp, 0xc
test eax, eax
jne 0x42f5a3
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
jne 0x42f54f
jmp 0x42f5a7
mov byte [ebp + 0x6f], 1
lea ecx, [ebp + 0x40]
call fcn.00402cb5
lea ecx, [ebp + 0x50]
call fcn.0043db4f
lea ecx, [ebp + 0x54]
call fcn.0043db4f
cmp byte [ebp + 0x6f], bl
je 0x42f5f2
push dword [ebp + 0x7c]
push 0x4c2358
push dword [ebp + 0x68]
call dword [sym.imp.USER32.DLL_wsprintfW]
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push ebx
push ebx
push ebx
push dword [ebp + 0x68]
mov byte [0x4d8035], 1
call fcn.00433455
jmp 0x42f720
push dword [ebp + 0x60]
push edi
mov edi, dword [sym.imp.USER32.DLL_wsprintfW]
push 0x4c2330
push dword [ebp + 0x68]
call edi
add esp, 0x10
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax*2]
push 0x4c2358
push eax
call edi
mov eax, dword [ebp + 0x38]
add esp, 0xc
cmp word [eax], bx
je 0x42f70b
mov dword [ebp + 0x70], ebx
call fcn.0040f957
mov edi, dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4bf2a8
push esi
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x38], eax
je 0x42f670
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x38], 0x3fd
je 0x42f686
push 0x4bed04
push esi
call fcn.0044e0a6
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4bed04
push esi
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
je 0x42f6b4
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4bf268
push esi
mov byte [0x4d8185], 1
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
je 0x42f6e9
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 4
lea eax, [ebp + 0x3c]
push eax
push 4
push 0x4c04d4
push 0x4bed04
push esi
mov dword [ebp + 0x3c], 1
call fcn.0043ed6b
add esp, 0x18
movsx eax, byte [ebp + 0x5f]
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push eax
push ebx
push ecx
push dword [ebp + 0x68]
call fcn.0040a2d5
lea ecx, [ebp + 0x48]
call fcn.0043db4f
mov esi, dword [sym.imp.USER32.DLL_GetMessageW]
jmp 0x42f744
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.USER32.DLL_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp + 0x10]
push ebx
push eax
call esi
test eax, eax
jne 0x42f730
push dword [0x4d7f90]
call dword [sym.imp.USER32.DLL_UnhookWindowsHookEx]
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4