Function at 0x425e9f
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c0
lea ebp, [esp - 0x74]
call fcn.004931e0
push ebx
push esi
mov dword [ebp + 0x6c], ecx
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
and dword [ebp + 0x48], 0
and dword [ebp + 0x40], 0
xor edi, edi
inc edi
mov dword [ebp + 0x58], edi
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x72], 0
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x73], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x30], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov bl, 0x2a
jne 0x425f00
add bl, 3
mov cl, byte [eax]
cmp bl, cl
jne 0x426157
mov esi, dword [ebp + 0x7c]
add esi, 2
mov ax, word [esi]
cmp ax, 0x41
jb 0x42612e
cmp ax, 0x2a
je 0x42612e
cmp ax, 0x30
jb 0x425f37
cmp ax, 0x39
jbe 0x42612e
cmp ax, 0x28
je 0x42612e
cmp cl, 0x2d
jne 0x425f62
mov dl, al
or dl, 0x20
cmp dl, 0x63
jne 0x425f62
mov edx, dword [ebp + 0x7c]
mov dl, byte [edx + 4]
or dl, 0x20
cmp dl, 0x6d
je 0x42612e
cmp cl, 0x2a
jne 0x425f7d
test ax, ax
je 0x42612e
call fcn.00437e2d
test al, al
jne 0x42612e
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4ab520
mov dword [ebp + 0x7c], esi
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x425fa0
mov byte [ebp + 0x71], 1
jmp 0x426121
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x425fc0
mov byte [ebp + 0x53], 1
jmp 0x426121
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4a7b78
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x425fe0
mov byte [ebp + 0x68], 1
jmp 0x426121
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426000
mov byte [ebp + 0x68], 0x41
jmp 0x426121
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426020
mov byte [ebp + 0x68], 0x10
jmp 0x426121
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426040
mov byte [ebp + 0x68], 0x50
jmp 0x426121
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426063
mov dword [ebp + 0x48], 0x10000
jmp 0x426121
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426083
mov byte [ebp + 0x72], 1
jmp 0x426121
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4aaf24
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4260a3
mov dword [ebp + 0x40], 0x40
jmp 0x426121
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4260d0
push edi
call fcn.00439b12
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x42655f
jmp 0x426121
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4260ed
mov byte [ebp + 0x73], 1
jmp 0x426121
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x426117
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044957c
pop ecx
jmp 0x426120
lea eax, [ebp + 0x7c]
push eax
call fcn.00405196
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp bl, cl
je 0x425f0a
cmp byte [ebp + 0x73], 0
je 0x426157
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x4c0de0]
setne cl
push ecx
push 0x4c1338
call fcn.0041146f
pop ecx
pop ecx
jmp 0x426b6c
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x426181
cmp byte [eax + 2], 0x2d
jne 0x426181
movzx eax, word [eax + 4]
test ax, ax
je 0x426177
call fcn.00437e2d
test al, al
je 0x426181
lea eax, [ebp + 0x7c]
push eax
call fcn.00405196
pop ecx
cmp byte [ebp + 0x68], 0
je 0x426295
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x5c]
call fcn.0040e71c
mov esi, dword [ebp + 0x68]
and esi, 0x40
push esi
call fcn.00410972
test eax, eax
pop ecx
mov dword [ebp + 0x48], eax
jne 0x4261c5
push esi
push dword [ebp + 0x6c]
call fcn.00417f89
pop ecx
pop ecx
mov dword [ebp + 0x48], eax
test eax, eax
mov dword [ebp + 0x58], edi
je 0x426276
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.0043dd9c
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x42620d
push dword [ebp + 0x18]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.00439000
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.0043904c
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.00437e1a
cmp dword [ebp + 0x5c], 0
je 0x426285
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x426b69
cmp byte [ebp + 0x72], 0
je 0x42634a
lea ecx, [ebp + 0x40]
mov ebx, str.PressKey
call fcn.0043dd7e
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
je 0x4262ca
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov ebx, dword [ebp + 0x40]
add esp, 0xc
push 0x3f
xor eax, eax
mov byte [ebp - 0x148], 0
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
mov word [ebp - 0x414c], si
lea edi, [ebp - 0x414c]
movzx eax, byte [ebp + esi - 0x148]
push eax
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 0xa
cmp esi, 0x100
jl 0x4262fd
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x374e], 0
lea eax, [ebp - 0x414c]
push eax
push ebx
call fcn.0043d658
lea ecx, [ebp + 0x40]
call fcn.00437e1a
and dword [ebp + 0x58], 0
jmp 0x426b2f
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x4c], 0xfffffc18
jne 0x42638c
lea eax, [edx + 2]
mov cx, word [eax]
or cx, 0x20
cmp cx, 0x63
je 0x42638c
cmp cx, 0x64
je 0x42638c
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x67], 1
call fcn.0040e2c3
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
jne 0x42639b
mov bl, byte [edx]
inc edx
inc edx
mov dword [ebp + 0x7c], edx
jmp 0x42639d
xor bl, bl
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.004129ca
add esp, 4
test al, al
je 0x42644c
mov eax, dword [ebp + 0x7c]
fld qword [0x4ab470]
mov dword [ebp + 0x60], eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x5c], esi
call fcn.0044957c
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x4263ea
mov ax, word [ecx]
call fcn.00437e2d
test al, al
jne 0x4263ef
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x60]
jb 0x4263d9
cmp dword [ebp + 0x5c], 0
jl 0x426440
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x5c]
mov dword [ebp + 0x68], edi
jne 0x426440
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00440b28
fld qword [ebp + 0x38]
fcomp qword [0x4ab468]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x4264c5
fld qword [ebp + 0x38]
fadd qword [0x4ab460]
fmul qword [0x4ab458]
call fcn.00493354
mov dword [ebp + 0x4c], eax
jmp 0x4264c5
lea eax, [ebp + 0x7c]
push eax
call fcn.00405196
pop ecx
jmp 0x4264c5
cmp cx, 0x28
jne 0x4264c5
fld qword [0x4ab470]
lea eax, [ebp + 0x38]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x7c]
push eax
call fcn.004814f9
test eax, eax
pop ecx
pop ecx
jle 0x4264c5
fld qword [ebp + 0x38]
fcomp qword [0x4ab468]
fnstsw ax
test ah, 1
jne 0x4264c5
fld qword [ebp + 0x38]
fadd qword [0x4ab460]
fld st(0)
call fcn.00493354
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.00493354
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
fild qword [ebp + 0x38]
fsubp st(1)
fcom qword [0x4ab450]
fnstsw ax
test ah, 0x41
jne 0x4264c3
fcom qword [0x4ab448]
fnstsw ax
test ah, 5
jnp 0x42642d
fstp st(0)
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
je 0x42664e
cmp edi, esi
jne 0x4264e0
cmp dword [ebp + 0x4c], 0
jl 0x42664e
and word [ebp - 0x46], 0
and word [ebp - 0x48], 0
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x5c], str.PressKey
call fcn.0043dd7e
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x426524
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], 0
je 0x426524
mov dword [ebp + 0x5c], eax
cmp byte [ebp + 0x67], 0
jne 0x426592
test edi, edi
jne 0x426535
cmp dword [ebp + 0x4c], edi
jle 0x42658d
test edi, edi
jl 0x426637
test bl, bl
je 0x426566
and dword [ebp + 0x58], 0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x426637
lea ecx, [ebp + 0x60]
call fcn.00437e1a
xor eax, eax
jmp 0x426b6c
mov ecx, dword [ebp + 0x4c]
test ecx, ecx
jg 0x42656f
xor ecx, ecx
test edi, edi
jle 0x426577
mov eax, edi
jmp 0x426579
xor eax, eax
push 0
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.00413b53
mov dword [ebp + 0x58], eax
jmp 0x426637
push 2
pop eax
jmp 0x426595
xor eax, eax
inc eax
or eax, dword [ebp + 0x48]
push eax
push edi
call fcn.0041ad8a
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x4265bc
cmp ebx, 0x60
jl 0x4265bc
cmp ebx, 0x69
jg 0x4265bc
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, str.0x_X
jle 0x4265db
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x48]
jmp 0x4265e0
mov eax, 0x4ab440
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.0043d658
test ebx, ebx
jle 0x426623
cmp ebx, 0x41
jl 0x4265fc
cmp ebx, 0x5a
jle 0x426609
push ebx
call fcn.004129ca
add esp, 4
test al, al
je 0x426618
and word [ebp - 0x46], 0
movsx ax, bl
mov word [ebp - 0x48], ax
jmp 0x426623
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x5c]
call fcn.0043d658
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x67], 0
call fcn.00437e1a
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
je 0x426b2f
xor edi, edi
mov ecx, eax
mov dword [ebp + 0x54], edi
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0
jne 0x42668c
mov eax, dword [ebp + 0x18]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x54], eax
jmp 0x426683
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x426680
cmp esi, edi
jle 0x4266fb
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x4266a3
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x54], edi
jmp 0x4266fb
cmp ax, 0x3d
jne 0x4266af
mov byte [ebp + 0x71], 1
jmp 0x4266b9
cmp ax, 0x24
jne 0x4266c1
mov byte [ebp + 0x73], 2
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x54], edi
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.004129ca
add esp, 4
test al, al
je 0x4266e3
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044957c
pop ecx
pop ecx
dec esi
cmp esi, edi
jle 0x4266fb
cmp byte [ebp + 0x73], 0
jne 0x4266fb
push esi
push dword [ebp + 0x54]
call fcn.0041137d
pop ecx
pop ecx
mov dword [ebp + 0x54], eax
or dword [ebp + 0x28], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x42671c
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x426720
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.004129ca
add esp, 4
test al, al
je 0x42673f
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044957c
pop ecx
pop ecx
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x14], edi
lea edi, [ebp + 0x14]
je 0x42674e
lea edi, [ebp + 0x54]
xor ebx, ebx
cmp byte [ebp + 0x73], bl
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x58], ebx
jne 0x426767
cmp dword [ebp + 0x54], ebx
jne 0x426772
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x54], ebx
je 0x42679e
cmp byte [ebp + 0x73], 0
jne 0x42679e
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x54]
push ebx
push 0x100000
je 0x426789
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x42678f
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x42679e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.0043dd9c
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004464e8
push 0x5c
push dword [ebp + 0x2c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
lea ecx, [ebp + 0x1c]
call fcn.0043dfec
mov dword [ebp + 0x3c], ebx
jmp 0x42692a
cmp byte [0x4bf2c0], 0
jle 0x42693e
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426851
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044957c
cmp dword [ebp + 0x30], ebx
pop ecx
pop ecx
jge 0x42692a
mov dword [ebp + 0x30], ebx
jmp 0x42692a
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x426909
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x34], eax
push 1
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.00419202
add esp, 0xc
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x7c], eax
call fcn.0043dd7e
lea ecx, [ebp + 0x5c]
call fcn.0043dd7e
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x5c]
push dword [ebp + 0x34]
call fcn.0043dea2
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x5c]
call fcn.004119b4
pop ecx
pop ecx
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
cmp dword [ebp + 0x4c], ebx
jle 0x4268f7
push 4
call fcn.00493048
cmp eax, ebx
pop ecx
je 0x4268db
mov ecx, dword [ebp + 0x60]
mov dword [eax], ecx
mov dword [ebp + 0x60], ebx
mov esi, eax
jmp 0x4268dd
xor esi, esi
push 4
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x24]
call fcn.0043dfaf
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x24]
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
lea ecx, [ebp + 0x60]
call fcn.00437e1a
jmp 0x42692a
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x426938
lea eax, [ebp + 0x7c]
push eax
call fcn.00405196
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x42680d
jmp 0x42693e
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x3c], eax
cmp byte [ebp + 0x67], 0
je 0x426947
neg dword [ebp + 0x68]
cmp dword [ebp + 0x40], ebx
jne 0x426959
cmp dword [edi], ebx
je 0x426959
push dword [ebp + 0x44]
call fcn.004104c6
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], 0
je 0x4269ef
jmp 0x4269e6
cmp dword [ebp + 0x68], 0
je 0x4269ef
mov edi, 0x3e8
jle 0x42698f
call ebx
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x4269ef
cmp ecx, edi
jge 0x42698f
mov edi, ecx
push 0x4ff
push edi
push 0
push dword [ebp + 0x48]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x4269ef
push 0x64
pop edi
jmp 0x4269dd
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4269e6
dec edi
je 0x4269e6
cmp dword [ebp - 4], 0x12
je 0x4269e6
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4bf2c0], 0
jg 0x4269ab
cmp byte [0x4bf2c0], 0
jg 0x426971
xor esi, esi
cmp dword [ebp + 0x28], esi
jl 0x426a14
cmp byte [ebp + 0x72], 0
je 0x426a07
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x426a14
mov ecx, dword [ebp + 0x6c]
push esi
push esi
push dword [ebp + 0x28]
call fcn.00413b53
cmp dword [ebp + 0x24], esi
jle 0x426add
cmp byte [0x4bf2c0], 0
jle 0x426add
cmp dword [ebp + 0x40], 0
jne 0x426a39
push dword [ebp + 0x44]
call fcn.004104c6
pop ecx
cmp dword [ebp + 0x24], 0
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x5c], eax
jle 0x426add
cmp byte [0x4bf2c0], 0
jle 0x426add
mov eax, dword [ebp + 0x24]
xor edi, edi
cmp eax, edi
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x60], eax
jle 0x426add
cmp byte [0x4bf2c0], 0
jle 0x426abf
mov eax, dword [ebp + 0x5c]
lea esi, [eax + edi*4]
mov eax, dword [esi]
test eax, eax
je 0x426ab9
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.00414fae
mov eax, dword [esi]
push dword [eax]
call fcn.00492626
test edx, edx
pop ecx
jg 0x426ab3
jl 0x426a9a
test eax, eax
ja 0x426ab3
mov ebx, dword [esi]
test ebx, ebx
je 0x426aae
mov ecx, ebx
call fcn.00437e1a
push ebx
call fcn.00492f44
pop ecx
and dword [esi], 0
jmp 0x426ab9
lea eax, [edi + 1]
mov dword [ebp + 0x34], eax
inc edi
cmp edi, dword [ebp + 0x60]
jl 0x426a65
mov esi, dword [ebp + 0x34]
test esi, esi
jle 0x426add
mov ecx, dword [ebp + 0x6c]
push 0
push 0
push dword [ebp + 0x30]
call fcn.00413b53
mov dword [ebp + 0x24], esi
jmp 0x426a49
xor esi, esi
cmp dword [ebp + 0x40], esi
jne 0x426af4
mov eax, dword [ebp + 0x48]
cmp dword [eax], esi
je 0x426af4
push dword [ebp + 0x2c]
call fcn.004104c6
pop ecx
mov eax, dword [ebp + 0x3c]
cmp eax, esi
je 0x426b0f
cmp word [eax], si
je 0x426b0f
mov ecx, dword [ebp + 0x6c]
push esi
push esi
push esi
push eax
call fcn.0042d06c
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x1c]
call fcn.0041cbd9
lea ecx, [ebp + 0x2c]
call fcn.00437e1a
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x14]
call fcn.00402b5a
cmp byte [ebp + 0x53], 0
je 0x426b5f
call fcn.004194a5
test eax, eax
je 0x426b57
push dword [ebp + 0x6c]
call fcn.004110a4
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.004194d1
pop ecx
pop ecx
push 0
call fcn.00414752
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.004628c6
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4