Function at 0x4298e0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x5d7ce0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Wow64DisableWow64FsRedirection
xor esi, esi
push str.kernel32
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
cmp eax, esi
je 0x429934
lea ecx, [ebp - 0x30]
push ecx
call eax
mov dword [ebp - 4], esi
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x429951
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x42997e
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4299ab
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4299d8
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 4
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x429a05
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
push 1
lea ecx, [ebp - 0x14]
push ecx
push ecx
mov byte [ebp - 4], 5
mov ebx, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x2c], ebx
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x429a41
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.strServicePath
mov byte [ebp - 4], 6
test ecx, 0xffff0000
jne 0x429a7a
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
cmp eax, esi
je 0x429a88
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x429a88
push 0xe
push str.strServicePath
mov ecx, ebx
call fcn.00407870
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov edi, esi
mov byte [ebp - 4], 5
call fcn.0043b9d0
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x429b65
mov ecx, 0xa0000001
lea esi, [ebp - 0x2c]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429ae4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429b10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
jmp 0x42a3c9
push 1
lea ecx, [ebp - 0x1c]
push ecx
push ecx
mov ebx, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x2c], ebx
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x429b8e
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.strServiceName
mov byte [ebp - 4], 8
test ecx, 0xffff0000
jne 0x429bc7
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x429bd5
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x429bd5
push 0xe
push str.strServiceName
mov ecx, ebx
call fcn.00407870
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push eax
mov edi, esi
mov byte [ebp - 4], 5
call fcn.0043b9d0
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x429cb4
mov ecx, 0xa0000001
lea esi, [ebp - 0x2c]
call fcn.0041ae20
mov ecx, dword [ebp + 0x14]
push eax
mov byte [ebp - 4], 9
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429c2f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429c5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429c7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
jmp 0x42a3c9
push 1
lea ecx, [ebp - 0x10]
push ecx
push ecx
mov ebx, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x2c], ebx
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x429cdd
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.strServiceDispName
mov byte [ebp - 4], 0xa
test ecx, 0xffff0000
jne 0x429d16
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x429d24
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x429d24
push 0x12
push str.strServiceDispName
mov ecx, ebx
call fcn.00407870
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push eax
mov edi, esi
mov byte [ebp - 4], 5
call fcn.0043b9d0
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x429e03
mov ecx, 0xa0000001
lea esi, [ebp - 0x2c]
call fcn.0041ae20
mov ecx, dword [ebp + 0x14]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429d7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429daa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429dcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
jmp 0x42a3c9
push 1
lea ecx, [ebp - 0x24]
push ecx
push ecx
mov ebx, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x2c], ebx
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x429e2c
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.dwStartType
mov byte [ebp - 4], 0xc
test ecx, 0xffff0000
jne 0x429e65
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x429e73
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x429e73
push 0xb
push str.dwStartType
mov ecx, ebx
call fcn.00407870
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push eax
mov edi, esi
mov byte [ebp - 4], 5
call fcn.0043b9d0
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x429f52
mov ecx, 0xa0000001
lea esi, [ebp - 0x2c]
call fcn.0041ae20
mov ecx, dword [ebp + 0x14]
push eax
mov byte [ebp - 4], 0xd
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429ecd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429ef9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429f1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
jmp 0x42a3c9
lea ecx, [ebp - 0x18]
push ecx
push ecx
mov ebx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2c], ebx
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x429f79
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.DWORD
mov byte [ebp - 4], 0xe
test ecx, 0xffff0000
jne 0x429fb2
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x429fc0
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x429fc0
push 5
push str.DWORD
mov ecx, ebx
call fcn.00407870
mov byte [ebp - 4], 0xf
mov esi, dword [ebp - 0x24]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
mov dword [ebp - 0x2c], esp
mov edi, esp
mov dword [ebp - 0x2c], esi
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x429ff7
cmp eax, dword [esi]
jne 0x429ff7
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42a033
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
jne 0x42a010
call fcn.0043d450
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add ebx, 0x10
mov dword [edi], ebx
mov byte [ebp - 4], 5
call fcn.0044bce0
add esp, 0xc
push 1
lea edx, [ebp - 0x20]
push edx
push ecx
mov ebx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x18], ebx
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42a06d
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.iSystemBits
mov byte [ebp - 4], 0x10
test ecx, 0xffff0000
jne 0x42a0a6
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x42a0b4
push edi
push eax
mov ecx, ebx
call fcn.004074b0
jmp 0x42a0b4
push 0xb
push str.iSystemBits
mov ecx, ebx
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 5
call fcn.0043b9d0
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x42a190
mov ecx, 0xa0000001
lea esi, [ebp - 0x28]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a10e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a13a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a15a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
jmp 0x42a3c9
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.0054df0d
add esp, 4
cmp dword [0x5d9fb8], 0
mov edi, eax
je 0x42a1ec
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42a1e2
lea ecx, [ebp - 0x58]
push ecx
call eax
mov ax, word [ebp - 0x58]
cmp ax, 9
je 0x42a1d8
cmp ax, 6
jne 0x42a1e2
mov dword [0x5e0c44], 1
mov dword [0x5d9fb8], 0
test edi, edi
je 0x42a1fe
cmp edi, 1
jne 0x42a251
cmp dword [0x5e0c44], 0
jne 0x42a25f
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [ebp - 0x1c]
mov ebx, eax
test ebx, ebx
je 0x42a2d9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
push 0
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push edx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x42a2ac
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 1
jmp 0x42a2b7
cmp edi, 2
jne 0x42a25f
cmp dword [0x5e0c44], 0
jne 0x42a1fe
lea eax, [ebx - 0x10]
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a286
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b33
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x429b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
xor esi, esi
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
jne 0x42a33f
cmp dword [ebp - 0x28], 0x431
mov eax, dword [ebp + 0x10]
jne 0x42a2eb
mov dword [eax], 1
jmp 0x42a2f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
jmp 0x42a2c5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
call fcn.0041ae20
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x2c]
push edx
push edi
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00409220
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a35c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42a35c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx], 2
mov eax, dword [edx + 0x30]
push edi
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00409220
add esp, 0xc
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a37f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a39f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a3c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a3e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a405
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], 0
je 0x42a433
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42a433
mov ecx, dword [ebp - 0x30]
push ecx
call eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret