Function at 0x41f4d0
Capabilities:
Check for time delay via gettickcount
Check http status code
Check os version
Query or enumerate registry value
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x44f9aa
mov eax, dword fs:[0]
push eax
sub esp, 0x934
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x930], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x948]
mov dword fs:[0], eax
mov eax, dword [esp + 0x958]
mov dword [esp + 0x1c], eax
mov ebx, ecx
mov eax, dword [esp + 0x960]
mov esi, pe_nt_image_headers32
mov dword [esp + 0x24], 0
cmp dword [esp + 0x974], esi
jae 0x41f53c
lea eax, [esp + 0x960]
lea ecx, [esp + 0x24]
push ecx
push 0xf003f
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, eax
call fcn.0042f890
mov dword [esp + 0x950], 1
cmp ebp, 2
jne 0x41f6f8
mov eax, dword [esp + 0x960]
cmp dword [esp + 0x974], esi
jae 0x41f582
lea eax, [esp + 0x960]
push 0
lea edx, [esp + 0x28]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, eax
mov eax, dword [esp + 0x960]
cmp dword [esp + 0x974], esi
jae 0x41f5b7
lea eax, [esp + 0x960]
push eax
push ebx
lea eax, [esp + 0xa0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x48], esp
cmp eax, 0x10
jb 0x41f5ea
mov ecx, dword [edi]
jmp 0x41f5ec
mov ecx, edi
cmp ecx, 0x455458
ja 0x41f627
cmp eax, 0x10
jb 0x41f5fd
mov ecx, dword [edi]
jmp 0x41f5ff
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455458
jbe 0x41f627
cmp eax, 0x10
jb 0x41f613
mov edi, dword [edi]
push 0x39
mov eax, 0x455458
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41f66b
cmp eax, 0x39
jae 0x41f639
mov ecx, dword [esi + 0x14]
push ecx
push 0x39
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41f645
mov eax, dword [edi]
jmp 0x41f647
mov eax, edi
push 0x39
push 0x455458
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x39
jb 0x41f667
mov edi, dword [edi]
mov byte [edi + 0x39], 0
lea esi, [esp + 0x68]
call fcn.004014c0
mov byte [esp + 0x95c], 4
call fcn.00401770
mov esi, pe_nt_image_headers32
mov byte [esp + 0x958], 5
cmp dword [eax + 0x18], esi
jb 0x41f698
mov eax, dword [eax + 4]
jmp 0x41f69b
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x14
cmp dword [esp + 0xb0], esi
jb 0x41f6c4
mov eax, dword [esp + 0x9c]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
mov byte [esp + 0x950], 1
call fcn.00429620
mov esi, pe_nt_image_headers32
cmp ebp, 5
jne 0x41f877
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41f716
sub eax, 2
je 0x41f716
sub eax, 4
jne 0x41f729
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00401440
mov eax, dword [esp + 0x960]
cmp dword [esp + 0x974], esi
jae 0x41f740
lea eax, [esp + 0x960]
push eax
push ebx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, pe_nt_image_headers32
lea ebx, [esp + 0xbc]
mov dword [esp + 0x44], esp
cmp eax, ebp
jb 0x41f776
mov ecx, dword [edi]
jmp 0x41f778
mov ecx, edi
cmp ecx, 0x455494
ja 0x41f7b1
cmp eax, ebp
jb 0x41f788
mov ecx, dword [edi]
jmp 0x41f78a
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455494
jbe 0x41f7b1
cmp eax, ebp
jb 0x41f79d
mov edi, dword [edi]
push 0x3c
mov eax, 0x455494
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41f7f3
cmp eax, 0x3c
jae 0x41f7c3
mov ecx, dword [esi + 0x14]
push ecx
push 0x3c
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41f7ce
mov eax, dword [edi]
jmp 0x41f7d0
mov eax, edi
push 0x3c
push 0x455494
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x3c
cmp dword [esi + 0x18], ebp
jb 0x41f7ef
mov edi, dword [edi]
mov byte [edi + 0x3c], 0
lea esi, [esp + 0x64]
call fcn.004014c0
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x958], 6
call fcn.00401a50
mov byte [esp + 0x958], 7
cmp dword [eax + 0x18], ebp
jb 0x41f81f
mov eax, dword [eax + 4]
jmp 0x41f822
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x14
cmp dword [esp + 0xb0], ebp
jb 0x41f84b
mov eax, dword [esp + 0x9c]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
call fcn.00429620
jmp 0x4201ac
test ebp, ebp
je 0x41f99a
mov eax, dword [esp + 0x960]
cmp dword [esp + 0x974], esi
jae 0x41f896
lea eax, [esp + 0x960]
push eax
push ebx
push ebp
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebx, [esp + 0xc0]
mov dword [esp + 0x48], esp
cmp eax, 0x10
jb 0x41f8c9
mov ecx, dword [edi]
jmp 0x41f8cb
mov ecx, edi
cmp ecx, 0x4554d8
ja 0x41f906
cmp eax, 0x10
jb 0x41f8dc
mov ecx, dword [edi]
jmp 0x41f8de
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4554d8
jbe 0x41f906
cmp eax, 0x10
jb 0x41f8f2
mov edi, dword [edi]
push 0x3f
mov eax, 0x4554d8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41f94a
cmp eax, 0x3f
jae 0x41f918
mov ecx, dword [esi + 0x14]
push ecx
push 0x3f
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41f924
mov eax, dword [edi]
jmp 0x41f926
mov eax, edi
push 0x3f
push 0x4554d8
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3f
jb 0x41f946
mov edi, dword [edi]
mov byte [edi + 0x3f], 0
lea esi, [esp + 0x68]
call fcn.004014c0
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x95c], 8
call fcn.00401a50
mov esi, pe_nt_image_headers32
mov byte [esp + 0x95c], 9
cmp dword [eax + 0x18], esi
jb 0x41f97b
mov eax, dword [eax + 4]
jmp 0x41f97e
add eax, 4
mov edx, dword [esp + 0x28]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x18
cmp dword [esp + 0xb0], esi
jmp 0x41f839
cmp dword [esp + 0x24], 0
je 0x4201bb
xor edi, edi
mov eax, 0xf
mov dword [esp + 0x38], edi
mov dword [esp + 0xd0], eax
mov dword [esp + 0xcc], edi
mov byte [esp + 0xbc], 0
mov dword [esp + 0xec], eax
mov dword [esp + 0xe8], edi
mov byte [esp + 0xd8], 0
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], edi
mov byte [esp + 0xf4], 0
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], edi
mov byte [esp + 0x110], 0
mov esi, dword [esp + 0x994]
mov byte [esp + 0x950], 0xa
mov dword [esp + 0x134], esi
mov dword [esp + 0x130], edi
mov dword [esp + 0x13c], 1
mov dword [esp + 0xb4], ebx
call fcn.00417d60
mov ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x90
jle 0x41fa6c
push 0x90
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406fe0
call fcn.00418a10
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x964]
push edx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x144], edi
call fcn.00402d10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41faa3
sub eax, 2
je 0x41faa3
sub eax, 4
je 0x41faa3
xor eax, eax
jmp 0x41fab3
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, 1
sub eax, 1
jne 0x41fac2
call fcn.00418a60
call fcn.004353a0
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x980]
push eax
lea ecx, [esp + 0xe0]
call fcn.00402d10
cmp esi, edi
je 0x41fdc1
push 0x3ff
lea ecx, [esp + 0x149]
push edi
push ecx
mov byte [esp + 0x150], 0
call fcn.0043e780
add esp, 0xc
mov dword [esp + 0x2c], 0x400
call fcn.00417c50
test eax, eax
je 0x41fb1a
call fcn.00406c60
call fcn.004197b0
mov eax, dword [esp + 0x97c]
mov ebp, pe_nt_image_headers32
cmp dword [esp + 0x990], ebp
jae 0x41fb36
lea eax, [esp + 0x97c]
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x148]
push ecx
push edi
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x41ffe9
lea eax, [esp + 0x144]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fb63
sub eax, edx
je 0x41ffe9
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], edi
mov byte [esp + 0x9c], cl
lea eax, [esp + 0x98]
push eax
sub esp, 0x1c
mov ebx, 0xb
mov byte [esp + 0x970], bl
lea edx, [esp + 0x164]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
lea esi, [esp + 0x44]
call fcn.00402b30
mov eax, dword [esp + 0x3c]
push eax
mov ecx, esi
call fcn.0040f5e0
cmp eax, edi
jge 0x41fbe2
lea ecx, [esp + 0x98]
mov byte [esp + 0x950], 0xa
call fcn.00402ba0
jmp 0x41ffe9
call fcn.0042f950
sub eax, 1
jne 0x41fc03
call fcn.00418b30
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00417a90
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0xa0]
push ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x95c], ebx
call fcn.00402d10
call fcn.00417c90
sub esp, 0x1c
mov dword [esp + 0x96c], ebx
lea edx, [esp + 0x160]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402b30
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xd0]
push eax
push ecx
call fcn.00420920
cmp eax, edi
jge 0x41fc77
lea ecx, [esp + 0x98]
mov byte [esp + 0x950], 0xa
call fcn.00402ba0
jmp 0x41ffe9
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, 2
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
je 0x41fc98
sub eax, 2
je 0x41fc98
sub eax, 4
je 0x41fc98
xor eax, eax
jmp 0x41fca0
push edi
call esi
mov eax, 1
sub eax, 1
jne 0x41fcaf
call fcn.00418790
call fcn.00406c60
call ebx
sub eax, 2
je 0x41fcc4
sub eax, 2
je 0x41fcc4
sub eax, 4
je 0x41fcc4
xor ecx, ecx
jmp 0x41fccc
push edi
call esi
mov ecx, 1
mov eax, 0x1948b0fd
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x51
jle 0x41fcf4
push 0x51
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401440
call fcn.00418c00
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402b70
mov eax, dword [esp + 0x38]
push eax
call fcn.0041ba90
cmp eax, edi
jl 0x41fd20
mov dword [esp + 0x38], 1
lea ecx, [esp + 0x98]
mov byte [esp + 0x950], 0xa
call fcn.00402ba0
cmp dword [esp + 0x38], edi
jne 0x420538
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xb4]
push ecx
push edi
call fcn.00421eb0
test eax, eax
jge 0x4205b8
mov eax, dword [esp + 0x110]
mov ebx, pe_nt_image_headers32
cmp dword [esp + 0x124], ebx
jae 0x41fd74
lea eax, [esp + 0x110]
push eax
lea edx, [esp + 0x9c]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x45
mov ecx, 0x455690
call fcn.00404250
lea esi, [esp + 0x64]
call fcn.004014c0
mov byte [esp + 0x958], 0x25
call fcn.004018b0
mov byte [esp + 0x954], 0x26
cmp dword [eax + 0x18], ebx
jb 0x42056f
mov eax, dword [eax + 4]
jmp 0x420572
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x34], edi
mov byte [esp + 0x2b], 0
mov edi, edi
mov ebx, dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x3ff
xor edi, edi
lea ecx, [esp + 0x149]
push edi
push ecx
mov esi, 0x400
mov byte [esp + 0x150], 0
call fcn.0043e780
add esp, 0xc
push 0x3ff
lea edx, [esp + 0x549]
push edi
push edx
mov byte [esp + 0x550], 0
call fcn.0043e780
lea eax, [esp + 0x37]
add esp, 0xc
mov dword [esp + 0x20], esi
mov dword [esp + 0x3c], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fe28
sub eax, edx
je 0x41fe4d
call ebx
mov esi, dword [sym.imp.USER32.dll_GetCapture]
call esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call ebx
call esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x548]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x40]
push edi
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x158]
push ecx
push edx
push eax
mov dword [esp + 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
jne 0x41ffe4
cmp dword [esp + 0x2c], 1
jne 0x41ffce
lea eax, [esp + 0x144]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fea0
sub eax, edx
je 0x41ffce
lea eax, [esp + 0x544]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fec0
sub eax, edx
je 0x41ffce
call fcn.00417b90
test eax, eax
je 0x41fedd
call fcn.00418cd0
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
lea eax, [esp + 0x17]
mov byte [esp + 0x950], 0x10
mov byte [esp + 0x17], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ff10
sub eax, edx
je 0x41ff20
call fcn.00418d40
lea ecx, [esp + 0x18]
push ecx
sub esp, 0x1c
lea edx, [esp + 0x164]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
lea ebx, [esp + 0xbc]
call fcn.00402b30
mov esi, ebp
call fcn.0040f4d0
mov esi, eax
call fcn.00417c50
sub eax, 1
jne 0x41ff5f
call fcn.00418790
call fcn.00435230
call fcn.00417c10
test eax, eax
je 0x41ff72
call fcn.00418790
call fcn.00435230
test esi, esi
jl 0x41ffba
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xfc]
call fcn.00402d10
sub esp, 0x1c
lea edx, [esp + 0x560]
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00402b30
lea eax, [esp + 0xd0]
push eax
push ebp
call fcn.00420920
test eax, eax
jge 0x420067
lea ecx, [esp + 0x98]
mov byte [esp + 0x950], 0xa
call fcn.00402ba0
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
cmp eax, 0xc8
jb 0x41fdd0
xor edi, edi
mov ebp, pe_nt_image_headers32
mov ebx, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x30]
lea ecx, [esp + 0xb8]
call fcn.004211d0
cmp eax, edi
jge 0x42023c
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x42001d
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x49
mov ecx, 0x455518
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x13
call fcn.00401a50
mov byte [esp + 0x954], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x4200ba
mov eax, dword [eax + 4]
jmp 0x4200bd
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402b70
push ebp
call fcn.0041ba90
mov esi, eax
call fcn.00417bd0
test eax, eax
je 0x420093
call fcn.00418e10
test esi, esi
jl 0x42009f
mov dword [esp + 0x38], 1
lea ecx, [esp + 0x98]
mov byte [esp + 0x950], 0xa
call fcn.00402ba0
xor edi, edi
jmp 0x41fd34
add eax, 4
push eax
mov eax, dword [esp + 0x24]
push 1
push eax
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
call fcn.00429620
call fcn.00417c50
mov dword [esp + 0x950], 0xa
lea edi, [esp + 0xf0]
call fcn.00429ca0
lea edi, [esp + 0x10c]
call fcn.00429ca0
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420116
sub eax, edx
mov ecx, 0
setne cl
mov eax, 0x82082083
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x3f
jle 0x420151
push 0x3f
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406fe0
call fcn.00418a10
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x980]
push edx
lea ecx, [esp + 0xe0]
mov dword [esp + 0x138], 0
call fcn.00402d10
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x128], 0xffffffff
lea eax, [esp + 0xb4]
push eax
lea ebx, [esi + 0x2d8]
call fcn.0042a1d0
push 0
call fcn.00439283
add esp, 4
lea esi, [esp + 0xb4]
call fcn.004208a0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4201bb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x974], esi
jb 0x4201d9
mov ecx, dword [esp + 0x960]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x974], 0xf
mov dword [esp + 0x970], 0
mov byte [esp + 0x960], 0
cmp dword [esp + 0x990], esi
jb 0x420210
mov edx, dword [esp + 0x97c]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x948]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x930]
xor ecx, esp
call fcn.00437983
add esp, 0x940
ret 0x40
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402b70
mov eax, dword [esp + 0x48]
push eax
push ebx
call fcn.0040e230
cmp eax, edi
jge 0x4202ee
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x42027c
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x9c]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x46
mov ecx, 0x455568
call fcn.00404250
lea esi, [esp + 0x64]
call fcn.004014c0
mov byte [esp + 0x958], 0x19
call fcn.00401770
mov byte [esp + 0x954], 0x1a
cmp dword [eax + 0x18], ebp
jb 0x4202c2
mov eax, dword [eax + 4]
jmp 0x4202c5
add eax, 4
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
mov byte [esp + 0x950], 0xa
call fcn.00429620
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402b70
push ebx
call fcn.0041ba90
cmp eax, edi
jge 0x420504
cmp dword [esp + 0x124], 0x10
mov eax, dword [esp + 0x110]
jae 0x42032a
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x40
mov ecx, 0x4555b0
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x1b
call fcn.00401640
mov ebp, pe_nt_image_headers32
mov byte [esp + 0x954], 0x1c
cmp dword [eax + 0x18], ebp
jb 0x420378
mov eax, dword [eax + 4]
jmp 0x42037b
add eax, 4
mov ebx, dword [esp + 0x20]
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
mov byte [esp + 0x950], 0xa
call fcn.00429620
push ebx
lea edx, [esp + 0x30]
lea ecx, [esp + 0xb8]
call fcn.004211d0
test eax, eax
jge 0x42044f
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x4203d8
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x49
mov ecx, 0x4555f8
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x1d
call fcn.00401a50
mov byte [esp + 0x954], 0x1e
cmp dword [eax + 0x18], ebp
jb 0x420421
mov eax, dword [eax + 4]
jmp 0x420424
add eax, 4
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
call fcn.00429620
call fcn.00417930
jmp 0x4200e7
sub esp, 0x1c
lea eax, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402b70
push ebx
call fcn.0041ba90
test eax, eax
jge 0x420504
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x42048a
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x40
mov ecx, 0x455648
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x23
call fcn.00401a50
mov byte [esp + 0x954], 0x24
cmp dword [eax + 0x18], ebp
jb 0x4204d3
mov eax, dword [eax + 4]
jmp 0x4204d6
add eax, 4
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
mov byte [esp + 0x950], 0xa
call fcn.00429620
jmp 0x4200f2
call fcn.00417cd0
test eax, eax
je 0x420512
call fcn.00406c60
cmp dword [esp + 0x13c], 0
je 0x4200f2
mov edi, dword [esp + 0x24]
lea esi, [esp + 0xb4]
call fcn.00421e40
test eax, eax
jl 0x4200f2
mov ecx, dword [esp + 0x110]
mov eax, pe_nt_image_headers32
cmp dword [esp + 0x124], eax
jae 0x420554
lea ecx, [esp + 0x110]
mov esi, dword [esp + 0x1c]
cmp dword [esi + 0x25c], eax
jb 0x420872
mov eax, dword [esi + 0x248]
jmp 0x420878
add eax, 4
push eax
push 1
push edi
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
mov byte [esp + 0x950], 0xa
call fcn.00429620
call fcn.00417c50
sub eax, 1
jne 0x4200f2
call fcn.00418790
call fcn.00418a10
jmp 0x4200f2
sub esp, 0x1c
lea eax, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402b70
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
mov byte [esp + 0x98c], 0x27
call fcn.00402b70
mov ecx, edi
mov byte [esp + 0x988], 0xa
call fcn.0040e0b0
test eax, eax
jge 0x420699
mov eax, dword [esp + 0x110]
mov ebx, pe_nt_image_headers32
cmp dword [esp + 0x124], ebx
jae 0x42061f
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x9c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x46
mov ecx, 0x4556d8
call fcn.00404250
lea esi, [esp + 0x64]
call fcn.004014c0
mov byte [esp + 0x958], 0x28
call fcn.00401580
mov byte [esp + 0x954], 0x29
cmp dword [eax + 0x18], ebx
jb 0x420665
mov eax, dword [eax + 4]
jmp 0x420668
add eax, 4
push eax
push 1
push edi
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
call fcn.00429620
call fcn.00417b90
mov dword [esp + 0x950], 0xa
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402b70
push edi
call fcn.0041ba90
mov esi, eax
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4206c3
sub eax, edx
je 0x4206d3
call fcn.00418790
test esi, esi
jge 0x420538
cmp dword [esp + 0x124], 0x10
mov eax, dword [esp + 0x110]
jae 0x4206f3
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x40
mov ecx, str._DRTSN:
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x2c
call fcn.00401a50
mov ebp, pe_nt_image_headers32
mov byte [esp + 0x954], 0x2d
cmp dword [eax + 0x18], ebp
jb 0x420741
mov eax, dword [eax + 4]
jmp 0x420744
add eax, 4
mov ebx, dword [esp + 0x20]
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00402ba0
lea esi, [esp + 0x40]
mov byte [esp + 0x950], 0xa
call fcn.00429620
lea eax, [esp + 0xb4]
push eax
push ebx
call fcn.00421eb0
test eax, eax
jge 0x4207ea
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x42079a
lea eax, [esp + 0x110]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x45
mov ecx, 0x455768
lea edi, [esp + 0xbc]
call fcn.00404250
lea esi, [esp + 0x60]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x954], 0x2e
call fcn.00401640
mov byte [esp + 0x954], 0x2f
cmp dword [eax + 0x18], ebp
jb 0x4204d3
mov eax, dword [eax + 4]
jmp 0x4204d6
sub esp, 0x1c
lea edx, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402b70
push ebx
call fcn.0041ba90
test eax, eax
jge 0x420538
mov eax, dword [esp + 0x110]
cmp dword [esp + 0x124], ebp
jae 0x420825
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x9c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x40
mov ecx, 0x4557b0
call fcn.00404250
lea esi, [esp + 0x64]
call fcn.004014c0
mov byte [esp + 0x958], 0x30
call fcn.00401770
mov byte [esp + 0x954], 0x31
cmp dword [eax + 0x18], ebp
jb 0x4204d3
mov eax, dword [eax + 4]
jmp 0x4204d6
lea eax, [esi + 0x248]
push ecx
push eax
call fcn.004394ce
add esp, 8
test eax, eax
jne 0x420183
mov dword [esp + 0x130], 1
jmp 0x420183