Function at 0x424ae0
Capabilities:
Check os version
Delete file
Query or enumerate registry value
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x44ebd1
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x518], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x530]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x3a0]
mov dword [esp + 0x44], ecx
cmp eax, 6
jbe 0x424b43
mov dword [ecx + 0x3a0], 0
mov dword [ecx + 0x39c], 1
jmp 0x4258f1
inc eax
mov dword [ecx + 0x3a0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
mov ebp, 0
je 0x424b64
sub eax, 2
je 0x424b64
sub eax, 4
jne 0x424b70
push ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.004353a0
mov edi, 0xf
mov dword [esp + 0x24], ebp
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jg 0x424bb4
mov eax, esi
cdq
idiv esi
cmp edx, ebp
je 0x424bb9
call fcn.00419390
mov dword [esp + 0xb8], edi
mov dword [esp + 0xb4], ebp
mov byte [esp + 0xa4], 0
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
lea edx, [esp + 0x18]
cmp eax, edx
jle 0x424bea
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x424bee
push 0xe
call esi
mov dword [esp + 0x538], 1
mov eax, 0xf
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd0], ebp
mov byte [esp + 0xc0], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push ebp
lea edx, [esp + 0x34]
push edx
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x564], 4
mov dword [esi + 0x18], eax
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x424c4e
mov ecx, dword [edi]
jmp 0x424c50
mov ecx, edi
cmp ecx, 0x455b68
ja 0x424c89
cmp eax, ebx
jb 0x424c60
mov ecx, dword [edi]
jmp 0x424c62
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455b68
jbe 0x424c89
cmp eax, ebx
jb 0x424c75
mov edi, dword [edi]
push 0x41
mov eax, 0x455b68
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x424ccb
cmp eax, 0x41
jae 0x424c9b
mov ecx, dword [esi + 0x14]
push ecx
push 0x41
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x424ca6
mov eax, dword [edi]
jmp 0x424ca8
mov eax, edi
push 0x41
push 0x455b68
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x41
cmp dword [esi + 0x18], ebx
jb 0x424cc7
mov edi, dword [edi]
mov byte [edi + 0x41], 0
lea esi, [esp + 0x74]
call fcn.004014c0
mov byte [esp + 0x548], 5
call fcn.00401770
cmp dword [eax + 0x18], ebx
jb 0x424ceb
mov eax, dword [eax + 4]
jmp 0x424cee
add eax, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp dword [esp + 0x40], ebx
jb 0x424d0f
mov edx, dword [esp + 0x2c]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
cmp edi, ebp
jne 0x4251ed
cmp dword [esp + 0x24], 0
je 0x4251fc
push 0x3ff
lea eax, [esp + 0x131]
push 0
push eax
mov byte [esp + 0x138], 0
call fcn.0043e780
add esp, 0xc
mov dword [esp + 0x18], 0x400
call fcn.0042f950
test eax, eax
je 0x424d79
call fcn.00435230
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x130]
push edx
push 0
push 0
lea eax, [esp + 0x38]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, pe_nt_image_headers32
mov dword [esp + 0x4c], esp
cmp eax, ebp
jb 0x424dbc
mov ecx, dword [edi]
jmp 0x424dbe
mov ecx, edi
cmp ecx, 0x455bac
ja 0x424df7
cmp eax, ebp
jb 0x424dce
mov ecx, dword [edi]
jmp 0x424dd0
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455bac
jbe 0x424df7
cmp eax, ebp
jb 0x424de3
mov edi, dword [edi]
push 0x12
mov eax, 0x455bac
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x424e39
cmp eax, 0x12
jae 0x424e09
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x424e14
mov eax, dword [edi]
jmp 0x424e16
mov eax, edi
push 0x12
push 0x455bac
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x12
cmp dword [esi + 0x18], ebp
jb 0x424e35
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x78]
call fcn.004014c0
mov byte [esp + 0x54c], 6
call fcn.00401580
cmp dword [eax + 0x18], ebp
jb 0x424e59
mov eax, dword [eax + 4]
jmp 0x424e5c
add eax, 4
mov edx, dword [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push edx
call ebx
mov edi, eax
cmp dword [esp + 0x40], ebp
jb 0x424e7f
mov eax, dword [esp + 0x2c]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
test edi, edi
jne 0x424ebd
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0xdc]
call fcn.00402df0
push 0x400
lea edx, [esp + 0x130]
push 0
push edx
mov dword [esp + 0x24], 0x400
call fcn.0043e780
add esp, 0xc
call fcn.00417960
test eax, eax
je 0x424eea
call fcn.00406c60
lea eax, [esp + 0x23]
mov byte [esp + 0x23], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424ef6
sub eax, edx
mov ecx, 0
setne cl
mov eax, 0x82082083
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x7e
jle 0x424f3e
push 0x7e
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00406c60
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x130]
push edx
push 0
push 0
lea eax, [esp + 0x38]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x4c], esp
cmp eax, ebp
jb 0x424f7c
mov ecx, dword [edi]
jmp 0x424f7e
mov ecx, edi
cmp ecx, 0x455bc0
ja 0x424fb7
cmp eax, ebp
jb 0x424f8e
mov ecx, dword [edi]
jmp 0x424f90
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455bc0
jbe 0x424fb7
cmp eax, ebp
jb 0x424fa3
mov edi, dword [edi]
push 0x12
mov eax, 0x455bc0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x424ff9
cmp eax, 0x12
jae 0x424fc9
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x424fd4
mov eax, dword [edi]
jmp 0x424fd6
mov eax, edi
push 0x12
push 0x455bc0
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x12
cmp dword [esi + 0x18], ebp
jb 0x424ff5
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x78]
call fcn.004014c0
mov byte [esp + 0x54c], 7
call fcn.00401580
cmp dword [eax + 0x18], ebp
jb 0x425019
mov eax, dword [eax + 4]
jmp 0x42501c
add eax, 4
mov edx, dword [esp + 0x34]
push eax
push edx
call ebx
mov edi, eax
cmp dword [esp + 0x40], ebp
jb 0x425039
mov eax, dword [esp + 0x2c]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
test edi, edi
jne 0x42508b
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0xa4]
call fcn.00402df0
call fcn.00417a90
sub eax, 1
jne 0x42508b
call fcn.00419460
call fcn.00419530
push 0x400
lea edx, [esp + 0x130]
push 0
push edx
mov dword [esp + 0x24], 0x400
call fcn.0043e780
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x130]
push ecx
push 0
push 0
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebp, [esp + 0x54]
mov dword [esp + 0x48], esp
cmp eax, 0x10
jb 0x4250e8
mov ecx, dword [edi]
jmp 0x4250ea
mov ecx, edi
cmp ecx, 0x455bd4
ja 0x425125
cmp eax, 0x10
jb 0x4250fb
mov ecx, dword [edi]
jmp 0x4250fd
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455bd4
jbe 0x425125
cmp eax, 0x10
jb 0x425111
mov edi, dword [edi]
push 0x12
mov eax, 0x455bd4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x425169
cmp eax, 0x12
jae 0x425137
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x425143
mov eax, dword [edi]
jmp 0x425145
mov eax, edi
push 0x12
push 0x455bd4
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x12
jb 0x425165
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x74]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x548], 8
call fcn.00401640
cmp dword [eax + 0x18], 0x10
jb 0x42518e
mov eax, dword [eax + 4]
jmp 0x425191
add eax, 4
mov edx, dword [esp + 0x34]
push eax
push edx
call ebx
cmp dword [esp + 0x40], 0x10
mov edi, eax
jb 0x4251af
mov eax, dword [esp + 0x2c]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
test edi, edi
jne 0x4251ed
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0xc0]
call fcn.00402df0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4251fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
lea ebx, [ebp + 0x10]
cmp dword [esp + 0xec], ebp
jne 0x42532c
lea edx, [esp + 0x28]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, ebx
jb 0x425237
mov ecx, dword [edi]
jmp 0x425239
mov ecx, edi
cmp ecx, 0x455be8
ja 0x425271
cmp eax, ebx
jb 0x425249
mov ecx, dword [edi]
jmp 0x42524b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455be8
jbe 0x425271
cmp eax, ebx
jb 0x42525e
mov edi, dword [edi]
push ebx
mov eax, 0x455be8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x4252ac
cmp eax, ebx
jae 0x425281
mov ecx, dword [esi + 0x14]
push ecx
push ebx
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x42528c
mov eax, dword [edi]
jmp 0x42528e
mov eax, edi
push ebx
push 0x455be8
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], ebx
cmp dword [esi + 0x18], ebx
jb 0x4252a8
mov edi, dword [edi]
mov byte [edi + 0x10], 0
lea esi, [esp + 0x68]
call fcn.004014c0
mov byte [esp + 0x53c], 9
call fcn.004018b0
mov byte [esp + 0x538], 0xa
cmp dword [eax + 0x18], ebx
jb 0x4252d4
mov edx, dword [eax + 4]
jmp 0x4252d7
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4252e0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xe0]
call fcn.00403090
cmp dword [esp + 0x40], ebx
jb 0x42530a
mov edx, dword [esp + 0x2c]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
cmp dword [esp + 0xb4], ebp
jne 0x42546a
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
lea ebp, [esp + 0x44]
mov dword [esp + 0x38], esp
cmp eax, ebx
jb 0x42536a
mov ecx, dword [edi]
jmp 0x42536c
mov ecx, edi
cmp ecx, 0x455bfc
ja 0x4253a4
cmp eax, ebx
jb 0x42537c
mov ecx, dword [edi]
jmp 0x42537e
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455bfc
jbe 0x4253a4
cmp eax, ebx
jb 0x425391
mov edi, dword [edi]
push ebx
mov eax, 0x455bfc
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x4253df
cmp eax, ebx
jae 0x4253b4
mov ecx, dword [esi + 0x14]
push ecx
push ebx
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x4253bf
mov eax, dword [edi]
jmp 0x4253c1
mov eax, edi
push ebx
push 0x455bfc
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], ebx
cmp dword [esi + 0x18], ebx
jb 0x4253db
mov edi, dword [edi]
mov byte [edi + 0x10], 0
lea esi, [esp + 0x64]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x538], 0xb
call fcn.00401640
mov byte [esp + 0x538], 0xc
cmp dword [eax + 0x18], ebx
jb 0x42540b
mov edx, dword [eax + 4]
jmp 0x42540e
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425413
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xa8]
call fcn.00403090
cmp dword [esp + 0x40], ebx
jb 0x42543d
mov edx, dword [esp + 0x2c]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
mov ebx, pe_nt_image_headers32
xor ebp, ebp
cmp dword [esp + 0xd0], ebp
jne 0x42559c
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, ebx
jb 0x4254a0
mov ecx, dword [edi]
jmp 0x4254a2
mov ecx, edi
cmp ecx, 0x455c10
ja 0x4254db
cmp eax, ebx
jb 0x4254b2
mov ecx, dword [edi]
jmp 0x4254b4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455c10
jbe 0x4254db
cmp eax, ebx
jb 0x4254c7
mov edi, dword [edi]
push 8
mov eax, 0x455c10
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x42551d
cmp eax, 8
jae 0x4254ed
mov ecx, dword [esi + 0x14]
push ecx
push 8
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x4254f8
mov eax, dword [edi]
jmp 0x4254fa
mov eax, edi
push 8
push 0x455c10
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 8
cmp dword [esi + 0x18], ebx
jb 0x425519
mov edi, dword [edi]
mov byte [edi + 8], 0
lea esi, [esp + 0x68]
call fcn.004014c0
mov byte [esp + 0x53c], 0xd
call fcn.00401770
mov byte [esp + 0x538], 0xe
cmp dword [eax + 0x18], ebx
jb 0x425545
mov edx, dword [eax + 4]
jmp 0x425548
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425550
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xc4]
call fcn.00403090
cmp dword [esp + 0x40], ebx
jb 0x42557a
mov edx, dword [esp + 0x2c]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x48]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
mov byte [esp + 0x538], 4
call fcn.00429620
mov eax, dword [esp + 0xdc]
cmp dword [esp + 0xf0], ebx
jae 0x4255b3
lea eax, [esp + 0xdc]
push eax
call sub.WS2_32.dll_gethostbyname
cmp eax, ebp
jne 0x425647
cmp dword [esp + 0xd4], ebx
jb 0x4255da
mov eax, dword [esp + 0xc0]
push eax
call fcn.00437f8b
add esp, 4
mov esi, 0xf
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebp
mov byte [esp + 0xc0], 0
cmp dword [esp + 0xb8], ebx
jb 0x42560e
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xb8], esi
mov dword [esp + 0xb4], ebp
mov byte [esp + 0xa4], 0
cmp dword [esp + 0xf0], ebx
jb 0x42563d
mov edx, dword [esp + 0xdc]
push edx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x4258f3
mov edi, 0xf
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebp
mov byte [esp + 0xf8], 0
lea eax, [esp + 0xf4]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x558], 0xf
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0xe4]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
push edx
mov byte [ecx + 4], 0
call fcn.00402d10
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x574], 0x10
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0xe4]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
push eax
mov byte [ecx + 4], 0
call fcn.00402d10
mov byte [esp + 0x574], 0xf
call fcn.00432fe0
mov esi, eax
call fcn.00417d30
mov ecx, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x37
jle 0x4256fd
push 0x37
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00419600
call fcn.004353a0
cmp esi, ebp
jge 0x425817
mov eax, dword [esp + 0xc0]
cmp dword [esp + 0xd4], ebx
jae 0x42571c
lea eax, [esp + 0xc0]
push eax
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0xbc], ebx
jae 0x425734
lea eax, [esp + 0xa8]
push eax
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x3f
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
push 0x455c20
mov byte [ecx + 4], 0
call fcn.00403090
lea esi, [esp + 0x70]
call fcn.004014c0
mov byte [esp + 0x544], 0x11
call fcn.004018b0
mov byte [esp + 0x540], 0x12
cmp dword [eax + 0x18], ebx
jb 0x425781
mov eax, dword [eax + 4]
jmp 0x425784
add eax, 4
push eax
mov eax, dword [esp + 0x50]
push 1
push eax
call fcn.0041c990
add esp, 0x14
lea ecx, [esp + 0x28]
call fcn.00402ba0
lea esi, [esp + 0x48]
call fcn.00429620
call fcn.00417c50
mov ecx, eax
mov eax, 0x9d719fc1
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x6810
jle 0x4257dd
push 0x6810
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401440
call fcn.00419670
lea ecx, [esp + 0xf4]
call fcn.00402ba0
lea ecx, [esp + 0xbc]
call fcn.00402ba0
lea ecx, [esp + 0xa0]
call fcn.00402ba0
lea ecx, [esp + 0xd8]
call fcn.00402ba0
mov eax, 0x80004005
jmp 0x4258f3
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x45360f
call fcn.00402b30
sub esp, 0x1c
mov byte [esp + 0x570], 0x13
lea edx, [esp + 0x12c]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.00402b70
mov edi, dword [esp + 0x7c]
lea esi, [edi + 0x18]
mov ecx, esi
mov byte [esp + 0x570], 0xf
call fcn.00431a10
cmp eax, ebp
jl 0x4257dd
mov dword [esp + 0x128], 0xf
mov dword [esp + 0x124], ebp
mov byte [esp + 0x114], 0
lea eax, [esp + 0x110]
push eax
mov eax, esi
mov byte [esp + 0x53c], 0x14
call fcn.004323b0
lea ecx, [esp + 0x110]
test eax, eax
jge 0x4258ac
call fcn.00402ba0
jmp 0x4257dd
mov dword [edi + 0x39c], 1
mov dword [edi + 0x3a0], ebp
call fcn.00402ba0
lea ecx, [esp + 0xf4]
call fcn.00402ba0
lea ecx, [esp + 0xbc]
call fcn.00402ba0
lea ecx, [esp + 0xa0]
call fcn.00402ba0
lea ecx, [esp + 0xd8]
call fcn.00402ba0
xor eax, eax
mov ecx, dword [esp + 0x530]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.00437983
add esp, 0x528
ret