Function at 0x426efc
Capabilities:
Create process on windows
Encode data using base64
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x520
mov esi, dword [ebp + 8]
mov dword [esp + 0x50], ecx
mov ebx, edx
mov ecx, edx
mov edx, esi
call fcn.0041a420
test al, al
mov dword [esp + 0x2c], ebx
je 0x427108
lea ecx, [esp + 0xd0]
mov edx, ebx
push esi
call fcn.0041eeb0
add esp, 4
mov eax, dword [0x43eebc]
lea ecx, [esp + 0x90]
xor ebx, ebx
mov edx, 0x43ee1d
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
push 1
call fcn.0041fa20
add esp, 4
mov eax, dword [esp + 0xd8]
movsd xmm0, qword [esp + 0xd0]
lea esi, [esp + 0x118]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
push esi
call fcn.0041e570
add esp, 4
mov edi, edx
lea ecx, [esp + 0x90]
mov edx, eax
push edi
call fcn.0041fa20
add esp, 4
cmp dword [esi + 4], ebx
je 0x426fac
mov ecx, dword [esp + 0x118]
call fcn.0042856a
lea esi, [esp + 0x90]
mov edx, 0x43ee1e
mov ecx, esi
push 9
call fcn.0041fa20
add esp, 4
mov eax, dword [esi + 8]
movsd xmm0, qword [esi]
lea ecx, [esp + 0xe0]
mov dword [esp + 0x108], 0x43ee27
mov dword [ecx + 8], eax
mov eax, 0xd
movsd qword [ecx], xmm0
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], 0x43ee34
mov dword [esp + 0x114], eax
push ecx
call fcn.0041e570
add esp, 4
mov edi, edx
mov edx, dword [esp + 0x2c]
xorps xmm0, xmm0
mov dword [esp + 0x118], 0x44
mov dword [esp + 8], eax
mov dword [esp + 0x120], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x154], ebx
lea ecx, [esp + 0xf0]
movaps xmmword [esi], xmm0
push dword [ebp + 8]
call fcn.004268f0
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xfc]
push edi
call fcn.004268f0
add esp, 4
cmp dword [ebp + 0x18], 0
je 0x427410
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
mov dword [esp + 0xdc], eax
je 0x427415
mov edi, eax
mov esi, eax
add edi, 2
xor ebx, ebx
dec ebx
cmp ebx, 0x80000000
je 0x4281bb
cmp word [edi - 2], 0
jne 0x427102
cmp word [edi], 0
je 0x4271fd
dec ebx
add edi, 2
jmp 0x4270e5
lea esi, [esp + 0x80]
mov ecx, esi
call fcn.00419b00
cmp dword [esi], 1
jne 0x42712e
mov ebx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
jmp 0x427ecb
lea eax, [esp + 0x84]
lea edx, [esp + 0x38]
mov ecx, dword [eax + 8]
movsd xmm0, qword [eax]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
push edx
call fcn.0041e570
add esp, 4
mov esi, edx
lea edi, [esp + 0x118]
mov edx, eax
mov ecx, edi
push esi
call fcn.0041eeb0
add esp, 4
mov eax, dword [edi + 8]
movsd xmm0, qword [edi]
lea esi, [esp + 0x70]
mov edx, ebx
mov ecx, esi
mov dword [esi + 8], eax
movsd qword [esi], xmm0
push dword [ebp + 8]
call fcn.0041ef10
add esp, 4
push esi
call fcn.0041e570
add esp, 4
lea esi, [esp + 0x118]
xor ebx, ebx
lea edi, [esp + 0x90]
mov dword [esp + 8], edx
mov edx, eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x1c], ebx
mov word [edi + 0x20], 0
mov dword [edi + 0x10], 7
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 4], 1
mov dword [edi + 8], ebx
mov dword [edi], 0x2000000
mov ecx, esi
push edi
push dword [esp + 0xc]
call fcn.0041e690
add esp, 8
cmp dword [esi], 1
jne 0x42749c
mov ebx, dword [esp + 0x11c]
mov esi, dword [esp + 0x120]
xor edi, edi
inc edi
jmp 0x427ea7
test ebx, ebx
je 0x4281a7
neg ebx
xor edx, edx
mov dword [esp + 0x10], 0
mov ecx, ebx
call fcn.0042aa6f
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [ecx], eax
mov eax, esi
mov dword [ecx + 4], edx
mov dword [ecx + 8], 0
mov dword [esp + 8], eax
xor eax, eax
mov edx, ebx
mov ecx, 0xfffffffe
mov ebx, esi
mov dword [esp + 0xc], esi
inc eax
movzx esi, word [ebx]
test si, si
je 0x427263
add ebx, 2
inc eax
add ecx, 0xfffffffe
cmp ebx, edi
jne 0x427242
mov eax, dword [esp + 8]
mov ebx, edx
mov dword [esp + 0x18], eax
mov eax, edx
jmp 0x427272
mov edi, dword [esp + 8]
mov ebx, edx
sub ebx, eax
dec eax
sub edi, ecx
mov dword [esp + 0x18], edi
test eax, eax
je 0x427280
mov ecx, dword [esp + 0xc]
cmp word [ecx], 0x3d
jne 0x427285
test si, si
jmp 0x4272c9
mov edx, dword [esp + 8]
lea edi, [esp + 0x38]
mov ecx, edi
push eax
call fcn.0042af74
add esp, 4
mov edx, dword [esp + 0x40]
cmp edx, dword [esp + 0x3c]
jne 0x4272ad
mov ecx, edi
call fcn.0042abb4
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
lea eax, [edx + 1]
test si, si
mov dword [esp + 0x10], eax
mov word [ecx + edx*2], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x18]
jne 0x4272dc
lea edi, [eax + ebx*2]
test ebx, ebx
mov esi, eax
jne 0x42722e
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov edx, dword [esp + 0x10]
shl esi, 4
mov dword [esp + 0xc], esi
je 0x4273f1
add dword [esp + 0xc], edi
lea ebx, [esp + 0x38]
lea ecx, [esp + 0x70]
mov edx, edi
call fcn.00429abb
mov edx, dword [esp + 0x78]
mov eax, edx
sub eax, 1
jb 0x4280fb
cmp edx, eax
jb 0x4281cf
mov edx, dword [esp + 0x70]
mov ecx, ebx
mov dword [esp + 8], edx
push eax
call fcn.0042af74
add esp, 4
mov edx, dword [esp + 0x40]
cmp edx, dword [esp + 0x3c]
jne 0x427345
mov ecx, ebx
call fcn.0042abb4
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add edi, 8
lea ecx, [esp + 0x5c]
mov word [eax + edx*2], 0x3d
inc edx
mov dword [esp + 0x40], edx
mov edx, edi
call fcn.00429abb
mov edx, dword [esp + 0x64]
mov eax, edx
sub eax, 1
jb 0x42810c
cmp edx, eax
jb 0x4281d8
mov edx, dword [esp + 0x5c]
mov esi, ebx
mov ecx, ebx
mov dword [esp + 0x18], edx
push eax
call fcn.0042af74
add esp, 4
mov edx, dword [esp + 0x40]
cmp edx, dword [esp + 0x3c]
jne 0x4273a3
mov ecx, esi
call fcn.0042abb4
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov word [eax + edx*2], 0
inc edx
mov dword [esp + 0x14], eax
test dword [esp + 0x60], 0x7fffffff
mov dword [esp + 0x40], edx
je 0x4273cd
mov ecx, dword [esp + 0x18]
mov esi, edx
call fcn.0042856a
mov edx, esi
test dword [esp + 0x74], 0x7fffffff
je 0x4273e4
mov ecx, dword [esp + 8]
mov esi, edx
call fcn.0042856a
mov edx, esi
add edi, 8
cmp edi, dword [esp + 0xc]
jne 0x4272fb
cmp edx, dword [esp + 0x3c]
jne 0x427579
lea esi, [esp + 0x38]
mov ecx, esi
call fcn.0042abb4
mov eax, dword [esi]
mov edx, dword [esi + 8]
jmp 0x42757d
jmp 0x42759c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x20
mov esi, eax
call fcn.00428524
movsd xmm1, qword [0x43f276]
movsd xmm0, qword [0x43f27e]
movsd xmm2, qword [0x43f26e]
mov edi, eax
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [0x43f266]
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
test dword [esp + 0x100], 0x7fffffff
je 0x427475
mov ecx, dword [esp + 0xfc]
call fcn.0042856a
test dword [esp + 0xf4], 0x7fffffff
je 0x42748e
mov ecx, dword [esp + 0xf0]
call fcn.0042856a
mov eax, 0x20
xor edx, edx
xor ebx, ebx
jmp 0x4276ae
mov eax, dword [esp + 0x11c]
mov dword [esp + 8], eax
push 0x400
push ebx
push esi
call fcn.0042c750
add esp, 0xc
mov eax, dword [0x43fe2c]
lea ecx, [esp + 0x5c]
mov edi, 0x200
xor esi, esi
mov dword [esp + 0x18], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov dword [esp + 0x10], eax
mov dword [ecx + 8], ebx
cmp edi, 0x201
jb 0x427506
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov eax, edi
sub eax, edx
sub ecx, edx
cmp ecx, eax
jb 0x42755f
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x64], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
jmp 0x427515
lea ebx, [esp + 0x118]
mov dword [esp + 0x14], 0x200
mov dword [esp + 0xc], ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
test eax, eax
jne 0x427541
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x427e72
cmp ebx, edi
jne 0x427554
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x427554
add edi, edi
jmp 0x4274da
cmp ebx, edi
mov edi, ebx
jae 0x4274da
jmp 0x427cb4
lea ecx, [esp + 0x5c]
push eax
call fcn.00438950
add esp, 4
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
jmp 0x4274f4
mov eax, dword [esp + 0x14]
mov word [eax + edx*2], 0
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
push dword [esp + 0xdc]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xfc]
xor esi, esi
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x11c]
push eax
push esi
push ebx
push 0x401
push esi
push esi
push esi
mov dword [esp + 0x30], edx
push edx
mov dword [esp + 0x38], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4275fe
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
mov edi, 2
lea ecx, [esp + 0x108]
mov dword [esp + 8], ecx
mov dword [esp + 0x18], eax
jmp 0x427647
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x18
mov dword [esp + 8], eax
call fcn.00428524
movsd xmm0, qword [0x43f24e]
movsd xmm2, qword [0x43f256]
movsd xmm1, qword [0x43f25e]
xor esi, esi
mov edi, eax
mov dword [esp + 0x18], 0
xor edx, edx
inc esi
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax + 0x10], xmm1
mov eax, dword [esp + 0xc]
test ebx, ebx
je 0x427665
test eax, eax
je 0x427665
and eax, 0x7fffffff
je 0x427665
mov ecx, ebx
mov ebx, edx
call fcn.0042856a
mov edx, ebx
test dword [esp + 0x100], 0x7fffffff
je 0x42767f
mov ecx, dword [esp + 0x10]
mov ebx, edx
call fcn.0042856a
mov edx, ebx
test dword [esp + 0xf4], 0x7fffffff
mov ebx, dword [esp + 0x18]
je 0x4276a1
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], edx
call fcn.0042856a
mov edx, dword [esp + 0xc]
mov eax, 0x18
test esi, esi
je 0x4276cf
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 4], edx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx], 0
jmp 0x4280c1
mov eax, dword [esp + 8]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], ebx
mov bl, byte [ebp + 0x1c]
mov esi, dword [ebp + 0x10]
mov ecx, 0x10
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edi
mov edi, dword [ebp + 0xc]
call fcn.00428524
mov dword [eax], edi
xor edi, edi
mov ecx, eax
mov dword [eax + 4], esi
mov dword [eax + 8], 0x43ee41
mov dword [eax + 0xc], 0xa
mov dword [esp + 0x90], eax
inc edi
test bl, bl
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
je 0x427cae
lea esi, [esp + 0x118]
mov dword [esp + 0x24], ecx
mov edx, 0x43ee4b
mov ecx, esi
push 0x10
call fcn.0041ba10
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x427cf1
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x11c]
test ecx, ecx
mov dword [esp + 0x68], eax
mov eax, ecx
mov dword [esp + 0x48], ecx
je 0x4277e2
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
add eax, ecx
mov bl, byte [ecx]
lea edx, [ecx + 1]
test bl, bl
js 0x427794
mov ecx, edx
jmp 0x4277de
add ecx, 2
cmp bl, 0xe0
jae 0x4277a3
cmp edx, eax
cmove ecx, edx
jmp 0x4277de
cmp bl, 0xed
jne 0x4277c0
cmp edx, eax
cmove ecx, edx
cmp ecx, eax
je 0x4277e2
inc ecx
cmp edx, eax
je 0x4277de
cmp byte [edx], 0x9f
jbe 0x4277de
jmp 0x428122
cmp edx, eax
mov esi, ecx
cmove esi, edx
xor ecx, ecx
cmp esi, eax
setne cl
add ecx, esi
cmp bl, 0xf0
jb 0x4277de
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
cmp ecx, eax
jne 0x427787
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x118]
mov ecx, ebx
push 1
push 0x43ee5b
push dword [esp + 0x50]
call fcn.004079d0
add esp, 0xc
mov eax, dword [ebx]
mov edi, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x30]
mov dword [esp + 0xc8], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x7c], ecx
neg ecx
mov dword [esp + 0xb8], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc4], ecx
mov dword [esp + 0x54], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xcc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov ebx, dword [ebx + 0x3c]
mov dword [esp + 0x18], eax
mov eax, edi
mov dword [esp + 0x14], ebx
and eax, 0xff000000
mov dword [esp + 0xc0], eax
mov eax, edi
shr eax, 0x10
mov dword [esp + 0x58], eax
mov eax, edi
and edi, 0xff00
mov eax, ebx
sub ebx, edx
mov dword [esp + 0xbc], edi
mov edi, dword [esp + 0x24]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xb4], ebx
inc eax
mov dword [esp + 0x6c], eax
cmp dword [esp + 0xc8], 1
jne 0x427a5f
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x30], ecx
lea eax, [edx + eax - 1]
cmp eax, esi
jae 0x427a78
movzx ecx, byte [esp + 0x58]
movzx edx, byte [esp + 0x2c]
mov dword [esp + 0x24], edi
shl ecx, 0x10
or ecx, dword [esp + 0xc0]
or ecx, dword [esp + 0xbc]
or edx, ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov edx, esi
mov esi, dword [esp + 0x10]
mov cl, byte [esi + eax]
xor eax, eax
xor edi, edi
mov ebx, esi
inc edi
mov esi, edi
shld eax, edi, cl
shl esi, cl
test cl, 0x20
mov ecx, 0
cmovne eax, esi
cmovne esi, ecx
and eax, dword [esp + 0x28]
and esi, dword [esp + 0xcc]
or esi, eax
je 0x4279b4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
cmp eax, ecx
mov edx, ecx
mov ecx, dword [esp + 8]
cmova edx, eax
cmp dword [esp + 0x1c], 0xffffffff
lea esi, [ebx + ecx]
cmove edx, eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dword [esp + 0x34], edx
cmp edx, eax
cmova eax, edx
cmp eax, ecx
je 0x4279cd
mov edx, dword [esp + 8]
lea edi, [edx + ecx]
mov edx, dword [esp + 0xc]
cmp edi, edx
jae 0x427fee
mov edx, dword [esp + 0x18]
lea edi, [ecx + 1]
mov bl, byte [edx + ecx]
cmp bl, byte [esi + ecx]
mov ecx, edi
je 0x427961
mov eax, dword [esp + 8]
add eax, dword [esp + 0xc4]
add eax, edi
cmp dword [esp + 0x1c], 0xffffffff
mov dword [esp + 8], eax
je 0x427a55
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
xor eax, eax
jmp 0x427a38
mov eax, dword [esp + 8]
mov esi, ebx
add eax, dword [esp + 0x14]
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esp + 0x1c], 0xffffffff
jne 0x427a38
jmp 0x427a3c
cmp dword [esp + 0x1c], 0xffffffff
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0xc]
mov eax, 0
cmove esi, eax
cmp esi, ecx
jae 0x427a9d
dec ecx
cmp ecx, dword [esp + 0x14]
jae 0x4280df
mov eax, dword [esp + 8]
add eax, ecx
cmp eax, edx
jae 0x4280ea
mov edi, dword [esp + 0x18]
mov bl, byte [edi + ecx]
mov edi, dword [esp + 0x10]
cmp bl, byte [edi + eax]
je 0x4279e6
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x10]
add eax, dword [esp + 0xb8]
cmp dword [esp + 0x1c], 0xffffffff
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb4]
je 0x427a3c
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
lea eax, [ecx + eax - 1]
cmp eax, edx
jb 0x427902
jmp 0x427c62
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
jmp 0x427a3c
cmp byte [esp + 0x58], 0
mov edx, dword [esp + 0x54]
je 0x427adc
mov dword [esp + 0x34], 0
mov ebx, dword [esp + 0x48]
jmp 0x427a94
mov ecx, dword [esp + 0x30]
mov dword [esp + 8], esi
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], ecx
jmp 0x427bd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x1c], 0xffffffff
mov edi, dword [esp + 0x24]
lea esi, [ecx + eax]
mov eax, 0
mov dword [esp + 0x20], ecx
cmovne edx, eax
mov dword [esp + 0x28], esi
mov eax, esi
mov dword [esp + 8], esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x54]
jmp 0x427bc2
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], edi
test edx, edx
mov eax, dword [esp + 0x2c]
je 0x427b03
cmp dword [esp + 0xc], edx
jbe 0x427afd
cmp byte [esi + edx], 0xbf
jg 0x427b03
jmp 0x4281e9
jne 0x4281e9
mov ecx, eax
xor cl, 1
cmp edx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
je 0x427bae
mov ah, byte [esi + edx]
movzx ecx, ah
test ah, ah
jns 0x427b6f
movzx ebx, byte [esi + edx + 1]
and ecx, 0x1f
and ebx, 0x3f
cmp ah, 0xdf
jbe 0x427b5b
mov edi, esi
movzx esi, byte [esi + edx + 2]
shl ebx, 6
and esi, 0x3f
or esi, ebx
cmp ah, 0xf0
jb 0x427b62
movzx ebx, byte [edi + edx + 3]
and ecx, 7
shl esi, 6
shl ecx, 0x12
and ebx, 0x3f
or ebx, esi
or ecx, ebx
jmp 0x427b67
shl ecx, 6
or ecx, ebx
jmp 0x427b6f
shl ecx, 0xc
or ecx, esi
mov ebx, dword [esp + 0x24]
mov esi, edi
mov edi, ebx
test al, al
jne 0x427bba
cmp ecx, 0x110000
je 0x427c4b
cmp ecx, 0x80
mov eax, 1
jb 0x427ba7
mov eax, 2
cmp ecx, 0x800
jb 0x427ba7
cmp ecx, 0x10000
mov eax, 4
sbb eax, 0
add edx, eax
jmp 0x427ae4
test al, al
je 0x427c8f
mov edx, dword [esp + 0xc]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x20]
mov al, 1
mov dword [esp + 0x34], eax
lea eax, [esi + ecx]
sub ebx, ecx
mov dword [esp + 0x54], edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x94]
jne 0x427c06
mov edx, eax
lea ecx, [esp + 0x90]
call fcn.0040c344
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x20]
shl eax, 4
mov dword [edi + eax], ecx
mov dword [edi + eax + 4], ebx
mov dword [edi + eax + 8], 0x43ee41
mov dword [edi + eax + 0xc], 0xa
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x98]
inc eax
cmp byte [esp + 0x34], 0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x98], eax
jne 0x4278a5
jmp 0x427ce9
mov ecx, dword [esp + 0x30]
mov al, 1
mov dword [esp + 0x34], 0
mov dword [esp + 0x58], eax
jmp 0x427a72
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
jmp 0x427bd0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x48]
mov al, 1
mov dword [esp + 0x34], 0
mov dword [esp + 0x58], eax
jmp 0x427a94
xor ebx, ebx
mov eax, ecx
jmp 0x427cfd
mov edx, dword [esp + 0x14]
cmp ebx, edx
ja 0x428202
mov edx, dword [esp + 0xc]
lea edi, [esp + 0x108]
mov ecx, edi
push ebx
call fcn.0041a2d0
add esp, 4
mov eax, dword [edi + 8]
mov ebx, dword [edi]
mov esi, dword [edi + 4]
xor edi, edi
mov dword [esp + 0x18], eax
jmp 0x427e7f
mov edi, dword [esp + 0x6c]
mov bl, 1
jmp 0x427cf6
xor edi, edi
inc edi
xor ebx, ebx
mov eax, dword [esp + 0x90]
lea esi, [esp + 0x118]
lea edx, [esp + 0x80]
mov ecx, esi
push edi
mov dword [esp + 0x28], eax
push eax
call fcn.004233e8
add esp, 8
cmp dword [esi], 1
jne 0x427d62
lea esi, [esp + 0x11c]
push 1
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movsd xmm1, qword [esi + 8]
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esi]
movsd qword [eax + 0xc], xmm1
movsd xmm1, qword [esi + 0x10]
movsd qword [eax + 4], xmm0
movsd qword [eax + 0x14], xmm1
mov dword [eax], 0
jmp 0x428097
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x120]
mov esi, dword [esp + 0x124]
push dword [esp + 0x11c]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
call sub.KERNEL32.dll_DebugActiveProcessStop
push ebx
call sub.KERNEL32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x427f10
lea edi, [esp + 0x118]
mov edx, ebx
mov ecx, edi
call fcn.00429ae4
mov ebx, dword [edi]
cmp ebx, 2
jne 0x427f73
mov ecx, 0xc
mov dword [esp + 0x70], 0xc
call fcn.00428547
xor ebx, ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 0x5c], 0
mov ecx, dword [esp + 8]
mov eax, 0xc
mov dword [esp + 0x118], ebx
sub eax, edi
add ecx, edi
push ebx
lea edx, [esp + 0x11c]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427fb3
add edi, dword [esp + 0x118]
jb 0x428193
cmp edi, 0xc
mov dword [esp + 0x5c], edi
jb 0x427dd3
lea ebx, [esp + 0x118]
mov edx, esi
mov ecx, ebx
call fcn.00429ae4
mov esi, dword [ebx]
cmp esi, 2
jne 0x428005
cmp edi, 0xc
jne 0x42820b
mov ecx, dword [esp + 8]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
call fcn.0042856a
test esi, esi
je 0x428156
cmp esi, 1
je 0x428148
cmp esi, 2
jne 0x428186
xor eax, eax
inc eax
mov dword [esp + 8], eax
jmp 0x428150
xor edi, edi
xor ebx, ebx
inc edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x60]
test eax, eax
je 0x427e9e
cmp dword [esp + 0x10], 0
je 0x427e9e
and eax, 0x7fffffff
je 0x427e9e
mov ecx, dword [esp + 0x10]
call fcn.0042856a
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0x74], 0
je 0x427eb7
mov ecx, dword [esp + 0x70]
call fcn.0042856a
cmp dword [esp + 0x3c], 0
je 0x427ec7
mov ecx, dword [esp + 0x38]
call fcn.0042856a
test edi, edi
je 0x427ef2
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x2c]
lea ecx, [edi + 4]
push dword [ebp + 8]
call fcn.0041eeb0
add esp, 4
mov dword [edi], 2
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
jmp 0x4280d7
mov eax, dword [esp + 0x18]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd8], eax
jmp 0x426f3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x15
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x15
call fcn.00428524
movsd xmm0, qword [0x43f4f7]
movsd xmm2, qword [0x43f4ff]
movsd xmm1, qword [0x43f504]
mov edi, eax
xor ebx, ebx
mov dword [esp + 8], 3
mov dword [esp + 0xc], 0
mov dword [esp + 0x2c], 0x15
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm0
movsd qword [eax + 0xd], xmm1
jmp 0x428053
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
mov edx, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov dword [esp + 8], 3
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], ecx
jmp 0x428053
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x28
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x28
call fcn.00428524
push 0x28
push str.Error_while_reading_child_processs_pipe_
mov dword [esp + 0x24], eax
push eax
call fcn.0042c8b0
add esp, 0xc
xor ebx, ebx
xor ecx, ecx
mov eax, 0x28
jmp 0x428036
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 8]
cmp edx, ecx
cmova ecx, edx
push 0x43ef34
jmp 0x4280f1
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
mov ebx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x12c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x2c], eax
call fcn.0042856a
mov edi, dword [esp + 0x1c]
mov dword [esp + 8], 3
xor esi, esi
inc esi
push esi
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0xc]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edi
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edx
mov dword [eax], esi
test dword [esp + 0x94], 0xfffffff
mov ecx, dword [esp + 0x24]
je 0x4280ad
call fcn.0042856a
test bl, bl
je 0x4280c1
cmp dword [esp + 0x68], 0
je 0x4280c1
mov ecx, dword [esp + 0x4c]
call fcn.0042856a
cmp dword [esp + 0xe4], 0
je 0x4280d7
mov ecx, dword [esp + 0xe0]
call fcn.0042856a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x14]
push 0x43ef44
jmp 0x4280f1
mov ecx, eax
push 0x43ef54
call fcn.00437d80
add esp, 4
ud2
mov ecx, str.attempt_to_subtract_with_overflow
mov edx, 0x21
push 0x43f2bc
jmp 0x42811b
mov ecx, str.attempt_to_subtract_with_overflow
mov edx, 0x21
push 0x43f304
call fcn.00437f00
jmp 0x4280f6
mov ecx, dword [esp + 0x4c]
xor edi, edi
xor ebx, ebx
inc edi
test ecx, ecx
je 0x427cf6
cmp dword [esp + 0x68], 0
je 0x427cf6
call fcn.0042856a
jmp 0x427cf4
mov dword [esp + 8], 0
mov dword [esp + 0xc], edi
jmp 0x42818e
mov eax, dword [esp + 0x50]
test dword [esp + 0x94], 0xfffffff
mov ecx, dword [esp + 0x24]
mov dword [eax], 3
je 0x428176
call fcn.0042856a
cmp byte [esp + 0x18], 0
jne 0x4280b1
jmp 0x4280c1
mov dword [esp + 8], 2
jmp 0x428053
mov ecx, str.attempt_to_add_with_overflow_
mov edx, 0x1c
push 0x43f498
jmp 0x42811b
mov ecx, str.attempt_to_add_with_overflow_
mov edx, 0x1c
push 0x43f288
jmp 0x42811b
mov ecx, str.attempt_to_add_with_overflow_
mov edx, 0x1c
push 0x43fdf8
jmp 0x42811b
mov ecx, eax
push 0x43f2f4
jmp 0x4281df
mov ecx, eax
push 0x43f314
call fcn.00437e90
jmp 0x4280f6
mov eax, edx
mov edx, dword [esp + 0xc]
mov ecx, esi
push 0x43ef24
push edx
push eax
call fcn.00438050
add esp, 0xc
ud2
mov ecx, ebx
push 0x43e4a8
jmp 0x4281df
mov dword [esp + 0x118], 0
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x70]
push ebx
call fcn.00438af5
jmp 0x4280f6