Function at 0x426940
Capabilities:
Create process on windows
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c37f
mov eax, dword fs:[0]
push eax
sub esp, 0xe74
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc18], ecx
mov dword [ebp - 0xe1c], 0
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 0xc41]
push eax
lea ecx, [ebp - 0xec]
call fcn.00409420
mov byte [ebp - 4], 1
mov dword [ebp - 0xc28], 0x57b6ec
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xcac], ecx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xc4e], ax
add dword [ebp - 0xc28], 2
cmp word [ebp - 0xc4e], 0
jne 0x4269b2
mov ecx, dword [ebp - 0xc28]
sub ecx, dword [ebp - 0xcac]
sar ecx, 1
mov dword [ebp - 0xcb0], ecx
mov edx, dword [ebp - 0xcb0]
mov dword [ebp - 0xcb4], edx
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcb8], eax
mov ecx, dword [ebp - 0xcb8]
push ecx
push 0x57b6ec
lea ecx, [ebp - 0xec]
call fcn.00403cb0
mov byte [ebp - 4], 2
movzx edx, byte [ebp - 0xc49]
push edx
lea ecx, [ebp - 0xd4]
call fcn.00409420
mov byte [ebp - 4], 3
mov dword [ebp - 0xc2c], 0x57b700
mov eax, dword [ebp - 0xc2c]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov ecx, dword [ebp - 0xc2c]
mov dx, word [ecx]
mov word [ebp - 0xc56], dx
add dword [ebp - 0xc2c], 2
cmp word [ebp - 0xc56], 0
jne 0x426a4a
mov eax, dword [ebp - 0xc2c]
sub eax, dword [ebp - 0xcbc]
sar eax, 1
mov dword [ebp - 0xcc0], eax
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc4], ecx
mov edx, dword [ebp - 0xcc4]
mov dword [ebp - 0xcc8], edx
mov eax, dword [ebp - 0xcc8]
push eax
push 0x57b700
lea ecx, [ebp - 0xd4]
call fcn.00403cb0
mov byte [ebp - 4], 4
movzx ecx, byte [ebp - 0xc4a]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.00409420
mov byte [ebp - 4], 5
mov dword [ebp - 0xc30], 0x57b724
mov edx, dword [ebp - 0xc30]
add edx, 2
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0xc30]
mov cx, word [eax]
mov word [ebp - 0xc58], cx
add dword [ebp - 0xc30], 2
cmp word [ebp - 0xc58], 0
jne 0x426ae2
mov edx, dword [ebp - 0xc30]
sub edx, dword [ebp - 0xccc]
sar edx, 1
mov dword [ebp - 0xcd0], edx
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0xcd4]
mov dword [ebp - 0xcd8], ecx
mov edx, dword [ebp - 0xcd8]
push edx
push 0x57b724
lea ecx, [ebp - 0xbc]
call fcn.00403cb0
mov byte [ebp - 4], 6
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd84], eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd80], ecx
lea edx, [ebp - 0xc4b]
push edx
mov eax, dword [ebp - 0xd80]
push eax
mov ecx, dword [ebp - 0xd84]
push ecx
lea ecx, [ebp - 0xca8]
call fcn.00437480
mov byte [ebp - 4], 8
push fcn.004046e0
push 3
push 0x18
lea edx, [ebp - 0xec]
push edx
call fcn.005107db
lea eax, [ebp - 0xca8]
push eax
call fcn.00401ec0
add esp, 4
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc18]
add ecx, 0x3e8
call fcn.0040d420
mov edx, dword [ebp - 0xc18]
mov eax, dword [edx + 0x3f8]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0xcdc], 0x14
jae 0x426c2d
lea ecx, [ebp - 0xc14]
call fcn.00419540
mov byte [ebp - 4], 9
push 0
lea ecx, [ebp - 0xc14]
call fcn.004558ad
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc14]
call fcn.004557f6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xca8]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405e70
jmp 0x4277ec
mov ecx, dword [ebp - 0xc18]
add ecx, 0x400
push ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe18], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3e8
push edx
call fcn.00404350
mov ecx, dword [ebp - 0xc18]
call fcn.0042d550
mov byte [ebp - 0xc19], al
mov al, byte [ebp - 0xc19]
mov byte [ebp - 0xc1a], al
movzx ecx, byte [ebp - 0xc1a]
cmp ecx, 1
jne 0x426cc1
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0xe08], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x400
push edx
call fcn.0041eb80
mov eax, dword [ebp - 0xc18]
mov ecx, dword [eax + 0x3cc]
call fcn.0041d600
mov ecx, dword [ebp - 0xc18]
mov ecx, dword [ecx + 0x3cc]
call fcn.0041d720
jmp 0x426d0f
lea ecx, [ebp - 0x864]
call fcn.00419540
mov byte [ebp - 4], 0xa
push 0
lea ecx, [ebp - 0x864]
call fcn.004558ad
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x864]
call fcn.004557f6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xca8]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405e70
jmp 0x4277ec
mov edx, dword [ebp - 0xc18]
mov ecx, dword [edx + 0x3cc]
call fcn.0041d5e0
mov dword [ebp - 0xe20], eax
lea eax, [ebp - 0xe34]
push eax
mov ecx, dword [ebp - 0xc18]
mov ecx, dword [ecx + 0x3cc]
call fcn.0041dfc0
mov dword [ebp - 0xce0], eax
mov edx, dword [ebp - 0xce0]
push edx
mov ecx, dword [ebp - 0xc18]
add ecx, 0x3a8
call fcn.004381d0
lea ecx, [ebp - 0xe34]
call fcn.004188f0
mov eax, dword [ebp - 0xc18]
add eax, 0x3a8
mov dword [ebp - 0xc6c], eax
mov ecx, dword [ebp - 0xc6c]
mov edx, dword [ebp - 0xc6c]
mov eax, dword [ecx + 4]
sub eax, dword [edx]
cdq
mov ecx, 0x18
idiv ecx
mov dword [ebp - 0xce4], eax
cmp dword [ebp - 0xce4], 0
jbe 0x4277ce
lea edx, [ebp - 0xdb4]
mov dword [ebp - 0xce8], edx
mov ecx, dword [ebp - 0xce8]
call fcn.004184d0
mov byte [ebp - 4], 0xb
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xe24], esp
mov dword [ebp - 0xc74], eax
movzx ecx, byte [ebp - 0xc4c]
push ecx
mov ecx, dword [ebp - 0xc74]
call fcn.00409420
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xc24], 0x57b74c
mov edx, dword [ebp - 0xc24]
add edx, 2
mov dword [ebp - 0xcec], edx
mov eax, dword [ebp - 0xc24]
mov cx, word [eax]
mov word [ebp - 0xc5a], cx
add dword [ebp - 0xc24], 2
cmp word [ebp - 0xc5a], 0
jne 0x426e00
mov edx, dword [ebp - 0xc24]
sub edx, dword [ebp - 0xcec]
sar edx, 1
mov dword [ebp - 0xcf0], edx
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0xcf4], eax
mov ecx, dword [ebp - 0xcf4]
mov dword [ebp - 0xddc], ecx
mov edx, dword [ebp - 0xddc]
push edx
push 0x57b74c
mov ecx, dword [ebp - 0xc74]
call fcn.00403cb0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xd
push 0
lea eax, [ebp - 0xdb4]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe28], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3b4
push edx
call fcn.00404350
mov byte [ebp - 4], 0xb
call fcn.00408cd0
add esp, 0x38
lea eax, [ebp - 0xdb4]
mov dword [ebp - 0xc78], eax
mov ecx, dword [ebp - 0xc78]
mov edx, dword [ecx]
mov dword [ebp - 0xc34], edx
mov eax, dword [ebp - 0xc78]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xdd8], ecx
jmp 0x426ed8
mov edx, dword [ebp - 0xc34]
add edx, 0x18
mov dword [ebp - 0xc34], edx
mov eax, dword [ebp - 0xc34]
cmp eax, dword [ebp - 0xdd8]
je 0x426fc7
mov ecx, dword [ebp - 0xc34]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00404350
mov byte [ebp - 4], 0xe
mov byte [ebp - 0xc1b], 0
lea edx, [ebp - 0xc1b]
push edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe00], esp
lea eax, [ebp - 0x40]
push eax
call fcn.00404350
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00402fc0
add esp, 0x20
mov dword [ebp - 0xe04], eax
push 0
push 0x57b758
lea ecx, [ebp - 0xa0]
call fcn.00410030
cmp eax, 0xffffffff
je 0x426f68
lea ecx, [ebp - 0x40]
call fcn.00405cb0
mov dword [ebp - 0xdd4], eax
mov edx, dword [ebp - 0xdd4]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x426fab
push 0
push 0x57b770
lea ecx, [ebp - 0x40]
call fcn.00410030
cmp eax, 0xffffffff
jne 0x426f90
push 0
push 0x57b788
lea ecx, [ebp - 0x40]
call fcn.00410030
cmp eax, 0xffffffff
je 0x426fab
lea ecx, [ebp - 0x40]
call fcn.00405cb0
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0xdd0]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp - 0xa0]
call fcn.00405e70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x40]
call fcn.00405e70
jmp 0x426ec9
push 0x57b798
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push 8
call fcn.0049658d
add esp, 4
mov dword [ebp - 0xc60], eax
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0xc60], 0
je 0x427088
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xdcc], ecx
mov dword [ebp - 0xd8c], 0x42c650
mov dword [ebp - 0xd88], 0
mov edx, dword [ebp - 0xd8c]
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0xdf4], edx
mov dword [ebp - 0xdf0], eax
lea ecx, [ebp - 0xdcc]
mov dword [ebp - 0xdc8], ecx
lea edx, [ebp - 0xdf4]
mov dword [ebp - 0xdc4], edx
mov eax, dword [ebp - 0xdc8]
push eax
mov ecx, dword [ebp - 0xdc4]
push ecx
lea ecx, [ebp - 0xe50]
call fcn.00436160
lea edx, [ebp - 0xe50]
mov dword [ebp - 0xdc0], edx
mov eax, dword [ebp - 0xdc0]
push eax
mov ecx, dword [ebp - 0xc60]
call fcn.00432830
mov ecx, dword [ebp - 0xc60]
mov dword [ebp - 0xc7c], ecx
jmp 0x427092
mov dword [ebp - 0xc7c], 0
mov edx, dword [ebp - 0xc7c]
mov dword [ebp - 0xdbc], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0xdb8], eax
mov ecx, dword [ebp - 0xdb8]
call fcn.0043e670
push 8
call fcn.0049658d
add esp, 4
mov dword [ebp - 0xc64], eax
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0xc64], 0
je 0x42716f
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xd7c], ecx
mov dword [ebp - 0xd94], 0x42af30
mov dword [ebp - 0xd90], 0
mov edx, dword [ebp - 0xd94]
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xdfc], edx
mov dword [ebp - 0xdf8], eax
lea ecx, [ebp - 0xd7c]
mov dword [ebp - 0xda8], ecx
lea edx, [ebp - 0xdfc]
mov dword [ebp - 0xcf8], edx
mov eax, dword [ebp - 0xda8]
push eax
mov ecx, dword [ebp - 0xcf8]
push ecx
lea ecx, [ebp - 0xe60]
call fcn.00436160
lea edx, [ebp - 0xe60]
mov dword [ebp - 0xcfc], edx
mov eax, dword [ebp - 0xcfc]
push eax
mov ecx, dword [ebp - 0xc64]
call fcn.00432830
mov ecx, dword [ebp - 0xc64]
mov dword [ebp - 0xc80], ecx
jmp 0x427179
mov dword [ebp - 0xc80], 0
mov edx, dword [ebp - 0xc80]
mov dword [ebp - 0xd00], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0xd04], eax
mov ecx, dword [ebp - 0xd04]
call fcn.0043e670
mov dword [ebp - 0xc88], 0
push 8
call fcn.0049658d
add esp, 4
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0xc38], 0
je 0x427260
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xd08], ecx
mov dword [ebp - 0xd9c], 0x42f520
mov dword [ebp - 0xd98], 0
mov edx, dword [ebp - 0xd9c]
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xde4], edx
mov dword [ebp - 0xde0], eax
lea ecx, [ebp - 0xd08]
mov dword [ebp - 0xd0c], ecx
lea edx, [ebp - 0xde4]
mov dword [ebp - 0xd10], edx
mov eax, dword [ebp - 0xd0c]
push eax
mov ecx, dword [ebp - 0xd10]
push ecx
lea ecx, [ebp - 0xe70]
call fcn.00436160
lea edx, [ebp - 0xe70]
mov dword [ebp - 0xd14], edx
mov eax, dword [ebp - 0xd14]
push eax
mov ecx, dword [ebp - 0xc38]
call fcn.00432830
mov ecx, dword [ebp - 0xc38]
mov dword [ebp - 0xc84], ecx
jmp 0x42726a
mov dword [ebp - 0xc84], 0
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0xd18], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xc88], eax
mov ecx, dword [ebp - 0xc88]
call fcn.0043e670
push 8
call fcn.0049658d
add esp, 4
mov dword [ebp - 0xc3c], eax
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0xc3c], 0
je 0x427347
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xd1c], ecx
mov dword [ebp - 0xda4], 0x42ba50
mov dword [ebp - 0xda0], 0
mov edx, dword [ebp - 0xda4]
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xdec], edx
mov dword [ebp - 0xde8], eax
lea ecx, [ebp - 0xd1c]
mov dword [ebp - 0xd20], ecx
lea edx, [ebp - 0xdec]
mov dword [ebp - 0xd24], edx
mov eax, dword [ebp - 0xd20]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
lea ecx, [ebp - 0xe80]
call fcn.00436160
lea edx, [ebp - 0xe80]
mov dword [ebp - 0xd28], edx
mov eax, dword [ebp - 0xd28]
push eax
mov ecx, dword [ebp - 0xc3c]
call fcn.00432830
mov ecx, dword [ebp - 0xc3c]
mov dword [ebp - 0xc8c], ecx
jmp 0x427351
mov dword [ebp - 0xc8c], 0
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0xd2c], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd30], eax
mov ecx, dword [ebp - 0xd30]
call fcn.0043e840
mov ecx, dword [ebp - 0xc18]
call fcn.00427810
movzx ecx, al
test ecx, ecx
jne 0x4273d8
push 0
push 0
push 0x57b7a8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0xc18]
call fcn.00424f70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdb4]
call fcn.00418a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xca8]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405e70
jmp 0x4277ec
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0xe0c], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3a8
push edx
call fcn.00437400
mov ecx, dword [ebp - 0xc18]
call fcn.0042e370
mov ecx, dword [ebp - 0xc18]
call fcn.0042d230
push 0x57b7ec
mov eax, dword [ebp - 0xc18]
add eax, 0x3b4
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.004146d0
add esp, 0xc
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x28]
mov dword [ebp - 0xd34], edx
mov ecx, dword [ebp - 0xd34]
call fcn.004042a0
lea ecx, [ebp - 0x28]
call fcn.0040f620
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x28]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe10], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x430
push edx
call fcn.00404350
call fcn.004159d0
add esp, 0x1c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
jne 0x4274d1
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x28]
call fcn.0040f520
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x58]
call fcn.00405e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdb4]
call fcn.00418a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xca8]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405e70
jmp 0x4277ec
push 0x2c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe14], esp
lea edx, [ebp - 0x28]
push edx
call fcn.0040bf50
lea eax, [ebp - 0xe40]
push eax
mov ecx, dword [ebp - 0xc18]
call fcn.0042f360
mov dword [ebp - 0xd3c], eax
mov ecx, dword [ebp - 0xd3c]
mov dword [ebp - 0xd40], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0xd40]
mov dword [ebp - 0xd44], edx
xor eax, eax
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xd44]
add ecx, dword [edx]
mov dword [ebp - 0xd48], ecx
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd4c], eax
mov ecx, dword [ebp - 0xd4c]
mov dword [ebp - 0xc40], ecx
mov edx, dword [ebp - 0xc40]
mov dword [ebp - 0xc94], edx
mov eax, dword [ebp - 0xc40]
cmp dword [eax + 0x14], 0xf
jbe 0x42756a
mov dword [ebp - 0xc90], 1
jmp 0x427574
mov dword [ebp - 0xc90], 0
mov cl, byte [ebp - 0xc90]
mov byte [ebp - 0xc1c], cl
movzx edx, byte [ebp - 0xc1c]
test edx, edx
je 0x4275a5
mov eax, dword [ebp - 0xc40]
mov ecx, dword [eax]
mov dword [ebp - 0xd50], ecx
mov edx, dword [ebp - 0xd50]
mov dword [ebp - 0xc94], edx
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xd54], eax
mov ecx, dword [ebp - 0xd54]
mov dword [ebp - 0xd58], ecx
mov edx, dword [ebp - 0xd58]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.00417010
add esp, 8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xe40]
call fcn.004188f0
lea ecx, [ebp - 0x70]
push ecx
push 0x57b804
lea edx, [ebp - 0x104]
push edx
call fcn.00430a70
add esp, 0xc
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xd60], eax
mov byte [ebp - 4], 0x18
push 0x22
mov ecx, dword [ebp - 0xd60]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.00430a30
add esp, 0xc
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x104]
call fcn.00405e70
lea ecx, [ebp - 0x4b4]
call fcn.004194c0
mov byte [ebp - 4], 0x1b
push 0
lea ecx, [ebp - 0x4b4]
call fcn.004558ad
lea eax, [ebp - 0x88]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0xc54]
mov dword [ebp - 0xc68], ecx
mov edx, dword [ebp - 0xc54]
cmp dword [edx + 0x14], 7
jbe 0x427680
mov dword [ebp - 0xc98], 1
jmp 0x42768a
mov dword [ebp - 0xc98], 0
mov al, byte [ebp - 0xc98]
mov byte [ebp - 0xc1d], al
movzx ecx, byte [ebp - 0xc1d]
test ecx, ecx
je 0x4276bb
mov edx, dword [ebp - 0xc54]
mov eax, dword [edx]
mov dword [ebp - 0xd64], eax
mov ecx, dword [ebp - 0xd64]
mov dword [ebp - 0xc68], ecx
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0xd68], edx
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xd74], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0xc48]
mov dword [ebp - 0xc70], edx
mov eax, dword [ebp - 0xc48]
cmp dword [eax + 0x14], 7
jbe 0x427700
mov dword [ebp - 0xc9c], 1
jmp 0x42770a
mov dword [ebp - 0xc9c], 0
mov cl, byte [ebp - 0xc9c]
mov byte [ebp - 0xc1e], cl
movzx edx, byte [ebp - 0xc1e]
test edx, edx
je 0x42773b
mov eax, dword [ebp - 0xc48]
mov ecx, dword [eax]
mov dword [ebp - 0xd6c], ecx
mov edx, dword [ebp - 0xd6c]
mov dword [ebp - 0xc70], edx
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0xd70], eax
mov ecx, dword [ebp - 0xd70]
mov dword [ebp - 0xd78], ecx
push 1
push 0
mov edx, dword [ebp - 0xd74]
push edx
mov eax, dword [ebp - 0xd78]
push eax
push 0x57b830
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc18]
call fcn.00424f70
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4b4]
call fcn.004557f6
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x88]
call fcn.00405e70
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x70]
call fcn.00405e70
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x28]
call fcn.0040f520
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x58]
call fcn.00405e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdb4]
call fcn.00418a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xca8]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00510479
mov esp, ebp
pop ebp
ret 0x18