Function at 0x42b03b
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c4
lea ebp, [esp - 0x74]
call fcn.004aa480
mov dword [ebp + 0x6c], ecx
lea ecx, [ebp + 0x7c]
call fcn.0040f4e0
and dword [ebp + 0x5c], 0
and dword [ebp + 0x40], 0
mov dword [ebp + 0x58], 1
mov dword [ebp + 0x24], 0xfffffff6
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x4f], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x28], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0x2a
jne 0x42b0a0
mov byte [ebp + 0x73], 0x2d
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
push ebx
push esi
push edi
push 0x40
pop edi
jne 0x42b30a
mov esi, dword [ebp + 0x7c]
lea edx, [esi + 2]
xor ebx, ebx
mov bx, word [edx]
cmp bx, 0x41
jb 0x42b2e1
cmp bx, 0x2a
je 0x42b2e1
mov eax, ebx
call fcn.00443d5b
test al, al
jne 0x42b2e1
cmp cl, 0x2d
jne 0x42b0f9
mov al, bl
or al, 0x20
cmp al, 0x63
jne 0x42b0f9
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x6d
je 0x42b2e1
cmp cl, 0x2a
jne 0x42b10d
mov eax, ebx
call fcn.0040f4f6
test al, al
jne 0x42b2e1
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c2128
mov dword [ebp + 0x7c], edx
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b130
mov byte [ebp + 0x71], 1
jmp 0x42b2d3
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b150
mov byte [ebp + 0x4f], 1
jmp 0x42b2d3
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4bddf0
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b170
mov byte [ebp + 0x68], 1
jmp 0x42b2d3
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b190
mov byte [ebp + 0x68], 0x41
jmp 0x42b2d3
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b1b0
mov byte [ebp + 0x68], 0x10
jmp 0x42b2d3
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b1d0
mov byte [ebp + 0x68], 0x50
jmp 0x42b2d3
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b1f3
mov dword [ebp + 0x5c], 0x10000
jmp 0x42b2d3
push 5
push dword [ebp + 0x7c]
push str.scan:
call fcn.0043f11b
add esp, 0xc
test al, al
je 0x42b215
add dword [ebp + 0x7c], 0xa
lea eax, [ebp + 0x24]
jmp 0x42b2bc
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b238
mov dword [ebp + 0x24], 0x1000
jmp 0x42b2d3
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c1230
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b254
mov dword [ebp + 0x40], edi
jmp 0x42b2d3
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b282
push 1
call fcn.0043faf8
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x42b74b
jmp 0x42b2d3
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42b29f
mov byte [ebp + 0x72], 1
jmp 0x42b2d3
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0043f11b
add esp, 0xc
test al, al
je 0x42b2c9
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004504ce
pop ecx
jmp 0x42b2d2
lea eax, [ebp + 0x7c]
push eax
call fcn.00408ddd
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
je 0x42b0b1
cmp byte [ebp + 0x72], 0
je 0x42b30a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x4d7e68]
setne cl
push ecx
push 0x4d8494
call fcn.00412b2f
pop ecx
pop ecx
jmp 0x42bd5a
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x42b32f
cmp byte [eax + 2], 0x2d
jne 0x42b32f
mov ax, word [eax + 4]
call fcn.0040f4f6
test al, al
je 0x42b32f
lea eax, [ebp + 0x7c]
push eax
call fcn.00408ddd
pop ecx
cmp byte [ebp + 0x68], 0
je 0x42b446
push 0x4d8d1c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x60]
call fcn.0040f9cf
mov esi, dword [ebp + 0x68]
and esi, edi
push esi
call fcn.00412032
test eax, eax
pop ecx
mov dword [ebp + 0x5c], eax
jne 0x42b372
push esi
push dword [ebp + 0x6c]
call fcn.00418c02
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
test eax, eax
mov dword [ebp + 0x58], 1
je 0x42b427
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.004441bf
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x42b3be
push dword [ebp + 0x14]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.0043ef9c
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.0043efe8
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.0043dd41
cmp dword [ebp + 0x60], 0
je 0x42b436
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4d8d1c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x42bd57
xor esi, esi
cmp dword [ebp + 0x24], esi
jl 0x42b52a
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x5c], str.PressKey
call fcn.004441a1
mov eax, dword [ebp + 0x7c]
cmp word [eax], si
je 0x42b480
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x40]
add esp, 0xc
mov dword [ebp + 0x5c], eax
push 0x3f
xor eax, eax
mov byte [ebp - 0x14c], 0
pop ecx
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 0x24]
mov edi, 0x100
cmp eax, edi
mov word [ebp - 0x4150], si
jae 0x42b4d7
movzx eax, byte [ebp + eax - 0x14c]
push eax
lea eax, [ebp - 0x4150]
push str.0x_02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42b4ff
xor esi, esi
lea ebx, [ebp - 0x4150]
movzx eax, byte [ebp + esi - 0x14c]
push eax
push str.0x_02X
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add ebx, 0xa
cmp esi, edi
jl 0x42b4df
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x3752], 0
lea eax, [ebp - 0x4150]
push eax
push dword [ebp + 0x5c]
call fcn.004438ac
lea ecx, [ebp + 0x40]
call fcn.0043dd41
and dword [ebp + 0x58], 0
jmp 0x42bd1d
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x48], 0xfffffc18
jne 0x42b56c
lea eax, [edx + 2]
mov cx, word [eax]
or cx, 0x20
cmp cx, 0x63
je 0x42b56c
cmp cx, 0x64
je 0x42b56c
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x67], 1
call fcn.0040f4e0
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
push 2
pop ebx
jne 0x42b581
mov al, byte [edx]
add edx, ebx
mov byte [ebp + 0x73], al
mov dword [ebp + 0x7c], edx
jmp 0x42b585
mov byte [ebp + 0x73], 0
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.00443c3d
add esp, 4
test al, al
je 0x42b626
fld qword [0x4c2078]
lea eax, [ebp + 0x60]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x54]
push eax
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x54], edx
call fcn.004504ce
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x42b5cf
mov ax, word [ecx]
call fcn.0040f4c7
test al, al
jne 0x42b5d4
add ecx, ebx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x54]
jb 0x42b5be
cmp dword [ebp + 0x60], 0
jl 0x42b617
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x60]
mov dword [ebp + 0x68], edi
jne 0x42b617
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004471b3
fld qword [ebp + 0x38]
fcomp qword [0x4c0950]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x42b6af
fld qword [ebp + 0x38]
fadd qword [0x4c2070]
jmp 0x42b69d
lea eax, [ebp + 0x7c]
push eax
call fcn.00408ddd
pop ecx
jmp 0x42b6af
cmp cx, 0x28
jne 0x42b6b2
fld qword [0x4c2078]
lea eax, [ebp + 0x38]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x7c]
push eax
call fcn.004474c5
test eax, eax
pop ecx
pop ecx
jle 0x42b6af
fld qword [ebp + 0x38]
fcomp qword [0x4c0950]
fnstsw ax
test ah, 1
jne 0x42b6af
fld qword [ebp + 0x38]
fadd qword [0x4c2070]
fld st(0)
call fcn.004aa5f4
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.004aa5f4
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
fild qword [ebp + 0x38]
fsubp st(1)
fcom qword [0x4c2068]
fnstsw ax
test ah, 0x41
jne 0x42b6ad
fcom qword [0x4c2060]
fnstsw ax
test ah, 5
jp 0x42b6ad
fmul qword [0x4c2058]
call fcn.004aa5f4
mov dword [ebp + 0x48], eax
jmp 0x42b6af
fstp st(0)
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2a
je 0x42b83b
cmp edi, esi
jne 0x42b6ca
cmp dword [ebp + 0x48], 0
jl 0x42b83b
and word [ebp - 0x4a], 0
and word [ebp - 0x4c], 0
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x60], str.PressKey
call fcn.004441a1
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x42b70d
add dword [ebp + 0x7c], ebx
push 0x2c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x54]
add esp, 0xc
cmp word [eax], 0
je 0x42b70d
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x67], 0
jne 0x42b77c
xor edx, edx
cmp edi, edx
jne 0x42b720
cmp dword [ebp + 0x48], edx
jle 0x42b778
cmp edi, edx
jl 0x42b821
cmp byte [ebp + 0x73], 0
je 0x42b752
push edi
mov dword [ebp + 0x58], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x42b821
lea ecx, [ebp + 0x54]
call fcn.0043dd41
xor eax, eax
jmp 0x42bd5a
mov ecx, dword [ebp + 0x48]
cmp ecx, edx
jg 0x42b75b
xor ecx, ecx
cmp edi, edx
jle 0x42b763
mov eax, edi
jmp 0x42b765
xor eax, eax
push edx
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.00415bb5
mov dword [ebp + 0x58], eax
jmp 0x42b821
mov eax, ebx
jmp 0x42b77f
xor eax, eax
inc eax
or eax, dword [ebp + 0x5c]
push eax
push edi
call fcn.0041bbae
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x42b7a6
cmp ebx, 0x60
jl 0x42b7a6
cmp ebx, 0x69
jg 0x42b7a6
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4bcb04
jle 0x42b7c5
push ebx
lea eax, [ebp - 0x4c]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x4c]
jmp 0x42b7ca
mov eax, 0x4c2050
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.004438ac
test ebx, ebx
jle 0x42b80d
cmp ebx, 0x41
jl 0x42b7e6
cmp ebx, 0x5a
jle 0x42b7f3
push ebx
call fcn.00443c3d
add esp, 4
test al, al
je 0x42b802
and word [ebp - 0x4a], 0
movsx ax, bl
mov word [ebp - 0x4c], ax
jmp 0x42b80d
push ebx
lea eax, [ebp - 0x4c]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x60]
call fcn.004438ac
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040f4e0
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x67], 0
call fcn.0043dd41
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0
je 0x42bd1d
mov ecx, dword [ebp + 0x7c]
xor ebx, ebx
mov dword [ebp + 0x50], ebx
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x71], bl
mov byte [ebp + 0x72], bl
jne 0x42b875
mov eax, dword [ebp + 0x14]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x50], eax
jmp 0x42b86c
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x42b869
cmp esi, ebx
jle 0x42b8e4
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x42b88c
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x50], ebx
jmp 0x42b8e4
cmp ax, 0x3d
jne 0x42b898
mov byte [ebp + 0x71], 1
jmp 0x42b8a2
cmp ax, 0x24
jne 0x42b8aa
mov byte [ebp + 0x72], 2
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x50], ebx
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00443c3d
add esp, 4
test al, al
je 0x42b8cc
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004504ce
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x42b8e4
cmp byte [ebp + 0x72], 0
jne 0x42b8e4
push esi
push dword [ebp + 0x50]
call fcn.00412a3d
pop ecx
pop ecx
mov dword [ebp + 0x50], eax
or dword [ebp + 0x30], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040f4e0
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x42b905
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x73], cl
mov dword [ebp + 0x7c], eax
jmp 0x42b909
mov byte [ebp + 0x73], 0
movzx eax, word [eax]
push eax
call fcn.00443c3d
add esp, 4
test al, al
je 0x42b928
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004504ce
pop ecx
pop ecx
cmp byte [ebp + 0x72], 0
mov dword [ebp + 0x10], ebx
jne 0x42b939
lea edi, [ebp + 0x10]
mov dword [ebp + 0x48], edi
jmp 0x42b941
lea eax, [ebp + 0x50]
mov dword [ebp + 0x48], eax
mov edi, eax
cmp byte [ebp + 0x72], 0
mov dword [ebp + 0x58], ebx
jne 0x42b956
cmp dword [ebp + 0x50], ebx
jne 0x42b961
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x50], ebx
je 0x42b98d
cmp byte [ebp + 0x72], 0
jne 0x42b98d
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x50]
push ebx
push 0x100000
je 0x42b978
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x42b97e
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x42b98d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.004441bf
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x2c]
call fcn.0044cf7e
push 0x5c
push dword [ebp + 0x2c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040f4e0
lea ecx, [ebp + 0x18]
call fcn.0044440f
mov dword [ebp + 0x3c], ebx
jmp 0x42bb19
cmp byte [0x4d62d4], 0
jle 0x42bb2d
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42ba40
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004504ce
cmp dword [ebp + 0x28], ebx
pop ecx
pop ecx
jge 0x42bb19
mov dword [ebp + 0x28], ebx
jmp 0x42bb19
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.004460ea
add esp, 0xc
test al, al
je 0x42baf8
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x34], eax
push 1
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x5c], ebx
call fcn.00419ea1
add esp, 0xc
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x7c], eax
call fcn.004441a1
lea ecx, [ebp + 0x60]
call fcn.004441a1
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x60]
push dword [ebp + 0x34]
call fcn.004442c5
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x60]
call fcn.0041307e
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.0043dd41
cmp dword [ebp + 0x5c], ebx
jle 0x42bae6
push 4
call fcn.004aa2e8
cmp eax, ebx
pop ecx
je 0x42baca
mov ecx, dword [ebp + 0x54]
mov dword [eax], ecx
mov dword [ebp + 0x54], ebx
mov esi, eax
jmp 0x42bacc
xor esi, esi
push 4
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x20]
call fcn.004443d2
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x20]
lea ecx, [ebp + 0x7c]
call fcn.0040f4e0
lea ecx, [ebp + 0x54]
call fcn.0043dd41
jmp 0x42bb19
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.004460ea
add esp, 0xc
test al, al
jne 0x42bb27
lea eax, [ebp + 0x7c]
push eax
call fcn.00408ddd
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x42b9fc
jmp 0x42bb2d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x3c], eax
cmp byte [ebp + 0x67], 0
je 0x42bb36
neg dword [ebp + 0x68]
cmp dword [ebp + 0x40], ebx
jne 0x42bb48
cmp dword [edi], ebx
je 0x42bb48
push dword [ebp + 0x44]
call fcn.00411b89
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], ebx
je 0x42bbdb
jmp 0x42bbd2
cmp dword [ebp + 0x68], ebx
je 0x42bbdb
mov edi, 0x3e8
jle 0x42bb7e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x42bbdb
cmp ecx, edi
jge 0x42bb7e
mov edi, ecx
push 0x4ff
push edi
push ebx
push dword [ebp + 0x48]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x42bbdb
push 0x64
pop edi
jmp 0x42bbc9
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42bbd2
dec edi
je 0x42bbd2
cmp dword [ebp - 8], 0x12
je 0x42bbd2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4d62d4], 0
jg 0x42bb99
cmp byte [0x4d62d4], 0
jg 0x42bb5d
cmp dword [ebp + 0x30], ebx
jl 0x42bbfe
cmp byte [ebp + 0x73], 0
je 0x42bbf1
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42bbfe
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x30]
call fcn.00415bb5
cmp dword [ebp + 0x20], ebx
jle 0x42bcc5
cmp byte [0x4d62d4], 0
jle 0x42bcc5
cmp dword [ebp + 0x40], ebx
jne 0x42bc22
push dword [ebp + 0x44]
call fcn.00411b89
pop ecx
cmp dword [ebp + 0x20], ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x5c], eax
jle 0x42bcc5
cmp byte [0x4d62d4], 0
jle 0x42bcc5
mov eax, dword [ebp + 0x20]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x60], eax
jle 0x42bcc5
cmp byte [0x4d62d4], 0
jle 0x42bca9
mov eax, dword [ebp + 0x5c]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x42bca1
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.0042907e
mov eax, dword [esi]
push dword [eax]
call fcn.004a976c
test edx, edx
pop ecx
jg 0x42bc9b
jl 0x42bc82
test eax, eax
ja 0x42bc9b
mov ebx, dword [esi]
test ebx, ebx
je 0x42bc96
mov ecx, ebx
call fcn.0043dd41
push ebx
call fcn.004aa1e4
pop ecx
and dword [esi], 0
jmp 0x42bca1
lea eax, [edi + 1]
mov dword [ebp + 0x34], eax
inc edi
xor ebx, ebx
cmp edi, dword [ebp + 0x60]
jl 0x42bc4d
mov esi, dword [ebp + 0x34]
cmp esi, ebx
jle 0x42bcc5
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x28]
call fcn.00415bb5
mov dword [ebp + 0x20], esi
jmp 0x42bc31
cmp dword [ebp + 0x40], ebx
jne 0x42bcda
mov eax, dword [ebp + 0x48]
cmp dword [eax], ebx
je 0x42bcda
push dword [ebp + 0x2c]
call fcn.00411b89
pop ecx
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
je 0x42bcf5
cmp word [eax], bx
je 0x42bcf5
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push ebx
push eax
call fcn.0043362f
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x18]
call fcn.00455fb5
lea ecx, [ebp + 0x18]
call fcn.0043dd41
lea ecx, [ebp + 0x2c]
call fcn.0043dd41
lea ecx, [ebp + 0x44]
call fcn.0043dd41
lea ecx, [ebp + 0x10]
call fcn.00402c9f
cmp byte [ebp + 0x4f], 0
je 0x42bd4d
call fcn.0041a1a9
test eax, eax
je 0x42bd45
push dword [ebp + 0x6c]
call fcn.00412764
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.0041a1d5
pop ecx
pop ecx
push 0
call fcn.004167e6
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.0046be18
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4