Function at 0x42b6dc
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c4
lea ebp, [esp - 0x74]
call fcn.004aec00
mov dword [ebp + 0x6c], ecx
lea ecx, [ebp + 0x7c]
call fcn.0040fa1e
and dword [ebp + 0x5c], 0
and dword [ebp + 0x40], 0
mov dword [ebp + 0x58], 1
mov dword [ebp + 0x24], 0xfffffff6
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x4f], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x28], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0x2a
jne 0x42b741
mov byte [ebp + 0x73], 0x2d
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
push ebx
push esi
push edi
push 0x40
pop edi
jne 0x42b9ab
mov esi, dword [ebp + 0x7c]
lea edx, [esi + 2]
xor ebx, ebx
mov bx, word [edx]
cmp bx, 0x41
jb 0x42b982
cmp bx, 0x2a
je 0x42b982
mov eax, ebx
call fcn.00414b24
test al, al
jne 0x42b982
cmp cl, 0x2d
jne 0x42b79a
mov al, bl
or al, 0x20
cmp al, 0x63
jne 0x42b79a
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x6d
je 0x42b982
cmp cl, 0x2a
jne 0x42b7ae
mov eax, ebx
call fcn.0040fa34
test al, al
jne 0x42b982
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c7200
mov dword [ebp + 0x7c], edx
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b7d1
mov byte [ebp + 0x71], 1
jmp 0x42b974
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b7f1
mov byte [ebp + 0x4f], 1
jmp 0x42b974
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c2eb0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b811
mov byte [ebp + 0x68], 1
jmp 0x42b974
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b831
mov byte [ebp + 0x68], 0x41
jmp 0x42b974
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b851
mov byte [ebp + 0x68], 0x10
jmp 0x42b974
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b871
mov byte [ebp + 0x68], 0x50
jmp 0x42b974
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b894
mov dword [ebp + 0x5c], 0x10000
jmp 0x42b974
push 5
push dword [ebp + 0x7c]
push str.scan:
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x42b8b6
add dword [ebp + 0x7c], 0xa
lea eax, [ebp + 0x24]
jmp 0x42b95d
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b8d9
mov dword [ebp + 0x24], 0x1000
jmp 0x42b974
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c62d0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b8f5
mov dword [ebp + 0x40], edi
jmp 0x42b974
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b923
push 1
call fcn.00440627
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x42bdec
jmp 0x42b974
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42b940
mov byte [ebp + 0x72], 1
jmp 0x42b974
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x42b96a
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00451e7f
pop ecx
jmp 0x42b973
lea eax, [ebp + 0x7c]
push eax
call fcn.00409344
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
je 0x42b752
cmp byte [ebp + 0x72], 0
je 0x42b9ab
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x4dce78]
setne cl
push ecx
push 0x4dd4a4
call fcn.00413111
pop ecx
pop ecx
jmp 0x42c3fb
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x42b9d0
cmp byte [eax + 2], 0x2d
jne 0x42b9d0
mov ax, word [eax + 4]
call fcn.0040fa34
test al, al
je 0x42b9d0
lea eax, [ebp + 0x7c]
push eax
call fcn.00409344
pop ecx
cmp byte [ebp + 0x68], 0
je 0x42bae7
push 0x4ddd50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x60]
call fcn.0040fef7
mov esi, dword [ebp + 0x68]
and esi, edi
push esi
call fcn.00412614
test eax, eax
pop ecx
mov dword [ebp + 0x5c], eax
jne 0x42ba13
push esi
push dword [ebp + 0x6c]
call fcn.00419260
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
test eax, eax
mov dword [ebp + 0x58], 1
je 0x42bac8
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00444f8a
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x42ba5f
push dword [ebp + 0x14]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.0043fa7d
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.0043fad8
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.0043e825
cmp dword [ebp + 0x60], 0
je 0x42bad7
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4ddd50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x42c3f8
xor esi, esi
cmp dword [ebp + 0x24], esi
jl 0x42bbcb
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x5c], 0x4c6350
call fcn.00444f6c
mov eax, dword [ebp + 0x7c]
cmp word [eax], si
je 0x42bb21
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x40]
add esp, 0xc
mov dword [ebp + 0x5c], eax
push 0x3f
xor eax, eax
mov byte [ebp - 0x14c], 0
pop ecx
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 0x24]
mov edi, 0x100
cmp eax, edi
mov word [ebp - 0x4150], si
jae 0x42bb78
movzx eax, byte [ebp + eax - 0x14c]
push eax
lea eax, [ebp - 0x4150]
push 0x4c7158
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42bba0
xor esi, esi
lea ebx, [ebp - 0x4150]
movzx eax, byte [ebp + esi - 0x14c]
push eax
push 0x4c7158
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add ebx, 0xa
cmp esi, edi
jl 0x42bb80
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x3752], 0
lea eax, [ebp - 0x4150]
push eax
push dword [ebp + 0x5c]
call fcn.00444692
lea ecx, [ebp + 0x40]
call fcn.0043e825
and dword [ebp + 0x58], 0
jmp 0x42c3be
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x48], 0xfffffc18
jne 0x42bc0d
lea eax, [edx + 2]
mov cx, word [eax]
or cx, 0x20
cmp cx, 0x63
je 0x42bc0d
cmp cx, 0x64
je 0x42bc0d
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x67], 1
call fcn.0040fa1e
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
push 2
pop ebx
jne 0x42bc22
mov al, byte [edx]
add edx, ebx
mov byte [ebp + 0x73], al
mov dword [ebp + 0x7c], edx
jmp 0x42bc26
mov byte [ebp + 0x73], 0
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.00414a48
add esp, 4
test al, al
je 0x42bcc7
fld qword [0x4c7150]
lea eax, [ebp + 0x60]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x54]
push eax
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x54], edx
call fcn.00451e7f
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x42bc70
mov ax, word [ecx]
call fcn.0043e785
test al, al
jne 0x42bc75
add ecx, ebx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x54]
jb 0x42bc5f
cmp dword [ebp + 0x60], 0
jl 0x42bcb8
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x60]
mov dword [ebp + 0x68], edi
jne 0x42bcb8
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004480f6
fld qword [ebp + 0x38]
fcomp qword [0x4c59f0]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x42bd50
fld qword [ebp + 0x38]
fadd qword [0x4c7148]
jmp 0x42bd3e
lea eax, [ebp + 0x7c]
push eax
call fcn.00409344
pop ecx
jmp 0x42bd50
cmp cx, 0x28
jne 0x42bd53
fld qword [0x4c7150]
lea eax, [ebp + 0x38]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x7c]
push eax
call fcn.00448408
test eax, eax
pop ecx
pop ecx
jle 0x42bd50
fld qword [ebp + 0x38]
fcomp qword [0x4c59f0]
fnstsw ax
test ah, 1
jne 0x42bd50
fld qword [ebp + 0x38]
fadd qword [0x4c7148]
fld st(0)
call fcn.004aee58
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.004aee58
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
fild qword [ebp + 0x38]
fsubp st(1)
fcom qword [0x4c7140]
fnstsw ax
test ah, 0x41
jne 0x42bd4e
fcom qword [0x4c7138]
fnstsw ax
test ah, 5
jp 0x42bd4e
fmul qword [0x4c7130]
call fcn.004aee58
mov dword [ebp + 0x48], eax
jmp 0x42bd50
fstp st(0)
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2a
je 0x42bedc
cmp edi, esi
jne 0x42bd6b
cmp dword [ebp + 0x48], 0
jl 0x42bedc
and word [ebp - 0x4a], 0
and word [ebp - 0x4c], 0
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x60], 0x4c6350
call fcn.00444f6c
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x42bdae
add dword [ebp + 0x7c], ebx
push 0x2c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x54]
add esp, 0xc
cmp word [eax], 0
je 0x42bdae
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x67], 0
jne 0x42be1d
xor edx, edx
cmp edi, edx
jne 0x42bdc1
cmp dword [ebp + 0x48], edx
jle 0x42be19
cmp edi, edx
jl 0x42bec2
cmp byte [ebp + 0x73], 0
je 0x42bdf3
push edi
mov dword [ebp + 0x58], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x42bec2
lea ecx, [ebp + 0x54]
call fcn.0043e825
xor eax, eax
jmp 0x42c3fb
mov ecx, dword [ebp + 0x48]
cmp ecx, edx
jg 0x42bdfc
xor ecx, ecx
cmp edi, edx
jle 0x42be04
mov eax, edi
jmp 0x42be06
xor eax, eax
push edx
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.004161d8
mov dword [ebp + 0x58], eax
jmp 0x42bec2
mov eax, ebx
jmp 0x42be20
xor eax, eax
inc eax
or eax, dword [ebp + 0x5c]
push eax
push edi
call fcn.0041af29
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x42be47
cmp ebx, 0x60
jl 0x42be47
cmp ebx, 0x69
jg 0x42be47
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4c1b20
jle 0x42be66
push ebx
lea eax, [ebp - 0x4c]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x4c]
jmp 0x42be6b
mov eax, 0x4c7128
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.00444692
test ebx, ebx
jle 0x42beae
cmp ebx, 0x41
jl 0x42be87
cmp ebx, 0x5a
jle 0x42be94
push ebx
call fcn.00414a48
add esp, 4
test al, al
je 0x42bea3
and word [ebp - 0x4a], 0
movsx ax, bl
mov word [ebp - 0x4c], ax
jmp 0x42beae
push ebx
lea eax, [ebp - 0x4c]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x60]
call fcn.00444692
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040fa1e
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x67], 0
call fcn.0043e825
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0
je 0x42c3be
mov ecx, dword [ebp + 0x7c]
xor ebx, ebx
mov dword [ebp + 0x50], ebx
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x71], bl
mov byte [ebp + 0x72], bl
jne 0x42bf16
mov eax, dword [ebp + 0x14]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x50], eax
jmp 0x42bf0d
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x42bf0a
cmp esi, ebx
jle 0x42bf85
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x42bf2d
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x50], ebx
jmp 0x42bf85
cmp ax, 0x3d
jne 0x42bf39
mov byte [ebp + 0x71], 1
jmp 0x42bf43
cmp ax, 0x24
jne 0x42bf4b
mov byte [ebp + 0x72], 2
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x50], ebx
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00414a48
add esp, 4
test al, al
je 0x42bf6d
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00451e7f
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x42bf85
cmp byte [ebp + 0x72], 0
jne 0x42bf85
push esi
push dword [ebp + 0x50]
call fcn.0041301f
pop ecx
pop ecx
mov dword [ebp + 0x50], eax
or dword [ebp + 0x30], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040fa1e
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x42bfa6
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x73], cl
mov dword [ebp + 0x7c], eax
jmp 0x42bfaa
mov byte [ebp + 0x73], 0
movzx eax, word [eax]
push eax
call fcn.00414a48
add esp, 4
test al, al
je 0x42bfc9
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00451e7f
pop ecx
pop ecx
cmp byte [ebp + 0x72], 0
mov dword [ebp + 0x10], ebx
jne 0x42bfda
lea edi, [ebp + 0x10]
mov dword [ebp + 0x48], edi
jmp 0x42bfe2
lea eax, [ebp + 0x50]
mov dword [ebp + 0x48], eax
mov edi, eax
cmp byte [ebp + 0x72], 0
mov dword [ebp + 0x58], ebx
jne 0x42bff7
cmp dword [ebp + 0x50], ebx
jne 0x42c002
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x50], ebx
je 0x42c02e
cmp byte [ebp + 0x72], 0
jne 0x42c02e
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x50]
push ebx
push 0x100000
je 0x42c019
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x42c01f
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x42c02e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.00444f8a
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x2c]
call fcn.0044e878
push 0x5c
push dword [ebp + 0x2c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040fa1e
lea ecx, [ebp + 0x18]
call fcn.004451da
mov dword [ebp + 0x3c], ebx
jmp 0x42c1ba
cmp byte [0x4db2d4], 0
jle 0x42c1ce
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42c0e1
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00451e7f
cmp dword [ebp + 0x28], ebx
pop ecx
pop ecx
jge 0x42c1ba
mov dword [ebp + 0x28], ebx
jmp 0x42c1ba
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.00446fac
add esp, 0xc
test al, al
je 0x42c199
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x34], eax
push 1
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x5c], ebx
call fcn.0041a4ff
add esp, 0xc
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x7c], eax
call fcn.00444f6c
lea ecx, [ebp + 0x60]
call fcn.00444f6c
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x60]
push dword [ebp + 0x34]
call fcn.00445090
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x60]
call fcn.00413660
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.0043e825
cmp dword [ebp + 0x5c], ebx
jle 0x42c187
push 4
call fcn.004aea68
cmp eax, ebx
pop ecx
je 0x42c16b
mov ecx, dword [ebp + 0x54]
mov dword [eax], ecx
mov dword [ebp + 0x54], ebx
mov esi, eax
jmp 0x42c16d
xor esi, esi
push 4
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x20]
call fcn.0044519d
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x20]
lea ecx, [ebp + 0x7c]
call fcn.0040fa1e
lea ecx, [ebp + 0x54]
call fcn.0043e825
jmp 0x42c1ba
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x42c1c8
lea eax, [ebp + 0x7c]
push eax
call fcn.00409344
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x42c09d
jmp 0x42c1ce
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x3c], eax
cmp byte [ebp + 0x67], 0
je 0x42c1d7
neg dword [ebp + 0x68]
cmp dword [ebp + 0x40], ebx
jne 0x42c1e9
cmp dword [edi], ebx
je 0x42c1e9
push dword [ebp + 0x44]
call fcn.0041216b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], ebx
je 0x42c27c
jmp 0x42c273
cmp dword [ebp + 0x68], ebx
je 0x42c27c
mov edi, 0x3e8
jle 0x42c21f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x42c27c
cmp ecx, edi
jge 0x42c21f
mov edi, ecx
push 0x4ff
push edi
push ebx
push dword [ebp + 0x48]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x42c27c
push 0x64
pop edi
jmp 0x42c26a
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42c273
dec edi
je 0x42c273
cmp dword [ebp - 8], 0x12
je 0x42c273
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4db2d4], 0
jg 0x42c23a
cmp byte [0x4db2d4], 0
jg 0x42c1fe
cmp dword [ebp + 0x30], ebx
jl 0x42c29f
cmp byte [ebp + 0x73], 0
je 0x42c292
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42c29f
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x30]
call fcn.004161d8
cmp dword [ebp + 0x20], ebx
jle 0x42c366
cmp byte [0x4db2d4], 0
jle 0x42c366
cmp dword [ebp + 0x40], ebx
jne 0x42c2c3
push dword [ebp + 0x44]
call fcn.0041216b
pop ecx
cmp dword [ebp + 0x20], ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x5c], eax
jle 0x42c366
cmp byte [0x4db2d4], 0
jle 0x42c366
mov eax, dword [ebp + 0x20]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x60], eax
jle 0x42c366
cmp byte [0x4db2d4], 0
jle 0x42c34a
mov eax, dword [ebp + 0x5c]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x42c342
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.0042971f
mov eax, dword [esi]
push dword [eax]
call fcn.004adeef
test edx, edx
pop ecx
jg 0x42c33c
jl 0x42c323
test eax, eax
ja 0x42c33c
mov ebx, dword [esi]
test ebx, ebx
je 0x42c337
mov ecx, ebx
call fcn.0043e825
push ebx
call fcn.004ae964
pop ecx
and dword [esi], 0
jmp 0x42c342
lea eax, [edi + 1]
mov dword [ebp + 0x34], eax
inc edi
xor ebx, ebx
cmp edi, dword [ebp + 0x60]
jl 0x42c2ee
mov esi, dword [ebp + 0x34]
cmp esi, ebx
jle 0x42c366
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x28]
call fcn.004161d8
mov dword [ebp + 0x20], esi
jmp 0x42c2d2
cmp dword [ebp + 0x40], ebx
jne 0x42c37b
mov eax, dword [ebp + 0x48]
cmp dword [eax], ebx
je 0x42c37b
push dword [ebp + 0x2c]
call fcn.0041216b
pop ecx
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
je 0x42c396
cmp word [eax], bx
je 0x42c396
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push ebx
push eax
call fcn.00434146
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x18]
call fcn.004a636c
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 0x2c]
call fcn.0043e825
lea ecx, [ebp + 0x44]
call fcn.0043e825
lea ecx, [ebp + 0x10]
call fcn.00402cc5
cmp byte [ebp + 0x4f], 0
je 0x42c3ee
call fcn.0041a807
test eax, eax
je 0x42c3e6
push dword [ebp + 0x6c]
call fcn.00412d46
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.0041a833
pop ecx
pop ecx
push 0
call fcn.00416e09
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.0046ea3b
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4