Function at 0x423400
Capabilities:
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create process suspended
Delete file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x451c7c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x18], eax
add eax, 0x2d8
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x42433a
mov ebp, 2
cmp dword [0x4628e0], ebp
jne 0x42357c
push ebp
lea ecx, [esp + 0x50]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x50], esp
cmp eax, 0x10
jb 0x4234af
mov ecx, dword [edi]
jmp 0x4234b1
mov ecx, edi
cmp ecx, 0x4574a0
ja 0x4234eb
cmp eax, 0x10
jb 0x4234c2
mov ecx, dword [edi]
jmp 0x4234c4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4574a0
jbe 0x4234eb
cmp eax, 0x10
jb 0x4234d8
mov edi, dword [edi]
push ebp
mov eax, 0x4574a0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x423527
cmp eax, ebp
jae 0x4234fb
mov ecx, dword [esi + 0x14]
push ecx
push ebp
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x423507
mov eax, dword [edi]
jmp 0x423509
mov eax, edi
push ebp
push 0x4574a0
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], ebp
jb 0x423524
mov edi, dword [edi]
mov byte [edi + 2], bl
lea esi, [esp + 0x100]
call fcn.004014e0
mov dword [esp + 0x1fc], 0
mov ecx, eax
mov dword [esp + 0x30], 1
call fcn.00401760
cmp dword [eax + 0x18], 0x10
mov ebx, 3
jb 0x42355d
mov eax, dword [eax + 4]
jmp 0x423560
add eax, 4
mov edx, dword [0x4628e4]
push eax
mov eax, dword [edx + 4]
push eax
call fcn.0043b77e
add esp, 0xc
mov byte [esp + 0x17], 1
test eax, eax
je 0x423581
mov byte [esp + 0x17], 0
mov ebp, 0x10
test bl, 2
je 0x4235b6
and ebx, 0xfffffffd
cmp dword [esp + 0x64], ebp
jb 0x4235a1
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
mov dword [esp + 0x1f4], 0xffffffff
test bl, 1
je 0x4235d2
lea esi, [esp + 0xdc]
call fcn.004037a0
cmp byte [esp + 0x17], 0
jne 0x423f81
xor ebx, ebx
push ebx
push 0x100
lea edx, [esp + 0x54]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, ebp
jb 0x42360d
mov ecx, dword [edi]
jmp 0x42360f
mov ecx, edi
cmp ecx, 0x4574a4
ja 0x423648
cmp eax, ebp
jb 0x42361f
mov ecx, dword [edi]
jmp 0x423621
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4574a4
jbe 0x423648
cmp eax, ebp
jb 0x423634
mov edi, dword [edi]
push 0x14
mov eax, 0x4574a4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42368a
cmp eax, 0x14
jae 0x42365a
mov ecx, dword [esi + 0x14]
push ecx
push 0x14
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x423665
mov eax, dword [edi]
jmp 0x423667
mov eax, edi
push 0x14
push 0x4574a4
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x14
cmp dword [esi + 0x18], ebp
jb 0x423686
mov edi, dword [edi]
mov byte [edi + 0x14], 0
lea esi, [esp + 0x104]
call fcn.004014e0
mov ecx, eax
mov dword [esp + 0x200], 1
call fcn.00401760
mov byte [esp + 0x1fc], 2
cmp dword [eax + 0x18], ebp
jb 0x4236ba
mov eax, dword [eax + 4]
jmp 0x4236bd
add eax, 4
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0040f9b0
mov edi, dword [esp + 0x1c]
add edi, 0x244
push eax
mov byte [esp + 0x1fc], 3
mov dword [esp + 0x34], edi
call fcn.0042e710
movzx edi, al
add esp, 8
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], edi
mov byte [esp + 0x1f8], 2
call fcn.0040faa0
cmp dword [esp + 0x64], ebp
jb 0x423713
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0xdc]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], 0
call fcn.004037a0
mov dword [esp + 0x1c4], 0xf
mov dword [esp + 0x1c0], ebx
mov byte [esp + 0x1b0], 0
mov dword [esp + 0x1f4], 4
cmp edi, ebx
je 0x423a36
push ebx
lea edx, [esp + 0x34]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, ebp
jb 0x423787
mov ecx, dword [edi]
jmp 0x423789
mov ecx, edi
cmp ecx, 0x4574bc
ja 0x4237c2
cmp eax, ebp
jb 0x423799
mov ecx, dword [edi]
jmp 0x42379b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4574bc
jbe 0x4237c2
cmp eax, ebp
jb 0x4237ae
mov edi, dword [edi]
push 0xa
mov eax, 0x4574bc
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x423804
cmp eax, 0xa
jae 0x4237d4
mov ecx, dword [esi + 0x14]
push ecx
push 0xa
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x4237df
mov eax, dword [edi]
jmp 0x4237e1
mov eax, edi
push 0xa
push 0x4574bc
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0xa
cmp dword [esi + 0x18], ebp
jb 0x423800
mov edi, dword [edi]
mov byte [edi + 0xa], 0
lea esi, [esp + 0x158]
call fcn.004014e0
mov byte [esp + 0x1fc], 5
call fcn.004015b0
mov byte [esp + 0x1f8], 6
cmp dword [eax + 0x18], ebp
jb 0x42382f
mov eax, dword [eax + 4]
jmp 0x423832
add eax, 4
push eax
lea ecx, [esp + 0x70]
call fcn.00402930
push eax
push 0x100
lea edx, [esp + 0x1d4]
push edx
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x220], 7
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x4c], esp
cmp eax, ebp
jb 0x423876
mov ecx, dword [edi]
jmp 0x423878
mov ecx, edi
cmp ecx, 0x4574c8
ja 0x4238b1
cmp eax, ebp
jb 0x423888
mov ecx, dword [edi]
jmp 0x42388a
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4574c8
jbe 0x4238b1
cmp eax, ebp
jb 0x42389d
mov edi, dword [edi]
push 0xc
mov eax, 0x4574c8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x4238f3
cmp eax, 0xc
jae 0x4238c3
mov ecx, dword [esi + 0x14]
push ecx
push 0xc
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x4238ce
mov eax, dword [edi]
jmp 0x4238d0
mov eax, edi
push 0xc
push 0x4574c8
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0xc
cmp dword [esi + 0x18], ebp
jb 0x4238ef
mov edi, dword [edi]
mov byte [edi + 0xc], 0
lea esi, [esp + 0x108]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x204], 8
call fcn.00401760
mov bl, 9
mov byte [esp + 0x200], bl
cmp dword [eax + 0x18], ebp
jb 0x423921
mov eax, dword [eax + 4]
jmp 0x423924
add eax, 4
push eax
lea edx, [esp + 0x1a0]
push edx
call fcn.0040f9b0
mov esi, dword [esp + 0x34]
push eax
lea edi, [esp + 0x58]
mov byte [esp + 0x200], 0xa
call fcn.0042e7b0
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x200], 0xb
call fcn.00402be0
cmp dword [esp + 0x64], ebp
jb 0x423977
mov eax, dword [esp + 0x50]
push eax
call fcn.00439c49
add esp, 4
lea ecx, [esp + 0x190]
mov edi, 0xf
xor esi, esi
push ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], esi
mov byte [esp + 0x54], 0
mov byte [esp + 0x1f8], bl
call fcn.0040faa0
cmp dword [esp + 0x1e0], ebp
jb 0x4239b8
mov edx, dword [esp + 0x1cc]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x1dc], esi
lea esi, [esp + 0xdc]
mov dword [esp + 0x1e0], edi
mov byte [esp + 0x1cc], 0
call fcn.004037a0
cmp dword [esp + 0x80], ebp
jb 0x4239f0
mov eax, dword [esp + 0x6c]
push eax
call fcn.00439c49
add esp, 4
xor esi, esi
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], esi
mov byte [esp + 0x6c], 0
cmp dword [esp + 0x48], ebp
jb 0x423a15
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x44], esi
lea esi, [esp + 0x134]
mov dword [esp + 0x48], edi
mov byte [esp + 0x34], 0
mov byte [esp + 0x1f4], 4
call fcn.004037a0
mov ebx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
xor ebp, ebp
add eax, edx
je 0x423e35
mov esi, ebx
push ebp
mov eax, esi
call fcn.0042b7b0
cmp dword [eax + 0x74], 0xffffffff
je 0x423e01
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
lea edx, [eax + 1]
jmp 0x423a80
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423a80
sub eax, edx
je 0x423a90
call fcn.00419650
mov eax, dword [esp + 0x18]
lea ebx, [eax + 0x2c0]
push ebp
add eax, 0x2d8
call fcn.0042b7b0
mov eax, dword [eax + 0x74]
mov ecx, ebx
call fcn.0042b690
add eax, 0x1c
cmp dword [eax + 0x14], 0
je 0x423c7b
mov eax, dword [esp + 0x18]
push ebp
add eax, 0x2d8
call fcn.0042b7b0
mov eax, dword [eax + 0x74]
mov ecx, ebx
call fcn.0042b690
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1b4], 0xf
mov dword [esp + 0x1b0], 0
mov byte [esp + 0x1a0], 0
call fcn.00402be0
mov byte [esp + 0x1f4], 0xc
mov eax, dword [esp + 0x1a4]
test eax, eax
je 0x423b57
lea esi, [eax - 1]
cmp eax, esi
ja 0x423b26
call fcn.00438c11
cmp dword [esp + 0x1a8], 0x10
mov eax, dword [esp + 0x194]
jae 0x423b3e
lea eax, [esp + 0x194]
cmp byte [eax + esi], 0x5c
je 0x423b57
push 0x5c
mov eax, 1
lea edi, [esp + 0x194]
call fcn.00412960
call fcn.00417a70
mov ecx, eax
mov eax, 0x7c97d911
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x107
jle 0x423b8c
push 0x107
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00419720
call fcn.004197b0
call fcn.00430df0
sub eax, 1
jne 0x423bad
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00419d50
mov edi, dword [esp + 0x18]
push ebp
lea eax, [edi + 0x2d8]
call fcn.0042b7b0
add eax, 0x3c
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0x198]
call fcn.00405750
lea eax, [edi + 0x244]
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x423be7
mov eax, dword [eax + 4]
jmp 0x423bea
add eax, 4
mov ecx, dword [esp + 0x194]
cmp dword [esp + 0x1a8], esi
jae 0x423c01
lea ecx, [esp + 0x194]
push eax
push ecx
call fcn.0043b18c
add esp, 8
test eax, eax
je 0x423f31
cmp dword [esp + 0x28], 0
je 0x423c5a
mov ecx, dword [esp + 0x1b0]
cmp dword [esp + 0x1c4], esi
jae 0x423c31
lea ecx, [esp + 0x1b0]
mov eax, dword [esp + 0x194]
cmp dword [esp + 0x1a8], esi
jae 0x423c48
lea eax, [esp + 0x194]
push ecx
push eax
call fcn.0043b18c
add esp, 8
test eax, eax
je 0x423f88
mov byte [esp + 0x1f4], 4
cmp dword [esp + 0x1a8], esi
jb 0x423c7b
mov edx, dword [esp + 0x194]
push edx
call fcn.00439c49
add esp, 4
mov eax, dword [esp + 0x18]
push ebp
add eax, 0x2d8
call fcn.0042b7b0
mov eax, dword [eax + 0x74]
mov ecx, ebx
call fcn.0042b690
cmp dword [eax + 0x14], 0
je 0x423e01
mov edi, dword [esp + 0x18]
push ebp
lea eax, [edi + 0x2d8]
call fcn.0042b7b0
mov eax, dword [eax + 0x74]
mov ecx, ebx
call fcn.0042b690
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1b4], 0xf
mov dword [esp + 0x1b0], 0
mov byte [esp + 0x1a0], 0
call fcn.00402be0
mov byte [esp + 0x1f4], 0xd
mov eax, dword [esp + 0x1a4]
test eax, eax
je 0x423d41
lea esi, [eax - 1]
cmp eax, esi
ja 0x423d06
call fcn.00438c11
mov eax, dword [esp + 0x194]
mov ebx, 0x10
cmp dword [esp + 0x1a8], ebx
jae 0x423d22
lea eax, [esp + 0x194]
cmp byte [eax + esi], 0x5c
je 0x423d46
push 0x5c
mov eax, 1
lea edi, [esp + 0x194]
call fcn.00412960
mov edi, dword [esp + 0x18]
jmp 0x423d46
mov ebx, 0x10
push ebp
lea eax, [edi + 0x2d8]
call fcn.0042b7b0
add eax, 0x3c
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0x198]
call fcn.00405750
cmp dword [edi + 0x25c], ebx
lea eax, [edi + 0x244]
jb 0x423d7a
mov eax, dword [eax + 4]
jmp 0x423d7d
add eax, 4
mov ecx, dword [esp + 0x194]
cmp dword [esp + 0x1a8], ebx
jae 0x423d94
lea ecx, [esp + 0x194]
push eax
push ecx
call fcn.0043b18c
add esp, 8
test eax, eax
je 0x423fa7
cmp dword [esp + 0x28], 0
je 0x423ded
mov ecx, dword [esp + 0x1b0]
cmp dword [esp + 0x1c4], ebx
jae 0x423dc4
lea ecx, [esp + 0x1b0]
mov eax, dword [esp + 0x194]
cmp dword [esp + 0x1a8], ebx
jae 0x423ddb
lea eax, [esp + 0x194]
push ecx
push eax
call fcn.0043b18c
add esp, 8
test eax, eax
je 0x423f88
lea ecx, [esp + 0x190]
mov byte [esp + 0x1f4], 4
call fcn.004029a0
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x2e8]
sub ecx, dword [esi + 0x2e4]
add esi, 0x2d8
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
cmp ebp, eax
jb 0x423a5d
mov ebx, esi
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], 0
je 0x424320
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push esi
mov eax, ebx
call fcn.0042b7b0
add eax, 0x58
xor edi, edi
cmp dword [eax + 0x14], edi
je 0x4242f6
push esi
mov eax, ebx
call fcn.0042b7b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
add eax, 0x58
push edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push eax
mov byte [ecx + 4], 0
call fcn.00402be0
push ebp
call fcn.0041cba0
cmp eax, edi
jl 0x4242f6
mov eax, dword [ebp + 0x17c]
cmp eax, edi
je 0x423f15
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x424369
mov dword [ebp + 0x17c], edi
call fcn.00417970
sub eax, 1
jne 0x423ee6
call fcn.004198f0
call fcn.00419990
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423f00
sub eax, edx
je 0x423f15
call fcn.00406ed0
call fcn.00406ed0
mov ebx, 0x10
cmp dword [ebp + 0x198], ebx
jb 0x423ffe
mov eax, dword [ebp + 0x184]
jmp 0x424004
cmp dword [esp + 0x1a8], esi
jb 0x423f4a
mov ecx, dword [esp + 0x194]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x1a8], 0xf
mov dword [esp + 0x1a4], 0
mov byte [esp + 0x194], 0
cmp dword [esp + 0x1c4], esi
jb 0x423f81
mov edx, dword [esp + 0x1b0]
push edx
call fcn.00439c49
add esp, 4
xor eax, eax
jmp 0x42433f
lea ecx, [esp + 0x190]
call fcn.004029a0
lea ecx, [esp + 0x1ac]
call fcn.004029a0
xor eax, eax
jmp 0x42433f
cmp dword [esp + 0x1a8], ebx
jb 0x423fc0
mov eax, dword [esp + 0x194]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x1a8], 0xf
mov dword [esp + 0x1a4], 0
mov byte [esp + 0x194], 0
cmp dword [esp + 0x1c4], ebx
jb 0x423f81
mov ecx, dword [esp + 0x1b0]
push ecx
call fcn.00439c49
add esp, 4
xor eax, eax
jmp 0x42433f
lea eax, [ebp + 0x184]
push eax
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp + 0x17c], eax
call fcn.004179d0
test eax, eax
je 0x424037
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00419d50
cmp dword [ebp + 0x17c], edi
jne 0x4244d6
push 0x40
xor eax, eax
lea ecx, [esp + 0x13c]
push edi
push ecx
mov dword [esp + 0x19c], edi
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x140], edi
call fcn.00440440
add esp, 0xc
call fcn.00406590
test eax, eax
je 0x42408e
call fcn.00419a60
call fcn.00431240
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov dword [esp + 0x40], esp
mov dword [esp + 0x180], 1
mov word [esp + 0x184], dx
push 3
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push 0x457528
mov byte [ecx + 4], dl
call fcn.00402f50
lea esi, [esp + 0xfc]
call fcn.004014e0
mov byte [esp + 0x1f8], 0x12
call fcn.004015b0
mov byte [esp + 0x1f4], 0x13
cmp dword [eax + 0x18], ebx
jb 0x4240f5
mov edi, dword [eax + 4]
jmp 0x4240f8
lea edi, [eax + 4]
mov ecx, dword [esp + 0x1c]
lea ebx, [ebp + 0x2d8]
push ecx
mov eax, ebx
call fcn.0042b7b0
add eax, 0x58
push eax
lea esi, [esp + 0x1cc]
call fcn.004054c0
add esp, 4
cmp dword [esp + 0x48], 0x10
jb 0x424131
mov edx, dword [esp + 0x34]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
lea esi, [esp + 0xdc]
mov byte [esp + 0x1f4], 0x16
call fcn.004037a0
mov eax, dword [esp + 0x1cc]
mov edi, 0x10
cmp dword [esp + 0x1e0], edi
jae 0x424176
lea eax, [esp + 0x1cc]
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x138]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x190]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
call fcn.00417810
mov ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x34
jle 0x4241e2
push 0x34
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00419b30
call fcn.0041ab40
cmp esi, 0x102
jne 0x424589
mov edx, dword [esp + 0x190]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x194]
push eax
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, ebp
call fcn.0041d910
mov eax, dword [esp + 0x1cc]
cmp dword [esp + 0x1e0], edi
jae 0x424231
lea eax, [esp + 0x1cc]
push eax
lea ecx, [esp + 0x6c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x22
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x45755c
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0xa8]
call fcn.004014e0
mov byte [esp + 0x1fc], 0x19
call fcn.004016a0
mov byte [esp + 0x1f8], 0x1a
cmp dword [eax + 0x18], edi
jb 0x424289
mov eax, dword [eax + 4]
jmp 0x42428c
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x80], edi
jb 0x4242ae
mov edx, dword [esp + 0x6c]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x84]
mov dword [esp + 0x80], 0xf
mov dword [esp + 0x7c], 0
mov byte [esp + 0x6c], 0
call fcn.004037a0
mov dword [esp + 0x1f4], 4
cmp dword [esp + 0x1e0], edi
jb 0x4242f6
mov eax, dword [esp + 0x1cc]
push eax
call fcn.00439c49
add esp, 4
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov esi, dword [esp + 0x1c]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
inc esi
add ecx, edx
mov dword [esp + 0x1c], esi
cmp esi, ecx
jb 0x423e64
cmp dword [esp + 0x1c4], 0x10
jb 0x42433a
mov edx, dword [esp + 0x1b0]
push edx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.00439641
add esp, 0x1e4
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x4243a2
mov ecx, dword [edi]
jmp 0x4243a4
mov ecx, edi
cmp ecx, str.3DRTSN
ja 0x4243dd
cmp eax, ebx
jb 0x4243b4
mov ecx, dword [edi]
jmp 0x4243b6
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.3DRTSN
jbe 0x4243dd
cmp eax, ebx
jb 0x4243c9
mov edi, dword [edi]
push 0x26
mov eax, str.3DRTSN
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42441f
cmp eax, 0x26
jae 0x4243ef
mov ecx, dword [esi + 0x14]
push ecx
push 0x26
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x4243fa
mov eax, dword [edi]
jmp 0x4243fc
mov eax, edi
push 0x26
push str.3DRTSN
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x26
cmp dword [esi + 0x18], ebx
jb 0x42441b
mov edi, dword [edi]
mov byte [edi + 0x26], 0
lea esi, [esp + 0xa8]
call fcn.004014e0
mov byte [esp + 0x1fc], 0xe
call fcn.00401900
mov byte [esp + 0x1f8], 0xf
cmp dword [eax + 0x18], ebx
jb 0x42444a
mov eax, dword [eax + 4]
jmp 0x42444d
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x48], ebx
jb 0x42446c
mov edx, dword [esp + 0x34]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x84]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
mov byte [esp + 0x1f4], 4
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x4244aa
sub eax, 2
je 0x4244aa
sub eax, 4
jne 0x4244bc
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00419840
call fcn.00401350
cmp dword [esp + 0x1c4], ebx
jb 0x42433a
mov eax, dword [esp + 0x1b0]
push eax
jmp 0x424332
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x34]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x25
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push 0x457500
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0xa8]
call fcn.004014e0
mov byte [esp + 0x1fc], 0x10
call fcn.004016a0
mov byte [esp + 0x1f8], 0x11
cmp dword [eax + 0x18], ebx
jb 0x424530
mov eax, dword [eax + 4]
jmp 0x424533
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x48], ebx
jb 0x424552
mov edx, dword [esp + 0x34]
push edx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x84]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], edi
mov byte [esp + 0x34], 0
call fcn.004037a0
cmp dword [esp + 0x1c4], ebx
jb 0x42433a
mov eax, dword [esp + 0x1b0]
push eax
jmp 0x424332
mov ecx, dword [esp + 0x190]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00417b30
test eax, eax
je 0x4245a7
call fcn.00419be0
call fcn.00430df0
test eax, eax
je 0x4245b5
call fcn.00419c80
mov edx, dword [esp + 0x190]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x194]
push eax
call ebx
push esi
lea ecx, [esp + 0x6c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x2f
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x45752c
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0xa8]
call fcn.004014e0
mov byte [esp + 0x1fc], 0x17
call fcn.004015b0
mov byte [esp + 0x1f8], 0x18
cmp dword [eax + 0x18], edi
jb 0x424627
mov eax, dword [eax + 4]
jmp 0x42462a
add eax, 4
push eax
push 1
push ebp
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x80], edi
jb 0x42464c
mov edx, dword [esp + 0x6c]
push edx
call fcn.00439c49
add esp, 4
xor ebx, ebx
mov ebp, 0xf
lea esi, [esp + 0x84]
mov dword [esp + 0x80], ebp
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x424687
sub eax, 2
je 0x424687
sub eax, 4
je 0x424687
xor eax, eax
jmp 0x424692
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, 1
sub eax, 1
jne 0x4246a1
call fcn.00418100
call fcn.00406ed0
cmp dword [esp + 0x1e0], edi
jb 0x4246ba
mov eax, dword [esp + 0x1cc]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1dc], ebx
mov byte [esp + 0x1cc], bl
cmp dword [esp + 0x1c4], edi
jb 0x42433a
mov ecx, dword [esp + 0x1b0]
push ecx
jmp 0x424332