Function at 0x424eff
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c0
lea ebp, [esp - 0x74]
call fcn.0049abc0
push ebx
push esi
mov dword [ebp + 0x6c], ecx
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040ea44
and dword [ebp + 0x48], 0
and dword [ebp + 0x40], 0
xor edi, edi
inc edi
mov dword [ebp + 0x58], edi
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x72], 0
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x73], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x30], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov bl, 0x2a
jne 0x424f60
add bl, 3
mov cl, byte [eax]
cmp bl, cl
jne 0x4251b7
mov esi, dword [ebp + 0x7c]
add esi, 2
mov ax, word [esi]
cmp ax, 0x41
jb 0x42518e
cmp ax, 0x2a
je 0x42518e
cmp ax, 0x30
jb 0x424f97
cmp ax, 0x39
jbe 0x42518e
cmp ax, 0x28
je 0x42518e
cmp cl, 0x2d
jne 0x424fc2
mov dl, al
or dl, 0x20
cmp dl, 0x63
jne 0x424fc2
mov edx, dword [ebp + 0x7c]
mov dl, byte [edx + 4]
or dl, 0x20
cmp dl, 0x6d
je 0x42518e
cmp cl, 0x2a
jne 0x424fdd
test ax, ax
je 0x42518e
call fcn.0040ea2b
test al, al
jne 0x42518e
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4b36b4
mov dword [ebp + 0x7c], esi
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425000
mov byte [ebp + 0x71], 1
jmp 0x425181
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425020
mov byte [ebp + 0x53], 1
jmp 0x425181
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4afc40
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425040
mov byte [ebp + 0x68], 1
jmp 0x425181
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425060
mov byte [ebp + 0x68], 0x41
jmp 0x425181
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425080
mov byte [ebp + 0x68], 0x10
jmp 0x425181
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4250a0
mov byte [ebp + 0x68], 0x50
jmp 0x425181
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4250c3
mov dword [ebp + 0x48], 0x10000
jmp 0x425181
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4250e3
mov byte [ebp + 0x72], 1
jmp 0x425181
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4b367c
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425103
mov dword [ebp + 0x40], 0x40
jmp 0x425181
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425130
push edi
call fcn.0043b8ef
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x4255bf
jmp 0x425181
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x42514d
mov byte [ebp + 0x73], 1
jmp 0x425181
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0043af58
add esp, 0xc
test al, al
je 0x425177
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044b46e
pop ecx
jmp 0x425180
lea eax, [ebp + 0x7c]
push eax
call fcn.00405444
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp bl, cl
je 0x424f6a
cmp byte [ebp + 0x73], 0
je 0x4251b7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x4c8e18]
setne cl
push ecx
push 0x4c93bc
call fcn.00411d72
pop ecx
pop ecx
jmp 0x425bd4
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x4251e1
cmp byte [eax + 2], 0x2d
jne 0x4251e1
movzx eax, word [eax + 4]
test ax, ax
je 0x4251d7
call fcn.0040ea2b
test al, al
je 0x4251e1
lea eax, [ebp + 0x7c]
push eax
call fcn.00405444
pop ecx
cmp byte [ebp + 0x68], 0
je 0x4252f5
push 0x4c9c14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x5c]
call fcn.0040ee9d
mov esi, dword [ebp + 0x68]
and esi, 0x40
push esi
call fcn.00411275
test eax, eax
pop ecx
mov dword [ebp + 0x48], eax
jne 0x425225
push esi
push dword [ebp + 0x6c]
call fcn.004190e8
pop ecx
pop ecx
mov dword [ebp + 0x48], eax
test eax, eax
mov dword [ebp + 0x58], edi
je 0x4252d6
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.0043fdb8
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x42526d
push dword [ebp + 0x18]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.0043add9
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.0043ae25
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.00439cfd
cmp dword [ebp + 0x5c], 0
je 0x4252e5
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4c9c14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x425bd1
cmp byte [ebp + 0x72], 0
je 0x4253aa
lea ecx, [ebp + 0x40]
mov ebx, str.PressKey
call fcn.0043fd9a
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
je 0x42532a
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov ebx, dword [ebp + 0x40]
add esp, 0xc
push 0x3f
xor eax, eax
mov byte [ebp - 0x148], 0
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
mov word [ebp - 0x414c], si
lea edi, [ebp - 0x414c]
movzx eax, byte [ebp + esi - 0x148]
push eax
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 0xa
cmp esi, 0x100
jl 0x42535d
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x374e], 0
lea eax, [ebp - 0x414c]
push eax
push ebx
call fcn.0043f62b
lea ecx, [ebp + 0x40]
call fcn.00439cfd
and dword [ebp + 0x58], 0
jmp 0x425b97
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x4c], 0xfffffc18
jne 0x4253ec
lea eax, [edx + 2]
mov cx, word [eax]
or cx, 0x20
cmp cx, 0x63
je 0x4253ec
cmp cx, 0x64
je 0x4253ec
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x67], 1
call fcn.0040ea44
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
jne 0x4253fb
mov bl, byte [edx]
inc edx
inc edx
mov dword [ebp + 0x7c], edx
jmp 0x4253fd
xor bl, bl
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.0043f865
add esp, 4
test al, al
je 0x4254ac
mov eax, dword [ebp + 0x7c]
fld qword [0x4b3608]
mov dword [ebp + 0x60], eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x5c], esi
call fcn.0044b46e
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x42544a
mov ax, word [ecx]
call fcn.0040ea2b
test al, al
jne 0x42544f
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x60]
jb 0x425439
cmp dword [ebp + 0x5c], 0
jl 0x4254a0
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x5c]
mov dword [ebp + 0x68], edi
jne 0x4254a0
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00442c7a
fld qword [ebp + 0x38]
fcomp qword [0x4b3600]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x425525
fld qword [ebp + 0x38]
fadd qword [0x4b35f8]
fmul qword [0x4b35f0]
call fcn.0049ad34
mov dword [ebp + 0x4c], eax
jmp 0x425525
lea eax, [ebp + 0x7c]
push eax
call fcn.00405444
pop ecx
jmp 0x425525
cmp cx, 0x28
jne 0x425525
fld qword [0x4b3608]
lea eax, [ebp + 0x38]
push eax
fstp qword [ebp + 0x38]
lea eax, [ebp + 0x7c]
push eax
call fcn.0047c2f7
test eax, eax
pop ecx
pop ecx
jle 0x425525
fld qword [ebp + 0x38]
fcomp qword [0x4b3600]
fnstsw ax
test ah, 1
jne 0x425525
fld qword [ebp + 0x38]
fadd qword [0x4b35f8]
fld st(0)
call fcn.0049ad34
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.0049ad34
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
fild qword [ebp + 0x38]
fsubp st(1)
fcom qword [0x4b35e8]
fnstsw ax
test ah, 0x41
jne 0x425523
fcom qword [0x4b35e0]
fnstsw ax
test ah, 5
jnp 0x42548d
fstp st(0)
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
je 0x4256ae
cmp edi, esi
jne 0x425540
cmp dword [ebp + 0x4c], 0
jl 0x4256ae
and word [ebp - 0x46], 0
and word [ebp - 0x48], 0
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x5c], str.PressKey
call fcn.0043fd9a
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x425584
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], 0
je 0x425584
mov dword [ebp + 0x5c], eax
cmp byte [ebp + 0x67], 0
jne 0x4255f2
test edi, edi
jne 0x425595
cmp dword [ebp + 0x4c], edi
jle 0x4255ed
test edi, edi
jl 0x425697
test bl, bl
je 0x4255c6
and dword [ebp + 0x58], 0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x425697
lea ecx, [ebp + 0x60]
call fcn.00439cfd
xor eax, eax
jmp 0x425bd4
mov ecx, dword [ebp + 0x4c]
test ecx, ecx
jg 0x4255cf
xor ecx, ecx
test edi, edi
jle 0x4255d7
mov eax, edi
jmp 0x4255d9
xor eax, eax
push 0
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.00414c28
mov dword [ebp + 0x58], eax
jmp 0x425697
push 2
pop eax
jmp 0x4255f5
xor eax, eax
inc eax
or eax, dword [ebp + 0x48]
push eax
push edi
call fcn.0041bff3
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x42561c
cmp ebx, 0x60
jl 0x42561c
cmp ebx, 0x69
jg 0x42561c
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, str.0x_X
jle 0x42563b
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x48]
jmp 0x425640
mov eax, 0x4b35d8
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.0043f62b
test ebx, ebx
jle 0x425683
cmp ebx, 0x41
jl 0x42565c
cmp ebx, 0x5a
jle 0x425669
push ebx
call fcn.0043f865
add esp, 4
test al, al
je 0x425678
and word [ebp - 0x46], 0
movsx ax, bl
mov word [ebp - 0x48], ax
jmp 0x425683
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x5c]
call fcn.0043f62b
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040ea44
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x67], 0
call fcn.00439cfd
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
je 0x425b97
xor edi, edi
mov ecx, eax
mov dword [ebp + 0x54], edi
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0
jne 0x4256ec
mov eax, dword [ebp + 0x18]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x54], eax
jmp 0x4256e3
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x4256e0
cmp esi, edi
jle 0x42575b
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x425703
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x54], edi
jmp 0x42575b
cmp ax, 0x3d
jne 0x42570f
mov byte [ebp + 0x71], 1
jmp 0x425719
cmp ax, 0x24
jne 0x425721
mov byte [ebp + 0x73], 2
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x54], edi
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0043f865
add esp, 4
test al, al
je 0x425743
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044b46e
pop ecx
pop ecx
dec esi
cmp esi, edi
jle 0x42575b
cmp byte [ebp + 0x73], 0
jne 0x42575b
push esi
push dword [ebp + 0x54]
call fcn.00411c80
pop ecx
pop ecx
mov dword [ebp + 0x54], eax
or dword [ebp + 0x28], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040ea44
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x42577c
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x425780
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.0043f865
add esp, 4
test al, al
je 0x42579f
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044b46e
pop ecx
pop ecx
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x14], edi
lea edi, [ebp + 0x14]
je 0x4257ae
lea edi, [ebp + 0x54]
xor ebx, ebx
cmp byte [ebp + 0x73], bl
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x58], ebx
jne 0x4257c7
cmp dword [ebp + 0x54], ebx
jne 0x4257d2
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x54], ebx
je 0x4257fe
cmp byte [ebp + 0x73], 0
jne 0x4257fe
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x54]
push ebx
push 0x100000
je 0x4257e9
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x4257ef
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x4257fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.0043fdb8
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x2c]
call fcn.004483ea
push 0x5c
push dword [ebp + 0x2c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040ea44
lea ecx, [ebp + 0x1c]
call fcn.00440008
mov dword [ebp + 0x3c], ebx
jmp 0x42598a
cmp byte [0x4c72b4], 0
jle 0x42599e
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4258b1
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044b46e
cmp dword [ebp + 0x30], ebx
pop ecx
pop ecx
jge 0x42598a
mov dword [ebp + 0x30], ebx
jmp 0x42598a
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x425969
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x34], eax
push 1
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.0041a38c
add esp, 0xc
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x7c], eax
call fcn.0043fd9a
lea ecx, [ebp + 0x5c]
call fcn.0043fd9a
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x5c]
push dword [ebp + 0x34]
call fcn.0043febe
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x5c]
call fcn.004122c1
pop ecx
pop ecx
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
cmp dword [ebp + 0x4c], ebx
jle 0x425957
push 4
call fcn.0049aa28
cmp eax, ebx
pop ecx
je 0x42593b
mov ecx, dword [ebp + 0x60]
mov dword [eax], ecx
mov dword [ebp + 0x60], ebx
mov esi, eax
jmp 0x42593d
xor esi, esi
push 4
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x24]
call fcn.0043ffcb
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x24]
lea ecx, [ebp + 0x7c]
call fcn.0040ea44
lea ecx, [ebp + 0x60]
call fcn.00439cfd
jmp 0x42598a
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.00441bc4
add esp, 0xc
test al, al
jne 0x425998
lea eax, [ebp + 0x7c]
push eax
call fcn.00405444
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x42586d
jmp 0x42599e
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x3c], eax
cmp byte [ebp + 0x67], 0
je 0x4259a7
neg dword [ebp + 0x68]
cmp dword [ebp + 0x40], ebx
jne 0x4259b9
cmp dword [edi], ebx
je 0x4259b9
push dword [ebp + 0x44]
call fcn.00410d81
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], 0
je 0x425a4f
jmp 0x425a46
cmp dword [ebp + 0x68], 0
je 0x425a4f
mov edi, 0x3e8
jle 0x4259ef
call ebx
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x425a4f
cmp ecx, edi
jge 0x4259ef
mov edi, ecx
push 0x4ff
push edi
push 0
push dword [ebp + 0x48]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x425a4f
push 0x64
pop edi
jmp 0x425a3d
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x425a46
dec edi
je 0x425a46
cmp dword [ebp - 4], 0x12
je 0x425a46
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4c72b4], 0
jg 0x425a0b
cmp byte [0x4c72b4], 0
jg 0x4259d1
xor esi, esi
cmp dword [ebp + 0x28], esi
jl 0x425a74
cmp byte [ebp + 0x72], 0
je 0x425a67
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x425a74
mov ecx, dword [ebp + 0x6c]
push esi
push esi
push dword [ebp + 0x28]
call fcn.00414c28
cmp dword [ebp + 0x24], esi
jle 0x425b3d
cmp byte [0x4c72b4], 0
jle 0x425b3d
cmp dword [ebp + 0x40], 0
jne 0x425a99
push dword [ebp + 0x44]
call fcn.00410d81
pop ecx
cmp dword [ebp + 0x24], 0
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x5c], eax
jle 0x425b3d
cmp byte [0x4c72b4], 0
jle 0x425b3d
mov eax, dword [ebp + 0x24]
xor edi, edi
cmp eax, edi
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x60], eax
jle 0x425b3d
cmp byte [0x4c72b4], 0
jle 0x425b1f
mov eax, dword [ebp + 0x5c]
lea esi, [eax + edi*4]
mov eax, dword [esi]
test eax, eax
je 0x425b19
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.00416083
mov eax, dword [esi]
push dword [eax]
call fcn.00499f59
test edx, edx
pop ecx
jg 0x425b13
jl 0x425afa
test eax, eax
ja 0x425b13
mov ebx, dword [esi]
test ebx, ebx
je 0x425b0e
mov ecx, ebx
call fcn.00439cfd
push ebx
call fcn.0049a924
pop ecx
and dword [esi], 0
jmp 0x425b19
lea eax, [edi + 1]
mov dword [ebp + 0x34], eax
inc edi
cmp edi, dword [ebp + 0x60]
jl 0x425ac5
mov esi, dword [ebp + 0x34]
test esi, esi
jle 0x425b3d
mov ecx, dword [ebp + 0x6c]
push 0
push 0
push dword [ebp + 0x30]
call fcn.00414c28
mov dword [ebp + 0x24], esi
jmp 0x425aa9
xor esi, esi
cmp dword [ebp + 0x40], esi
jne 0x425b54
mov eax, dword [ebp + 0x48]
cmp dword [eax], esi
je 0x425b54
push dword [ebp + 0x2c]
call fcn.00410d81
pop ecx
mov eax, dword [ebp + 0x3c]
cmp eax, esi
je 0x425b6f
cmp word [eax], si
je 0x425b6f
mov ecx, dword [ebp + 0x6c]
push esi
push esi
push esi
push eax
call fcn.0042e6e7
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x1c]
call fcn.0041372c
lea ecx, [ebp + 0x1c]
call fcn.00439cfd
lea ecx, [ebp + 0x2c]
call fcn.00439cfd
lea ecx, [ebp + 0x44]
call fcn.00439cfd
lea ecx, [ebp + 0x14]
call fcn.00402c5b
cmp byte [ebp + 0x53], 0
je 0x425bc7
call fcn.0041a62f
test eax, eax
je 0x425bbf
push dword [ebp + 0x6c]
call fcn.004119a7
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.0041a65b
pop ecx
pop ecx
push 0
call fcn.00415827
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.0046496c
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4