Function at 0x424083
Capabilities:
Create process on windows
Encode data using base64
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x540
mov esi, esp
mov dword [esi + 0x528], ebp
lea eax, [esi + 0x530]
mov dword [esi + 0x28], ecx
mov ebx, dword [ebp + 8]
mov edi, edx
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x42b620
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, edx
mov edx, ebx
mov dword fs:[0], eax
call fcn.004166b0
test al, al
mov dword [esi + 0x1c], edi
je 0x424491
lea ecx, [esi + 0x118]
mov edx, edi
push ebx
call fcn.0041faf0
add esp, 4
lea ecx, [esi + 0x118]
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
xor ecx, ecx
xor eax, eax
lea edi, [esi + 0x128]
mov edx, 0x4422e0
inc eax
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov byte [edi + 0xc], 1
mov ecx, edi
mov dword [esi + 0x38], eax
push eax
call fcn.0041a230
add esp, 4
mov ecx, edi
mov edx, ebx
push dword [esi + 0xc]
call fcn.0041a230
add esp, 4
cmp dword [esi + 0x14], 0
je 0x424147
mov ecx, ebx
call fcn.00425a4f
lea ebx, [esi + 0x128]
mov edx, 0x4422e1
mov ecx, ebx
push 9
call fcn.0041a230
add esp, 4
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x98], 0x442570
lea edi, [esi + 0xe8]
xorps xmm0, xmm0
movaps xmmword [esi + 0x70], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x84], eax
mov eax, 0xd
add ecx, edx
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], 0x4422ea
mov dword [esi + 0xa4], eax
xor eax, eax
inc eax
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebx + 4]
mov dword [edi + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [ebx], 0x44
movsd qword [ebx + 4], xmm0
movsd qword [ebx + 0xc], xmm0
movsd qword [ebx + 0x14], xmm0
movsd qword [ebx + 0x1c], xmm0
movsd qword [ebx + 0x24], xmm0
movsd qword [ebx + 0x2c], xmm0
movsd qword [ebx + 0x34], xmm0
movsd qword [ebx + 0x3c], xmm0
xor ebx, ebx
mov edx, edi
mov word [edi + 0xc], bx
add ecx, eax
mov dword [esi + 0x88], eax
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10c]
call fcn.0042a2e2
mov edx, dword [esi + 0x88]
mov ecx, dword [esi + 0xc]
xor eax, eax
inc eax
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
lea ecx, [esi + 0xb8]
lea edx, [esi + 0xe8]
mov word [edi + 0xc], bx
call fcn.0042a2e2
cmp dword [ebp + 0x18], 0
je 0x424667
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x424806
xor ecx, ecx
mov ebx, eax
dec ecx
cmp ecx, 0x7ffffffe
je 0x4251b6
xor eax, eax
cmp word [ebx + ecx*2 + 2], 0
mov edi, ecx
jne 0x424269
xor eax, eax
cmp word [ebx + edi*2 + 4], 0
sete al
lea ecx, [edi + 1]
test eax, eax
je 0x424246
add edi, 2
cmp ecx, 0x3ffffffe
lea edx, [edi + edi]
ja 0x425213
mov al, byte [0x44b9c8]
mov ecx, edx
mov dword [esi + 0xc], edx
call fcn.00425980
test eax, eax
je 0x42521a
lea ecx, [esi + 0x58]
mov dword [esi + 0x18], ebx
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov ecx, ebx
test edi, edi
je 0x42431e
mov edx, ecx
lea ecx, [edi + edi]
xor eax, eax
movzx ebx, word [edx + eax*2]
test bx, bx
je 0x4242cd
inc eax
add ecx, 0xfffffffe
jne 0x4242b8
mov ecx, edx
mov eax, edi
jmp 0x4242d6
lea ecx, [eax + 1]
sub edi, ecx
lea ecx, [edx + eax*2 + 2]
test edx, edx
je 0x42431e
test eax, eax
je 0x424319
cmp word [edx], 0x3d
je 0x424319
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x58]
push eax
call fcn.0042a29a
add esp, 4
mov ecx, dword [esi + 0x60]
cmp ecx, dword [esi + 0x58]
jne 0x424309
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0x58]
call fcn.0042a752
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x5c]
mov word [eax + ecx*2], 0
inc ecx
mov dword [esi + 0x60], ecx
mov ecx, dword [esi + 0xc]
test bx, bx
je 0x4242ad
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
shl eax, 4
add eax, ecx
mov dword [esi + 0x20], eax
mov eax, dword [ecx]
mov dword [esi + 0xc], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0xe8], 1
lea edx, [esi + 0xe8]
add ecx, eax
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], ecx
lea ecx, [esi + 0xc4]
mov word [esi + 0xf4], 0
call fcn.0042a2e2
mov eax, dword [esi + 0xcc]
test eax, eax
je 0x4251c0
mov edx, dword [esi + 0xc8]
lea ebx, [esi + 0x58]
dec eax
mov ecx, ebx
mov dword [esi + 0x14], edx
push eax
call fcn.0042a29a
add esp, 4
mov edi, dword [esi + 0x60]
cmp edi, dword [esi + 0x58]
jne 0x42439b
mov ecx, ebx
call fcn.0042a752
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0xc]
lea edx, [esi + 0xe8]
mov word [eax + edi*2], 0x3d
inc edi
mov dword [esi + 0xe8], 1
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esi + 0x60], edi
add ecx, eax
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], ecx
lea ecx, [esi + 0x48]
mov word [esi + 0xf4], 0
call fcn.0042a2e2
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4251ca
mov edi, dword [esi + 0x4c]
dec eax
mov ecx, ebx
mov edx, edi
push eax
call fcn.0042a29a
add esp, 4
mov ebx, dword [esi + 0x60]
cmp ebx, dword [esi + 0x58]
jne 0x42440c
lea ecx, [esi + 0x58]
call fcn.0042a752
mov eax, dword [esi + 0x5c]
mov word [eax + ebx*2], 0
mov dword [esi + 0x10], eax
lea eax, [ebx + 1]
cmp dword [esi + 0x48], 0
mov dword [esi + 0x24], eax
mov dword [esi + 0x60], eax
je 0x42442e
mov ecx, edi
call fcn.00425a4f
cmp dword [esi + 0xc4], 0
je 0x42443f
mov ecx, dword [esi + 0x14]
call fcn.00425a4f
mov ecx, dword [esi + 0xc]
add ecx, 0x10
cmp ecx, dword [esi + 0x20]
jne 0x42432c
mov ecx, dword [esi + 0x58]
cmp dword [esi + 0x24], ecx
jne 0x424468
lea edi, [esi + 0x58]
mov ecx, edi
call fcn.0042a752
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov word [eax + ebx*2 + 2], 0
push dword [esi + 0x18]
mov edi, ecx
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor ebx, ebx
cmp edi, 0x80000000
mov dword [esi + 0x24], edi
cmovne ebx, dword [esi + 0x10]
jmp 0x42466e
lea edi, [esi + 0x98]
mov ecx, edi
call fcn.00415d20
mov eax, dword [edi]
cmp eax, 0x80000000
jne 0x4244be
mov eax, dword [esi + 0xa0]
mov ebx, dword [esi + 0x9c]
mov edx, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
jmp 0x424fa6
mov edx, dword [esi + 0x9c]
lea edi, [esi + 0xa8]
mov dword [esi + 0x38], eax
mov ecx, edi
mov dword [esi + 0x34], edx
push dword [ebp + 8]
push dword [esi + 0x1c]
push dword [esi + 0xa0]
call fcn.0041d0a0
add esp, 0xc
mov eax, dword [edi + 8]
movaps xmm0, xmmword [0x43c480]
mov edx, dword [edi + 4]
lea edi, [esi + 0xe8]
xor ecx, ecx
lea ebx, [esi + 0x128]
mov dword [edi + 0x1c], ecx
mov word [edi + 0x20], 0
mov dword [edi + 0x10], 7
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov ecx, ebx
movups xmmword [edi], xmm0
push edi
push eax
call fcn.0041a420
add esp, 8
mov al, byte [ebx]
cmp al, 4
jne 0x424894
mov eax, dword [esi + 0x12c]
xor ecx, ecx
mov ebx, 0x200
xor edx, edx
mov dword [esi + 0x18], 2
mov dword [esi + 0x10], eax
lea eax, [esi + 0x48]
mov dword [eax], ecx
mov dword [eax + 4], 2
mov dword [eax + 8], ecx
xor eax, eax
cmp ebx, 0x201
jae 0x424577
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], 0x200
lea edi, [esi + 0x128]
mov dword [esi + 0xc], ebx
jmp 0x4245ab
sub ebx, edx
je 0x42459c
mov dword [esi + 0x538], 0
lea ecx, [esi + 0x48]
push ebx
call fcn.0043a930
add esp, 4
mov eax, dword [esi + 0x4c]
mov edx, dword [esi + 0x48]
mov dword [esi + 0x18], eax
xor eax, eax
mov edi, dword [esi + 0x18]
mov dword [esi + 0x50], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], edx
push eax
xor ebx, ebx
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push dword [esi + 0xc]
mov dword [esi + 0x24], edi
push edi
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
test eax, eax
jne 0x4245d9
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x424f42
mov edi, dword [esi + 0xc]
cmp ebx, edi
jne 0x424606
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4251d4
mov edx, dword [esi + 0x14]
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
xor eax, eax
jmp 0x42455a
mov edx, dword [esi + 0x14]
mov eax, 0
ja 0x42455a
mov edx, dword [esi + 0x20]
mov dword [esi + 0x538], 0
cmp ebx, edx
ja 0x42524c
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x70]
push ebx
call fcn.00416500
add esp, 4
mov edi, dword [esi + 0x74]
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x7c]
mov ebx, dword [esi + 0x70]
mov dword [esi + 0x14], edi
shr edi, 8
cmp dword [esi + 0x48], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], ecx
je 0x424f65
mov ecx, dword [esi + 0x4c]
call fcn.00425a4f
jmp 0x424f65
mov dword [esi + 0x24], 0x80000000
mov edi, dword [esi + 0x110]
mov eax, dword [esi + 0xbc]
lea edx, [esi + 0x70]
xor ecx, ecx
push edx
lea edx, [esi + 0x128]
push edx
push ecx
push ebx
push 0x401
push ecx
push ecx
push ecx
mov dword [esi + 0x1c], eax
push eax
push edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
mov dword [esi + 0x18], edi
je 0x4246be
mov eax, dword [esi + 0x74]
mov edi, dword [esi + 0x70]
mov edx, 0x80000001
lea ebx, [esi + 0x98]
mov ecx, 2
mov dword [esi + 0xc], eax
jmp 0x4246fc
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, 0x18
mov al, byte [0x44b9c8]
call fcn.00425980
test eax, eax
je 0x425236
mov ebx, eax
push 0x18
push str.Could_not_create_process
push eax
call fcn.0042c2f0
add esp, 0xc
xor edi, edi
mov edx, 0x18
mov ecx, 0x18
test dword [esi + 0x24], 0x7fffffff
je 0x424719
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x10], edx
call fcn.00425a4f
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x24]
cmp dword [esi + 0xb8], 0
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ebx
je 0x42473e
mov ebx, ecx
mov ecx, dword [esi + 0x1c]
mov edi, edx
call fcn.00425a4f
mov edx, edi
mov ecx, ebx
mov ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x14]
cmp dword [esi + 0x10c], 0
je 0x42475d
mov ebx, ecx
mov ecx, dword [esi + 0x18]
mov edi, edx
call fcn.00425a4f
mov edx, edi
mov ecx, ebx
mov ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x14]
cmp edx, 0x80000001
jne 0x42486e
mov eax, dword [esi + 0xc]
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ecx
mov dword [esi + 0xb0], edi
mov ecx, 0x10
mov dword [esi + 0xb4], eax
mov al, byte [0x44b9c8]
call fcn.00425980
test eax, eax
je 0x425227
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dl, byte [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov dword [eax], ecx
mov dword [eax + 4], edi
xor edi, edi
mov dword [eax + 8], 0x4422f7
mov dword [eax + 0xc], 0xa
inc edi
test dl, dl
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], eax
mov al, 1
mov dword [esi + 0x78], edi
mov dword [esi + 0x14], eax
je 0x4248bd
lea edi, [esi + 0x128]
mov edx, 0x442301
mov ecx, edi
push 0x10
call fcn.004182f0
add esp, 4
mov edi, dword [edi]
cmp edi, 0x80000000
jne 0x4248c2
xor eax, eax
inc eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], eax
jmp 0x424d97
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov al, byte [0x44b9c8]
mov ecx, 0x20
call fcn.00425980
test eax, eax
je 0x42523f
mov ebx, eax
push 0x20
push str.Couldnt_get_environment_stringsCould_not_create_pipeCould_not_duplicate_pipe_handle
push eax
call fcn.0042c2f0
add esp, 0xc
cmp dword [esi + 0xb8], 0
je 0x42484b
mov ecx, dword [esi + 0xbc]
call fcn.00425a4f
cmp dword [esi + 0x10c], 0
mov dword [esi + 0xc], edi
je 0x424862
mov ecx, dword [esi + 0x110]
call fcn.00425a4f
xor edi, edi
mov edx, 0x20
mov ecx, 0x20
mov eax, dword [esi + 0x28]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edi
mov edi, dword [esi + 0xc]
mov dword [eax + 0x14], edi
mov edi, dword [esi + 0x84]
mov dword [eax], 0x80000000
mov dword [eax + 4], edx
jmp 0x42514d
mov dword [esi + 0x14], eax
movzx eax, byte [esi + 0x12b]
movzx edi, word [esi + 0x129]
mov ebx, 0x80000000
shl eax, 0x10
or edi, eax
mov eax, dword [esi + 0x12c]
mov dword [esi + 0xc], eax
jmp 0x424f6e
jmp 0x424d97
mov eax, dword [esi + 0x12c]
mov ecx, dword [esi + 0x130]
cmp byte [esi + 0x134], 0
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x3c], ecx
jne 0x42494c
cmp dword [esi + 0x3c], 0
je 0x42494c
mov edx, dword [esi + 0x64]
mov eax, dword [esi + 0x3c]
add eax, edx
mov bl, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x424946
cmp bl, 0xe0
jae 0x424906
add edx, 2
cmp ecx, eax
cmovne ecx, edx
jmp 0x424946
cmp bl, 0xed
jne 0x424927
cmp ecx, eax
je 0x42494c
lea ecx, [edx + 2]
cmp ecx, eax
je 0x42494c
cmp byte [edx + 1], 0x9f
ja 0x425170
add edx, 3
mov ecx, edx
jmp 0x424946
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x424946
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
cmp ecx, eax
mov edx, ecx
jne 0x4248ee
mov edx, dword [esi + 0x64]
lea edi, [esi + 0x128]
mov ecx, edi
push 1
push 0x442311
push dword [esi + 0x3c]
call fcn.00404930
add esp, 0xc
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi]
mov edx, dword [edi + 0xc]
mov ebx, dword [edi + 0x34]
mov dword [esi + 0x6c], ecx
mov ecx, dword [edi + 0x24]
mov dword [esi + 0xdc], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x34], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x1c], ecx
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x20], ecx
mov ecx, dword [edi + 0x38]
mov dword [esi + 0xe0], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x90], eax
mov eax, dword [edi + 0x18]
mov edi, edx
shr edi, 0x10
mov dword [esi + 0x54], edi
mov edi, edx
and edx, 0xff00ff00
mov dword [esi + 0xd8], edx
mov edx, ecx
mov dword [esi + 0xd4], eax
mov dword [esi + 0x24], ecx
sub edx, eax
mov eax, ecx
lea eax, [ecx - 1]
mov dword [esi + 0x94], eax
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xd0], edx
inc eax
mov dword [esi + 0x38], eax
cmp dword [esi + 0xdc], 0
je 0x424b76
mov eax, dword [esi + 0x94]
mov edx, dword [esi + 0x6c]
mov edi, dword [esi + 0x20]
add eax, edx
cmp eax, ebx
jae 0x424b88
mov dword [esi + 0x40], ecx
movzx ecx, byte [esi + 0x54]
mov ebx, dword [esi + 0x1c]
shl ecx, 0x10
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0xc], ecx
movzx ecx, byte [esi + 0x34]
or ecx, dword [esi + 0xd8]
or ecx, dword [esi + 0xc]
mov dword [esi + 0xc], edx
mov dword [esi + 0xe4], ecx
mov cl, byte [edi + eax]
xor eax, eax
xor edx, edx
mov ebx, edi
inc edx
mov edi, edx
shld eax, edx, cl
shl edi, cl
test cl, 0x20
mov ecx, 0
cmovne eax, edi
cmovne edi, ecx
and eax, dword [esi + 0xe4]
and edi, dword [esi + 0xe0]
or edi, eax
je 0x424ad4
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x90]
cmp eax, ecx
mov edx, ecx
mov ecx, dword [esi + 0xc]
cmova edx, eax
cmp dword [esi + 0x1c], 0xffffffff
lea edi, [ebx + ecx]
cmove edx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov dword [esi + 0x18], edx
cmp edx, eax
cmova eax, edx
cmp eax, ecx
je 0x424b0c
mov edx, ecx
mov ecx, dword [esi + 0xc]
add ecx, edx
cmp ecx, dword [esi + 0x10]
jae 0x425185
mov ebx, dword [esi + 0x14]
lea ecx, [edx + 1]
mov bl, byte [ebx + edx]
cmp bl, byte [edi + edx]
je 0x424a9a
mov ecx, dword [esi + 0xc]
xor eax, eax
sub ecx, dword [esi + 0x90]
cmp dword [esi + 0x1c], 0xffffffff
lea ecx, [ecx + edx + 1]
mov dword [esi + 0xc], ecx
jmp 0x424ae3
mov eax, dword [esi + 0xc]
add eax, dword [esi + 0x24]
mov dword [esi + 0xc], eax
xor eax, eax
cmp dword [esi + 0x1c], 0xffffffff
mov ebx, dword [esi + 0x10]
je 0x424af1
mov dword [esi + 0x8c], eax
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x94]
mov ecx, dword [esi + 0xc]
mov edi, dword [esi + 0x20]
add eax, ecx
cmp eax, ebx
jb 0x424a41
jmp 0x424d53
cmp dword [esi + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x30]
mov eax, 0
mov ebx, dword [esi + 0x10]
cmove ecx, eax
mov dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x90]
cmp dword [esi + 0x18], ecx
jae 0x424ba0
dec ecx
cmp ecx, dword [esi + 0x24]
jae 0x4251a9
mov eax, dword [esi + 0xc]
mov edx, ebx
add eax, ecx
cmp eax, ebx
jae 0x42519d
mov edi, dword [esi + 0x14]
mov bl, byte [edi + ecx]
mov edi, dword [esi + 0x20]
cmp bl, byte [edi + eax]
mov ebx, edx
je 0x424b27
mov eax, dword [esi + 0xc]
add eax, dword [esi + 0xd4]
cmp dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xd0]
jne 0x424ae8
jmp 0x424af1
cmp byte [esi + 0x54], 0
mov edi, dword [esi + 0x20]
je 0x424bd1
mov dword [esi + 0x18], 0
jmp 0x424b92
mov dword [esi + 0x18], 0
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x30], ecx
mov eax, dword [esi + 0x3c]
mov dword [esi + 0xc], eax
jmp 0x424ceb
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 0x1c], 0xffffffff
mov edx, dword [esi + 0x8c]
mov edi, dword [esi + 0x20]
lea ecx, [ecx + eax]
mov eax, 0
cmovne edx, eax
mov al, 1
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
jmp 0x424ce8
mov dword [esi + 0x40], ecx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x424bf0
cmp ecx, ebx
jae 0x424bea
cmp byte [edi + ecx], 0xbf
jg 0x424bf0
jmp 0x4251f7
jne 0x4251f7
cmp ecx, ebx
je 0x424cac
mov edx, ebx
mov bl, byte [edi + ecx]
mov dword [esi + 0x44], ecx
movzx eax, bl
test bl, bl
jns 0x424c62
mov edx, edi
movzx edi, byte [edi + ecx + 1]
and eax, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x424c49
movzx ecx, byte [edx + ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp bl, 0xf0
jb 0x424c55
mov ebx, dword [esi + 0x44]
mov edi, edx
and eax, 7
shl ecx, 6
shl eax, 0x12
movzx edx, byte [edx + ebx + 3]
and edx, 0x3f
or edx, ecx
mov ecx, ebx
or eax, edx
jmp 0x424c50
shl eax, 6
or eax, edi
mov edi, edx
mov edx, dword [esi + 0x10]
jmp 0x424c62
shl eax, 0xc
mov edi, edx
mov edx, dword [esi + 0x10]
or eax, ecx
mov ecx, dword [esi + 0x44]
mov ebx, dword [esi + 0x34]
test bl, bl
jne 0x424cd0
cmp eax, 0x110000
je 0x424d48
cmp eax, 0x80
mov ecx, 1
jb 0x424c99
mov ecx, 2
cmp eax, 0x800
jb 0x424c99
cmp eax, 0x10000
mov ecx, 4
sbb ecx, 0
mov eax, dword [esi + 0x44]
mov ebx, edx
add eax, ecx
mov ecx, eax
mov al, 1
mov dword [esi + 0x34], eax
jmp 0x424bd7
mov eax, dword [esi + 0x34]
test al, al
je 0x424d6e
xor al, 1
mov dword [esi + 0x54], 0
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x34], eax
mov al, 1
jmp 0x424ce5
xor bl, 1
mov al, 1
mov dword [esi + 0x54], 0
mov dword [esi + 0x30], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
cmp eax, dword [esi + 0x70]
jne 0x424d05
mov ebx, ecx
lea ecx, [esi + 0x70]
call fcn.00428895
mov eax, dword [esi + 0x74]
mov ecx, ebx
mov dword [esi + 0x2c], eax
mov ebx, dword [esi + 0xc]
mov edx, dword [esi + 0x38]
lea eax, [edi + ecx]
mov edi, dword [esi + 0x2c]
sub ebx, ecx
mov ecx, edx
inc edx
shl ecx, 4
cmp byte [esi + 0x18], 0
mov dword [esi + 0x38], edx
mov dword [edi + ecx], eax
mov dword [edi + ecx + 4], ebx
mov dword [edi + ecx + 8], 0x4422f7
mov dword [edi + ecx + 0xc], 0xa
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x10]
mov dword [esi + 0x78], edx
jne 0x4249ef
jmp 0x424d8a
mov al, 1
mov dword [esi + 0x18], 0
jmp 0x424d7a
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x18], 0
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x1c], eax
jmp 0x424b92
mov al, 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x44], ebx
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0x40]
mov al, 1
mov dword [esi + 0x54], eax
jmp 0x424b92
mov eax, dword [esi + 0x74]
mov dword [esi + 0x14], 0
mov dword [esi + 0x2c], eax
lea edi, [esi + 0x128]
lea edx, [esi + 0xa8]
mov ecx, edi
push dword [esi + 0x38]
push dword [esi + 0x2c]
call fcn.00420fac
add esp, 8
cmp dword [edi], 0x80000001
jne 0x424f03
mov edi, dword [esi + 0x130]
mov eax, dword [esi + 0x134]
mov dword [esi + 0xc], eax
push dword [esi + 0x12c]
call dword [sym.imp.kernel32.dll_GetProcessId]
push eax
call sub.kernel32.dll_DebugActiveProcessStop
push edi
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x424e10
lea ebx, [esi + 0x128]
mov edx, 0x44304b
mov ecx, ebx
push 0x15
call fcn.0042938a
add esp, 4
mov edx, dword [ebx]
cmp edx, 0x80000001
jne 0x425088
lea ebx, [esi + 0x128]
mov edx, edi
mov ecx, ebx
call fcn.004293fd
mov edx, dword [ebx]
cmp edx, 0x80000001
jne 0x424ff4
lea edi, [esi + 0xe8]
mov edx, 0xc
mov dword [esi + 0xb8], 0xc
mov ecx, edi
call fcn.0042a240
mov eax, dword [edi + 4]
xor edi, edi
mov ecx, 0xc
xor edx, edx
mov ebx, eax
add eax, edi
mov dword [esi + 0xc4], edx
sub ecx, edi
push edx
lea edx, [esi + 0xc4]
push edx
push ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x425020
add edi, dword [esi + 0xc4]
jb 0x425209
cmp edi, 0xc
mov eax, ebx
mov dword [esi + 0x58], edi
jb 0x424e4e
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0x128]
call fcn.004293fd
lea eax, [esi + 0x128]
mov edx, dword [eax]
cmp edx, 0x80000001
jne 0x425048
mov ecx, dword [esi + 0x2c]
cmp edi, 0xc
jne 0x42525d
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov edi, dword [ebx]
cmp dword [esi + 0xe8], 0
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
je 0x424ee1
mov ecx, ebx
call fcn.00425a4f
mov ecx, dword [esi + 0x2c]
cmp edi, 2
je 0x4250e4
cmp edi, 1
je 0x4250da
test edi, edi
jne 0x4250ee
mov edi, dword [esi + 0x28]
jmp 0x4250ba
mov eax, dword [esi + 0x138]
mov edi, dword [esi + 0x28]
movsd xmm0, qword [esi + 0x128]
movsd xmm1, qword [esi + 0x130]
mov dword [edi + 0x14], eax
movsd qword [edi + 0xc], xmm1
movsd qword [edi + 4], xmm0
push 1
push dword [esi + 0xb0]
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [edi], 0x80000000
jmp 0x425123
call dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [esi + 0x48], 0
mov dword [esi + 0xc], eax
je 0x424f59
mov ecx, dword [esi + 0x4c]
call fcn.00425a4f
mov ebx, 0x80000000
mov dword [esi + 0x14], 0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esi + 0xa8], 0
je 0x424f82
mov ecx, dword [esi + 0xac]
call fcn.00425a4f
cmp dword [esi + 0x38], 0
je 0x424f90
mov ecx, dword [esi + 0x34]
call fcn.00425a4f
movzx eax, byte [esi + 0x14]
cmp ebx, 0x80000000
jne 0x424fc5
mov ebx, edi
mov edx, dword [esi + 0x1c]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [esi + 0x28]
mov ecx, edi
push eax
call fcn.0041faf0
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], eax
jmp 0x42515c
mov ecx, ebx
mov edx, dword [esi + 0xc]
mov ebx, edi
mov dword [esi + 0x14], ecx
mov dword [esi + 0x118], ecx
mov ecx, dword [esi + 0x20]
shl ebx, 8
or ebx, eax
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], edx
mov dword [esi + 0x124], ecx
jmp 0x424101
mov ecx, dword [esi + 0x130]
mov edi, dword [esi + 0x134]
mov eax, dword [esi + 0x12c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0x138]
mov dword [esi + 0x48], edi
mov edi, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], ecx
jmp 0x4250f6
lea edi, [esi + 0x128]
mov edx, str.Error_while_reading_child_processs_pipe
mov ecx, edi
push 0x28
call fcn.0042938a
add esp, 4
mov edx, dword [edi]
cmp edx, 0x80000001
jne 0x425048
mov edx, 0x80000004
jmp 0x42506c
mov ecx, dword [esi + 0x130]
mov eax, dword [esi + 0x12c]
mov edi, dword [esi + 0x134]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0x138]
mov dword [esi + 0xc], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ecx
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
cmp dword [esi + 0xe8], 0
je 0x4250b2
mov ecx, ebx
mov ebx, edx
call fcn.00425a4f
mov edx, ebx
jmp 0x4250af
mov ecx, dword [esi + 0x130]
mov edi, dword [esi + 0x134]
mov eax, dword [esi + 0x12c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0x138]
mov dword [esi + 0x48], edi
mov edi, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0x2c]
cmp edx, 0x80000004
jne 0x4250f6
cmp dword [esi + 0x70], 0
mov dword [edi], 0x80000002
je 0x4250cb
call fcn.00425a4f
cmp dword [esi + 0x68], 0
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x84]
jmp 0x42513e
mov edi, dword [esi + 0x28]
mov edx, 0x80000001
jmp 0x4250f6
mov edi, dword [esi + 0x28]
mov edx, 0x80000002
jmp 0x4250f6
mov edi, dword [esi + 0x28]
mov edx, 0x80000003
mov eax, dword [esi + 0xc]
mov dword [edi + 4], edx
movsd xmm0, qword [esi + 0x48]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
movsd qword [edi + 0x10], xmm0
push 1
push dword [esi + 0xb0]
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [edi], 0x80000001
cmp dword [esi + 0x70], 0
mov edi, dword [esi + 0x84]
mov ecx, dword [esi + 0x2c]
je 0x425137
call fcn.00425a4f
cmp dword [esi + 0x68], 0
mov ecx, dword [esi + 0x14]
sete al
or cl, al
jne 0x42514d
mov ecx, dword [esi + 0x64]
call fcn.00425a4f
test edi, edi
je 0x42515c
mov ecx, dword [esi + 0x88]
call fcn.00425a4f
mov eax, dword [esi + 0x530]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x4248bd
mov ecx, dword [esi + 0x64]
call fcn.00425a4f
jmp 0x4247f8
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
add ecx, dword [esi + 0xc]
cmp edx, ecx
cmova ecx, edx
push 0x442298
call fcn.00439d10
mov ecx, eax
push 0x442288
call fcn.00439d10
mov edx, dword [esi + 0x24]
push 0x442278
call fcn.00439d10
mov ecx, 0x4437cc
call fcn.0043a210
mov ecx, 0x442e48
call fcn.0043a250
mov ecx, 0x442e58
call fcn.0043a250
mov dword [esi + 0x538], 0
mov ecx, str.internal_error:_entered_unreachable_code__D
mov edx, 0x28
push 0x4418e4
call fcn.00439dd0
add esp, 4
jmp 0x42525b
mov eax, ecx
mov ecx, edi
mov edx, ebx
push 0x4422a8
push ebx
push eax
call fcn.0043a170
mov ecx, 0x443024
call fcn.0043a210
xor ecx, ecx
call fcn.00439b70
mov edx, dword [esi + 0xc]
mov ecx, 2
call fcn.00439b70
mov ecx, 4
mov edx, 0x10
call fcn.00439b90
xor ecx, ecx
mov edx, 0x18
jmp 0x425246
xor ecx, ecx
mov edx, 0x20
inc ecx
call fcn.00439b70
mov ecx, ebx
push 0x4418d4
call fcn.00439d70
add esp, 4
ud2
mov dword [esi + 0x128], 0
lea ecx, [esi + 0x58]
lea edx, [esi + 0xb8]
push eax
call fcn.0043b56e
push ebp
sub esp, 0x28
lea esi, [ebp - 0x53c]
mov ebp, dword [esi + 0x528]
cmp dword [esi + 0x48], 0
je 0x425294
mov ecx, dword [esi + 0x4c]
call fcn.00425a4f
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0x28
pop ebp
ret