Function at 0x42bdd5
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x90
mov eax, dword [ebp + 0x7c]
push ebx
xor ebx, ebx
push esi
mov dword [ebp + 0x58], ecx
mov dword [ebp + 0x48], eax
mov byte [ebp + 0x5f], bl
call fcn.0040e814
mov eax, dword [ebp + 0x7c]
mov byte [0x4c0be6], bl
cmp word [eax], 0x2a
lea eax, [ebp + 0x7c]
push eax
sete byte [ebp + 0x67]
call fcn.00405196
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
cmp word [eax], 0x2d
pop ecx
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x6f], 0x2a
jne 0x42be27
mov byte [ebp + 0x6f], 0x2d
xor esi, esi
inc esi
mov dword [ebp + 0x4c], eax
push 5
lea eax, [ebp + 0x7c]
push eax
push 0x4ab330
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x42bed3
push 2
lea eax, [ebp + 0x7c]
push eax
push 0x4ac014
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x42bed3
mov eax, dword [ebp + 0x4c]
movsx ecx, byte [ebp + 0x6f]
movzx edx, word [eax]
cmp ecx, edx
jne 0x42bede
movzx edx, word [eax + 2]
cmp ecx, edx
jne 0x42bede
add eax, 4
mov dword [ebp + 0x4c], eax
push 4
lea eax, [ebp + 0x4c]
push eax
push 0x4ac00c
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x42bec5
push esi
lea eax, [ebp + 0x4c]
push eax
push 0x4ab338
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x42bec5
push 4
lea eax, [ebp + 0x4c]
push eax
push 0x4a7c14
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x42bede
mov byte [ebp + 0x5f], 1
jmp 0x42bec8
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x7c], eax
jmp 0x42be2a
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x68], esi
jmp 0x42be2a
cmp dword [ebp + 0x68], ebx
je 0x42beec
mov dword [ebp + 0x54], 0x4a8714
jmp 0x42bef4
mov eax, dword [0x4bf2d8]
mov dword [ebp + 0x54], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
cmp dword [ebp + 0x68], ebx
mov eax, 0x4a9ff4
jne 0x42bf0a
mov eax, 0x4abff8
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp esi, ebx
je 0x42bf2f
mov ecx, 0xb7
cmp eax, ecx
jne 0x42bf2f
mov eax, ecx
jmp 0x42c6de
cmp dword [ebp + 0x68], ebx
je 0x42bf3d
mov byte [0x4c4003], 0x20
jmp 0x42bf4d
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
setne al
add al, 0x10
mov byte [0x4c4003], al
cmp dword [0x4c0eb0], ebx
push edi
push 0xd
pop ecx
mov esi, 0x4abfc0
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x4c0fb8
jne 0x42bf85
lea eax, [ebp - 0xe]
push eax
call fcn.00492742
test eax, eax
pop ecx
je 0x42bf85
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.0041b3a1
movsx eax, byte [0x4c4003]
push eax
push dword [ebp + 0x48]
push 0x4abf98
push edi
call fcn.0040f61e
push dword [0x4c1124]
push 0x4abf50
push edi
call fcn.0040f61e
add esp, 0x1c
call fcn.00417eaf
cmp byte [ebp + 0x67], bl
je 0x42bfc0
mov byte [0x4c4001], 1
cmp dword [ebp + 0x68], ebx
mov esi, 0x80000002
jne 0x42c14a
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
je 0x42c166
mov dword [ebp + 0x70], ebx
call fcn.0040e814
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4a9008
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], eax
je 0x42c016
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x60], 0x3fd
je 0x42c02c
push 0x4a8a08
push esi
call fcn.00447853
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4a8a08
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
je 0x42c05e
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4a8f68
push esi
mov byte [0x4c1081], 1
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], eax
je 0x42c099
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x60], 0x3fd
je 0x42c0af
push 0x4a8fc8
push esi
call fcn.00447853
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4a8fc8
push esi
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x70], ebx
je 0x42c0e1
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x50]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4a7918
push esi
mov dword [ebp + 0x50], ebx
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
cmp dword [ebp + 0x50], ebx
je 0x42c112
push dword [ebp + 0x50]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 0x2ad1
push 0x4ab30c
push edi
call fcn.0040f70e
push 0x2ad3
push 0x4ab30c
push edi
call fcn.0040f70e
call fcn.0040e6e6
push 0x2ad5
push 0x4ab30c
push edi
call fcn.0040f70e
add esp, 0x24
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
je 0x42c166
mov ecx, dword [ebp + 0x58]
push ebx
push 0x24
push ebx
push 0x4a69d4
call fcn.00420aee
mov eax, dword [ebp + 0x7c]
xor ecx, ecx
mov cx, word [eax]
cmp cx, 0x2a
mov dword [ebp + 0x44], ecx
jne 0x42c188
add eax, 2
cmp word [eax], 0x23
je 0x42c188
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
call fcn.0040e2c3
mov eax, 0x4a69d4
push eax
push eax
call sym.PECMD.exe_LoadEnvi
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x42c1a5
mov byte [0x4c1331], 1
call fcn.004387a7
call fcn.0042bd8a
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 4
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x38]
push eax
push 4
push 0x4abf30
push 0x4a7918
push esi
call fcn.00439000
push 0x2adf
push 0x4ab30c
push edi
call fcn.0040f70e
push ebx
push 0x4c0fb8
call fcn.0048a13a
mov eax, dword [ebp + 0x58]
add esp, 0x2c
cmp dword [eax + 0x44], ebx
jne 0x42c268
test byte [0x4c10a0], 1
jne 0x42c217
or dword [0x4c10a0], 1
push 0x4a5bb3
mov dword [0x4c109c], ebx
call fcn.00493136
pop ecx
mov ecx, dword [ebp + 0x58]
push 0x10000
mov dword [ecx + 0x44], 0x4c109c
call fcn.0043c957
lea ecx, [ebp + 0x60]
call fcn.0043dd7e
push dword [ebp + 0x60]
mov ecx, 0x4c109c
call fcn.0046b933
mov eax, dword [0x4c109c]
mov ecx, dword [ebp + 0x58]
push 1
push dword [ebp + 0x48]
mov dword [ebp + 0x60], ebx
mov eax, dword [eax]
mov dword [ecx + 0x48], eax
call fcn.00448eba
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x60]
mov dword [eax + 0x50], ebx
call fcn.00437e1a
push 0x2aeb
push 0x4ab30c
push edi
call fcn.0040f70e
add esp, 0xc
cmp dword [ebp + 0x68], ebx
jne 0x42c2a3
mov al, byte [0x4c4003]
push 1
mov byte [ebp + 0x67], al
lea eax, [ebp + 0x67]
push eax
push 3
push 0x4abf20
push 0x4a7918
push esi
call fcn.00439000
add esp, 0x18
push 0x2aef
push 0x4ab30c
push edi
call fcn.0040f70e
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], bx
je 0x42c2c3
call fcn.004111e9
push 4
push 0x4c0ea4
push 4
push dword [ebp + 0x54]
push 0x4a7918
push esi
call fcn.00439000
add esp, 0x18
cmp word [ebp + 0x44], bx
jne 0x42c2e8
cmp dword [ebp + 0x68], ebx
je 0x42c2ed
call fcn.0042353d
mov ecx, dword [ebp + 0x58]
call fcn.004176b4
push 0x8000
call fcn.0044a789
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
pop ecx
jne 0x42c30d
cmp dword [ebp + 0x68], ebx
je 0x42c354
push 0x2afa
push 0x4ab30c
push edi
call fcn.0040f70e
push ebx
push 0x4c0bcc
push 0x10000
push 0x80000
push ebx
push 0x42bdaf
call fcn.00437fa4
add esp, 0x24
jmp 0x42c351
lea ecx, [eax + 2]
cmp word [ecx], 0x23
je 0x42c35a
mov dword [ebp + 0x7c], ecx
lea ecx, [ebp + 0x7c]
call fcn.0040e2c3
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
je 0x42c33d
cmp word [eax], bx
je 0x42c69c
push 0x2b02
push 0x4ab30c
push edi
call fcn.0040f70e
add esp, 0xc
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 0x5c8
push eax
lea ecx, [ebp + 0x48]
call fcn.0043dd9c
mov eax, dword [ebp + 0x48]
mov word [eax], bx
mov edi, dword [ebp + 0x48]
push 0x104
add edi, 0x280
mov dword [ebp + 0x40], eax
push edi
lea eax, [edi + 0x488]
push ebx
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.DLL_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x60], eax
jne 0x42c3cb
mov dword [ebp + 0x60], edi
jmp 0x42c3cf
add dword [ebp + 0x60], 2
push dword [ebp + 0x7c]
call fcn.004108d0
test eax, eax
pop ecx
lea ecx, [ebp + 0x54]
je 0x42c41f
push dword [ebp + 0x7c]
call fcn.00446497
push 4
push dword [ebp + 0x7c]
push 0x4abf18
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42c404
mov byte [0x4c0f35], 1
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push dword [ebp + 0x54]
call fcn.0042d06c
lea ecx, [ebp + 0x54]
call fcn.00437e1a
jmp 0x42c694
mov eax, dword [ebp + 0x7c]
mov byte [ebp + 0x6f], bl
mov dword [ebp + 0x70], eax
call fcn.0043dd7e
mov ecx, dword [ebp + 0x58]
push ebx
push 0x1000
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.0043359b
push 0x400
lea ecx, [ebp + 0x50]
call fcn.0043dd9c
mov eax, dword [ebp + 0x50]
push ebx
push ebx
push 3
push ebx
push 7
mov word [eax], bx
mov eax, dword [ebp + 0x50]
push 0x80000000
push dword [ebp + 0x54]
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x3c], ebx
call fcn.004051d2
push ebx
lea eax, [ebp + 0x44]
push eax
push 0x7fe
push dword [ebp + 0x50]
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp + 0x70]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp + 0x70]
cmp word [eax], 0xfeff
jne 0x42c4a9
add dword [ebp + 0x70], 2
push 7
push dword [ebp + 0x70]
push 0x4abf08
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x42c51b
add dword [ebp + 0x70], 0xe
jmp 0x42c50d
lea eax, [ebp + 0x70]
push eax
call fcn.00405172
mov eax, dword [ebp + 0x70]
pop ecx
mov cx, word [eax]
cmp cx, 0x20
je 0x42c4df
cmp cx, 9
jne 0x42c4e6
inc eax
inc eax
mov dword [ebp + 0x70], eax
jmp 0x42c4d0
movzx eax, word [eax]
push eax
call fcn.00402bd8
add esp, 4
test al, al
jne 0x42c51b
push 0xd
lea eax, [ebp + 0x70]
push eax
push 0x4abeec
call fcn.00437f44
add esp, 0xc
test eax, eax
jne 0x42c517
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
jne 0x42c4c3
jmp 0x42c51b
mov byte [ebp + 0x6f], 1
lea ecx, [ebp + 0x3c]
call fcn.00402b5a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
lea ecx, [ebp + 0x54]
call fcn.00437e1a
cmp byte [ebp + 0x6f], bl
je 0x42c566
push dword [ebp + 0x7c]
push 0x4abec8
push dword [ebp + 0x68]
call dword [sym.imp.USER32.DLL_wsprintfW]
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push ebx
push ebx
push ebx
push dword [ebp + 0x68]
mov byte [0x4c0f35], 1
call fcn.0042d06c
jmp 0x42c694
push dword [ebp + 0x60]
push edi
mov edi, dword [sym.imp.USER32.DLL_wsprintfW]
push 0x4abea0
push dword [ebp + 0x68]
call edi
add esp, 0x10
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax*2]
push 0x4abec8
push eax
call edi
mov eax, dword [ebp + 0x40]
add esp, 0xc
cmp word [eax], bx
je 0x42c67f
mov dword [ebp + 0x70], ebx
call fcn.0040e814
mov edi, dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push ebx
push ebx
push ebx
push 0x4a9008
push esi
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
mov dword [ebp + 0x40], eax
je 0x42c5e4
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp + 0x40], 0x3fd
je 0x42c5fa
push 0x4a8a08
push esi
call fcn.00447853
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4a8a08
push esi
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
je 0x42c628
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
lea eax, [ebp + 0x70]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 1
push eax
push 1
push ebx
push ebx
push 0x4a8fc8
push esi
mov byte [0x4c1081], 1
mov dword [ebp + 0x70], ebx
call edi
cmp dword [ebp + 0x70], ebx
je 0x42c65d
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 4
lea eax, [ebp + 0x38]
push eax
push 4
push 0x4aa29c
push 0x4a8a08
push esi
mov dword [ebp + 0x38], 1
call fcn.00439000
add esp, 0x18
movsx eax, byte [ebp + 0x5f]
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push eax
push ebx
push ecx
push dword [ebp + 0x68]
call fcn.00409677
lea ecx, [ebp + 0x48]
call fcn.00437e1a
mov esi, dword [sym.imp.USER32.DLL_GetMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1c]
push eax
call esi
pop edi
jmp 0x42c6cb
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.DLL_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1c]
push eax
call esi
test eax, eax
jne 0x42c6ae
push dword [0x4c0e90]
call dword [sym.imp.USER32.DLL_UnhookWindowsHookEx]
mov eax, dword [ebp + 0x24]
pop esi
pop ebx
add ebp, 0x74
leave
ret 4