Function at 0x428740
Capabilities:
Check for time delay via gettickcount
Check os version
Create directory
Create process on windows
Delete file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x450890
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1f4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
push edi
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x4287ba
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00418fd0
lea eax, [esp + 0x1f]
mov byte [esp + 0x1f], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4287c6
sub eax, edx
je 0x4287db
call fcn.0041a3c0
call fcn.00419840
cmp dword [esp + 0x214], edi
jne 0x4288a2
mov esi, 0x10
cmp dword [esp + 0x218], esi
jb 0x428806
mov ecx, dword [esp + 0x204]
push ecx
call fcn.004393c9
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x42883a
mov edx, dword [esp + 0x220]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x428869
mov eax, dword [esp + 0x23c]
push eax
call fcn.004393c9
add esp, 4
cmp dword [esp + 0x26c], esi
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
jb 0x428898
mov ecx, dword [esp + 0x258]
push ecx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x429dee
cmp dword [esp + 0x230], edi
jne 0x42896d
mov esi, 0x10
cmp dword [esp + 0x218], esi
jb 0x4288cd
mov edx, dword [esp + 0x204]
push edx
call fcn.004393c9
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x428901
mov eax, dword [esp + 0x220]
push eax
call fcn.004393c9
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x428930
mov ecx, dword [esp + 0x23c]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
cmp dword [esp + 0x26c], esi
jb 0x428898
mov edx, dword [esp + 0x258]
push edx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x429dee
cmp dword [esp + 0x24c], edi
jne 0x428a38
mov esi, 0x10
cmp dword [esp + 0x218], esi
jb 0x428998
mov eax, dword [esp + 0x204]
push eax
call fcn.004393c9
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], esi
jb 0x4289cc
mov ecx, dword [esp + 0x220]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x234], ebx
mov dword [esp + 0x230], edi
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], esi
jb 0x4289fb
mov edx, dword [esp + 0x23c]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x250], ebx
mov dword [esp + 0x24c], edi
mov byte [esp + 0x23c], 0
cmp dword [esp + 0x26c], esi
jb 0x428898
mov eax, dword [esp + 0x258]
push eax
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x429dee
call fcn.00430090
sub eax, 1
jne 0x428a60
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
call esi
mov ebx, dword [sym.imp.USER32.dll_GetCapture]
call ebx
mov ebp, dword [sym.imp.USER32.dll_GetClipboardOwner]
call ebp
call esi
call ebx
call ebp
mov ebp, dword [esp + 0x20]
mov ecx, dword [ebp + 0x300]
sub ecx, dword [ebp + 0x2fc]
add ebp, 0x2f0
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
xor ebx, ebx
add ecx, edx
je 0x428aec
jmp 0x428a90
cmp dword [esp + 0x218], 0x10
mov esi, dword [esp + 0x204]
jae 0x428aa8
lea esi, [esp + 0x204]
push ebx
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x18], 0x10
jb 0x428abb
mov eax, dword [eax + 4]
jmp 0x428abe
add eax, 4
push esi
push eax
call fcn.0043a90f
add esp, 8
test eax, eax
je 0x428c8b
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
jb 0x428a90
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
mov eax, 0xf
add ebx, edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x184], eax
mov dword [esp + 0x180], edi
mov byte [esp + 0x170], 0
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x19c], edi
mov byte [esp + 0x18c], 0
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1b8], edi
mov byte [esp + 0x1a8], 0
push edi
call fcn.0043a6c4
add esp, 4
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x208]
push ecx
lea ecx, [esp + 0x178]
mov dword [esp + 0x200], 4
call fcn.00402d80
mov edx, dword [esp + 0x20]
push 0xffffffffffffffff
push edi
add edx, 0x260
push edx
lea ecx, [esp + 0x194]
mov dword [esp + 0x1cc], edi
call fcn.00402d80
call fcn.00435460
sub eax, 1
jne 0x428bae
call fcn.00418100
call fcn.00418970
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x428bd8
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00418100
mov eax, dword [esp + 0x19c]
cmp eax, edi
je 0x428c20
lea esi, [eax - 1]
cmp eax, esi
ja 0x428bef
call fcn.00438391
cmp dword [esp + 0x1a0], 0x10
mov eax, dword [esp + 0x18c]
jae 0x428c07
lea eax, [esp + 0x18c]
cmp byte [esi + eax], 0x5c
je 0x428c20
push 0x5c
mov eax, 1
lea edi, [esp + 0x18c]
call fcn.00412590
push 0
call fcn.0043a6c4
add esp, 4
push 0
lea eax, [esp + 0x220]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x190]
call fcn.00405750
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 4
cmp esi, eax
jbe 0x428c73
push 0
call edi
call fcn.00419840
call fcn.0041a520
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
lea ecx, [esp + 0x24]
cmp eax, ecx
jle 0x428ca6
push 0
call edi
jmp 0x428caa
mov dword [esp + 0x28], ebx
call fcn.00417640
test eax, eax
je 0x428d53
call fcn.0041a450
jmp 0x428d53
push 0xe
call esi
mov dword [esp + 0x1f4], 4
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x428cfd
lea esi, [eax - 1]
cmp eax, esi
ja 0x428ccc
call fcn.00438391
cmp dword [esp + 0x1a0], 0x10
mov eax, dword [esp + 0x18c]
jae 0x428ce4
lea eax, [esp + 0x18c]
cmp byte [esi + eax], 0x5c
je 0x428cfd
push 0x5c
mov eax, 1
lea edi, [esp + 0x18c]
call fcn.00412590
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x190]
push edx
lea ecx, [esp + 0x1b0]
call fcn.00402d80
push 0
lea eax, [esp + 0x23c]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x190]
call fcn.00405750
lea ecx, [esp + 0x16c]
push ecx
mov edi, ebp
call fcn.0042abd0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 3
call fcn.00429e20
xor edi, edi
push ebx
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x54], 3
push ebx
mov eax, ebp
jbe 0x428f37
call fcn.0042ab30
cmp dword [eax + 0x18], 0x10
jb 0x428d78
mov eax, dword [eax + 4]
jmp 0x428d7b
add eax, 4
push eax
lea edx, [esp + 0x4c]
push edx
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x48], esp
cmp eax, ebx
jb 0x428dac
mov ecx, dword [edi]
jmp 0x428dae
mov ecx, edi
cmp ecx, 0x45784c
ja 0x428de7
cmp eax, ebx
jb 0x428dbe
mov ecx, dword [edi]
jmp 0x428dc0
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45784c
jbe 0x428de7
cmp eax, ebx
jb 0x428dd3
mov edi, dword [edi]
push 0x1b
mov eax, 0x45784c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x428e29
cmp eax, 0x1b
jae 0x428df9
mov ecx, dword [esi + 0x14]
push ecx
push 0x1b
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x428e04
mov eax, dword [edi]
jmp 0x428e06
mov eax, edi
push 0x1b
push 0x45784c
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x1b
cmp dword [esi + 0x18], ebx
jb 0x428e25
mov edi, dword [edi]
mov byte [edi + 0x1b], 0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 9
call fcn.00401850
mov byte [esp + 0x1f8], 0xa
cmp dword [eax + 0x18], ebx
jb 0x428e54
mov eax, dword [eax + 4]
jmp 0x428e57
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x10
cmp dword [esp + 0x60], ebx
jb 0x428e7a
mov eax, dword [esp + 0x4c]
push eax
call fcn.004393c9
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x16c]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x4c], 0
call fcn.00429e20
call fcn.004300d0
test eax, eax
je 0x428ea6
call fcn.004308a0
cmp dword [esp + 0x218], ebx
jb 0x428ebf
mov ecx, dword [esp + 0x204]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x218], edi
mov dword [esp + 0x214], ebp
mov byte [esp + 0x204], 0
cmp dword [esp + 0x234], ebx
jb 0x428eee
mov edx, dword [esp + 0x220]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x234], edi
mov dword [esp + 0x230], ebp
mov byte [esp + 0x220], 0
cmp dword [esp + 0x250], ebx
jb 0x428f1d
mov eax, dword [esp + 0x23c]
push eax
call fcn.004393c9
add esp, 4
cmp dword [esp + 0x26c], ebx
mov dword [esp + 0x250], edi
mov dword [esp + 0x24c], ebp
jmp 0x42887e
call fcn.0042ab30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
add eax, 0x1c
push edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push eax
mov byte [ecx + 4], 0
call fcn.00402d80
call fcn.0041d5f0
cmp eax, edi
jge 0x429b19
lea edx, [esp + 0x8c]
push edx
call fcn.0042af60
push 0
mov byte [esp + 0x1f8], 0xd
call fcn.0043a6c4
add esp, 4
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x428fbd
mov ecx, dword [edi]
jmp 0x428fbf
mov ecx, edi
cmp ecx, 0x457774
ja 0x428ff8
cmp eax, ebx
jb 0x428fcf
mov ecx, dword [edi]
jmp 0x428fd1
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457774
jbe 0x428ff8
cmp eax, ebx
jb 0x428fe4
mov edi, dword [edi]
push 0xb
mov eax, 0x457774
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x42903a
cmp eax, 0xb
jae 0x42900a
mov ecx, dword [esi + 0x14]
push ecx
push 0xb
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x429015
mov eax, dword [edi]
jmp 0x429017
mov eax, edi
push 0xb
push 0x457774
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0xb
cmp dword [esi + 0x18], ebx
jb 0x429036
mov edi, dword [edi]
mov byte [edi + 0xb], 0
lea esi, [esp + 0x18c]
call fcn.004016b0
mov byte [esp + 0x1f8], 0xe
call fcn.00401770
mov byte [esp + 0x1f4], 0xf
cmp dword [eax + 0x18], ebx
jb 0x429065
mov edx, dword [eax + 4]
jmp 0x429068
lea edx, [eax + 4]
mov eax, edx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429082
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x50]
call fcn.004030c0
lea edx, [esp + 0x48]
push edx
lea ebx, [esp + 0x90]
mov byte [esp + 0x1f8], 0x10
call fcn.0042a780
cmp dword [esp + 0x60], 0x10
jb 0x4290c3
mov eax, dword [esp + 0x4c]
push eax
call fcn.004393c9
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x44], 0x10
mov edi, 0xf
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x4290ea
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x16c]
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00429e20
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
lea edx, [esp + 0x24]
cmp eax, edx
jle 0x42911c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x429120
push 0xe
call esi
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov dword [esp + 0x214], 0xd
mov esi, esp
mov dword [esi + 0x18], edi
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, 0x10
jb 0x429150
mov ecx, dword [edi]
jmp 0x429152
mov ecx, edi
cmp ecx, 0x457780
ja 0x42918d
cmp eax, 0x10
jb 0x429163
mov ecx, dword [edi]
jmp 0x429165
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457780
jbe 0x42918d
cmp eax, 0x10
jb 0x429179
mov edi, dword [edi]
push 5
mov eax, 0x457780
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x4291d0
cmp eax, 5
jae 0x42919f
mov ecx, dword [esi + 0x14]
push ecx
push 5
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4291ab
mov eax, dword [edi]
jmp 0x4291ad
mov eax, edi
push 5
push 0x457780
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 5
jb 0x4291cd
mov edi, dword [edi]
mov byte [edi + 5], bl
lea esi, [esp + 0x18c]
call fcn.004016b0
mov byte [esp + 0x1f8], 0x13
call fcn.00401ca0
mov byte [esp + 0x1f4], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x4291fc
mov eax, dword [eax + 4]
jmp 0x4291ff
add eax, 4
push eax
lea ecx, [esp + 0x4c]
call fcn.00404230
lea edx, [esp + 0x48]
push edx
lea ebx, [esp + 0x90]
mov byte [esp + 0x1f8], 0x15
call fcn.0042a780
mov esi, 0x10
cmp dword [esp + 0x60], esi
jb 0x42923a
mov eax, dword [esp + 0x4c]
push eax
call fcn.004393c9
add esp, 4
xor ebx, ebx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x44], esi
jb 0x42925f
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x16c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x1f4], 0xd
call fcn.00429e20
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x3c], esp
push edx
lea ecx, [esp + 0xa8]
call fcn.0042a610
mov edi, dword [esp + 0x40]
push edi
mov eax, ebp
mov byte [esp + 0x210], 0x16
call fcn.0042ab30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d80
mov ecx, dword [esp + 0x54]
add ecx, 0x18
mov byte [esp + 0x228], 0xd
call fcn.00434970
cmp eax, ebx
push edi
mov eax, ebp
jge 0x429468
call fcn.0042ab30
inc dword [eax + 0x54]
add eax, 0x54
push edi
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x18], 0x10
jb 0x429309
mov eax, dword [eax + 4]
jmp 0x42930c
add eax, 4
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x21
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x457868
mov byte [ecx + 4], bl
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x17
call fcn.00401770
mov byte [esp + 0x1f8], 0x18
cmp dword [eax + 0x18], 0x10
jb 0x429360
mov eax, dword [eax + 4]
jmp 0x429363
add eax, 4
mov ecx, dword [esp + 0x24]
push eax
push 1
push ecx
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 0xd
call fcn.00429e20
push edi
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x18], 0x10
jb 0x4293a3
mov eax, dword [eax + 4]
jmp 0x4293a6
add eax, 4
push eax
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x45788c
mov byte [ecx + 4], bl
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x19
call fcn.00401ad0
mov byte [esp + 0x1f8], 0x1a
cmp dword [eax + 0x18], 0x10
jb 0x4293fa
mov eax, dword [eax + 4]
jmp 0x4293fd
add eax, 4
push eax
mov eax, dword [esp + 0x28]
push 2
push eax
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
lea esi, [esp + 0x16c]
call fcn.00429e20
lea esi, [esp + 0x8c]
call fcn.0042a730
lea ecx, [esp + 0x200]
call fcn.00402bd0
lea ecx, [esp + 0x21c]
call fcn.00402bd0
lea ecx, [esp + 0x238]
call fcn.00402bd0
lea ecx, [esp + 0x254]
call fcn.00402bd0
mov eax, 0x80004005
jmp 0x429dee
call fcn.0042ab30
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402ba0
call fcn.0041d5f0
mov dword [esp + 0x168], 0xf
mov dword [esp + 0x164], ebx
mov byte [esp + 0x154], bl
cmp eax, ebx
mov byte [esp + 0x1f4], 0x1b
jge 0x429925
mov esi, dword [esp + 0x28]
push esi
mov eax, ebp
call fcn.0042ab30
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x74]
call fcn.00402c30
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push esi
mov eax, ebp
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
call fcn.0042ab30
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x74]
call fcn.00410580
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
call fcn.00435430
test eax, eax
je 0x429505
call fcn.0041a5f0
mov dword [esp + 0x24], 0
lea ecx, [ecx]
mov ebx, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
lea esi, [esp + 0xa4]
call fcn.0040f4b0
mov byte [esp + 0x1f4], 0x1c
call fcn.004174a0
test eax, eax
je 0x42953f
call fcn.0041a6a0
call fcn.00419900
push 1
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 9
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x457890
mov byte [ecx + 4], 0
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x1d
call fcn.00401930
mov byte [esp + 0x1f8], 0x1e
cmp dword [eax + 0x18], 0x10
jb 0x429599
mov eax, dword [eax + 4]
jmp 0x42959c
add eax, 4
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.0040f570
push edi
push ebx
mov byte [esp + 0x1fc], 0x1f
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
push edx
push ecx
push edi
push ebx
push eax
lea edx, [esp + 0xc0]
push edx
xor ecx, ecx
call fcn.00410770
movzx edi, al
add esp, 0x20
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x1f8], 0x1e
call fcn.0040f660
cmp dword [esp + 0x44], 0x10
jb 0x4295f9
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004393c9
add esp, 4
xor ebx, ebx
lea esi, [esp + 0x16c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x1f4], 0x1c
call fcn.00429e20
lea esi, [esp + 0xa4]
cmp edi, ebx
je 0x4297ee
lea edi, [ebx + 1]
call fcn.0040f500
lea ecx, [esp + 0x2c]
call fcn.0040f550
push ebx
lea edx, [esp + 0x30]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x158]
mov byte [esp + 0x1fc], 0x20
call fcn.00405750
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1f4], 0x1c
call fcn.00402bd0
call fcn.00417360
test eax, eax
je 0x42967b
call fcn.0041a770
sub esp, 0x1c
lea eax, [esp + 0x16c]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402ba0
call fcn.0041d5f0
mov esi, eax
call fcn.00417690
test eax, eax
je 0x4296a6
call fcn.00419f30
call fcn.004174a0
test eax, eax
je 0x4296b9
call fcn.00417ea0
call fcn.0041a7e0
cmp esi, ebx
jge 0x429709
mov eax, dword [esp + 0x154]
mov esi, 0x10
cmp dword [esp + 0x168], esi
jae 0x4296d9
lea eax, [esp + 0x154]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [esp + 0x154]
je 0x429800
cmp dword [esp + 0x168], esi
jae 0x429700
lea eax, [esp + 0x154]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0xa4]
call fcn.0042aef0
mov edi, eax
lea eax, [esp + 0xa4]
call fcn.0042ae70
add edi, eax
lea esi, [esp + 0x64]
call fcn.004037f0
call fcn.004172c0
sub eax, 1
jne 0x429742
call fcn.00436210
call fcn.00418100
lea esi, [esp + 0xa4]
mov byte [esp + 0x1f4], 0x1b
call fcn.0040f300
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 0x1e
jb 0x429510
mov esi, dword [esp + 0x28]
push esi
mov eax, ebp
call fcn.0042ab30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
add eax, 0x38
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], 0
call fcn.00402d80
call fcn.0041d5f0
mov edi, eax
lea eax, [esp + 0x1f]
mov byte [esp + 0x1f], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4297b0
sub eax, edx
je 0x4297c5
call fcn.00418970
call fcn.00418fd0
cmp edi, ebx
jge 0x42991f
push esi
mov eax, ebp
call fcn.0042ab30
add eax, 0x38
mov edi, 0x10
cmp dword [eax + 0x18], edi
jb 0x42988e
mov eax, dword [eax + 4]
jmp 0x429891
mov byte [esp + 0x1f4], 0x1b
call fcn.0040f300
jmp 0x429768
cmp dword [esp + 0x168], esi
jae 0x429810
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x25
mov ecx, str.6WRUHR_L__aNCemC
call fcn.00404200
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x21
call fcn.00401ca0
mov ecx, eax
mov byte [esp + 0x1f8], 0x22
call fcn.00402d10
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
call fcn.00429e20
lea esi, [esp + 0xa4]
call fcn.0040f300
lea ecx, [esp + 0x150]
call fcn.00402bd0
jmp 0x429422
add eax, 4
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
xor eax, eax
push 0x27
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push str.pe
mov byte [ecx + 4], al
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x23
call fcn.00401770
mov byte [esp + 0x1f8], 0x24
cmp dword [eax + 0x18], edi
jb 0x4298e6
mov eax, dword [eax + 4]
jmp 0x4298e9
add eax, 4
mov ecx, dword [esp + 0x24]
push eax
push 1
push ecx
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
lea esi, [esp + 0x16c]
call fcn.00429e20
lea ecx, [esp + 0x150]
call fcn.00402bd0
jmp 0x429422
mov edi, dword [esp + 0x28]
xor ebx, ebx
push edi
mov eax, ebp
call fcn.0042ab30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
add eax, 0x1c
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d80
mov esi, dword [esp + 0x3c]
add esi, 0x18
call fcn.00432640
cmp eax, ebx
push edi
mov eax, ebp
jge 0x429ad6
call fcn.0042ab30
inc dword [eax + 0x54]
add eax, 0x54
call fcn.00417290
test eax, eax
je 0x42997f
call fcn.00435810
push edi
mov eax, ebp
call fcn.0042ab30
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x429995
mov eax, dword [eax + 4]
jmp 0x429998
add eax, 4
push eax
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x1d
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.6WRUH
mov byte [ecx + 4], bl
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x25
call fcn.00401ad0
mov byte [esp + 0x1f8], 0x26
cmp dword [eax + 0x18], 0x10
jb 0x4299ec
mov eax, dword [eax + 4]
jmp 0x4299ef
add eax, 4
push eax
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 0x1b
call fcn.00429e20
push ebx
call fcn.0043a6c4
add esp, 4
push edi
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x18], 0x10
jb 0x429a38
mov eax, dword [eax + 4]
jmp 0x429a3b
add eax, 4
push eax
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x45790c
mov byte [ecx + 4], bl
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x27
call fcn.00401ca0
mov byte [esp + 0x1f8], 0x28
cmp dword [eax + 0x18], 0x10
jb 0x429a8f
mov eax, dword [eax + 4]
jmp 0x429a92
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 2
push edx
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00402bd0
lea esi, [esp + 0x16c]
call fcn.00429e20
call fcn.00435460
test eax, eax
je 0x429ac5
call fcn.0041a8b0
lea ecx, [esp + 0x150]
call fcn.00402bd0
jmp 0x429422
call fcn.0042ab30
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x429ae9
mov eax, dword [eax + 4]
jmp 0x429aec
add eax, 4
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x150]
call fcn.00402bd0
lea esi, [esp + 0x8c]
mov byte [esp + 0x1f4], 3
call fcn.0042a730
mov ebx, dword [esp + 0x28]
xor eax, eax
xor esi, esi
push 0x40
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x10c]
push esi
push eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x110], esi
call fcn.0043fbd0
add esp, 0xc
push esi
mov dword [esp + 0x134], 1
call fcn.0043a6c4
add esp, 4
xor ecx, ecx
push ebx
mov eax, ebp
mov word [esp + 0x138], cx
call fcn.0042ab30
add eax, 0x1c
push eax
mov edi, 0x45763c
lea esi, [esp + 0x30]
call fcn.00405500
add esp, 4
lea edx, [esp + 0x254]
push edx
push eax
lea edi, [esp + 0x1d0]
mov byte [esp + 0x1fc], 0x29
call fcn.004055b0
add esp, 8
mov byte [esp + 0x1f4], 0x2b
cmp dword [esp + 0x44], 0x10
jb 0x429bca
mov eax, dword [esp + 0x30]
push eax
call fcn.004393c9
add esp, 4
push ebx
mov eax, ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.0042ab30
add eax, 0x38
mov ecx, 0x10
cmp dword [eax + 0x18], ecx
jb 0x429bf9
mov eax, dword [eax + 4]
jmp 0x429bfc
add eax, 4
cmp dword [esp + 0x1e0], ecx
mov ecx, dword [esp + 0x1cc]
jae 0x429c13
lea ecx, [esp + 0x1cc]
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0x108]
push edx
push eax
push 0
push 0xc000000
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esp + 0x7c]
push eax
call edi
mov ecx, dword [esp + 0x80]
push ecx
call edi
test esi, esi
jne 0x429db0
mov eax, dword [esp + 0x1cc]
mov edi, 0x10
cmp dword [esp + 0x1e0], edi
jae 0x429c74
lea eax, [esp + 0x1cc]
push eax
lea edx, [esp + 0x4c]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x1f
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x457910
mov byte [ecx + 4], 0
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x2c
call fcn.00401930
mov byte [esp + 0x1f8], 0x2d
cmp dword [eax + 0x18], edi
jb 0x429ccc
mov eax, dword [eax + 4]
jmp 0x429ccf
add eax, 4
push eax
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.00402bd0
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f4], 0x2b
call fcn.00429e20
push ebx
mov eax, ebp
call fcn.0042ab30
cmp dword [eax + 0x18], edi
jb 0x429d0e
mov eax, dword [eax + 4]
jmp 0x429d11
add eax, 4
push eax
lea ecx, [esp + 0x4c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x45790c
mov byte [ecx + 4], 0
call fcn.004030c0
lea esi, [esp + 0x190]
call fcn.004016b0
mov byte [esp + 0x1fc], 0x2e
call fcn.00401ca0
mov byte [esp + 0x1f8], 0x2f
cmp dword [eax + 0x18], edi
jb 0x429d69
mov eax, dword [eax + 4]
jmp 0x429d6c
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 2
push edx
call fcn.0041d220
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.00402bd0
lea esi, [esp + 0x16c]
call fcn.00429e20
call fcn.004176f0
test eax, eax
je 0x429d9f
call fcn.0041a980
lea ecx, [esp + 0x1c8]
call fcn.00402bd0
jmp 0x42942e
lea ecx, [esp + 0x1c8]
call fcn.00402bd0
lea ecx, [esp + 0x200]
call fcn.00402bd0
lea ecx, [esp + 0x21c]
call fcn.00402bd0
lea ecx, [esp + 0x238]
call fcn.00402bd0
lea ecx, [esp + 0x254]
call fcn.00402bd0
xor eax, eax
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.00438dc1
add esp, 0x1e4
ret 0x74