Function at 0x4296fc
Capabilities:
Check for time delay via gettickcount
Get disk information
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x148
push ebx
push esi
mov dword [ebp + 0x64], ecx
xor ebx, ebx
push edi
lea ecx, [ebp + 0x7c]
mov dword [ebp + 8], ebx
call fcn.0040c032
mov eax, dword [0x4afe10]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x38], eax
mov byte [ebp + 0x5b], bl
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 4], ebx
call fcn.0043717e
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x49c2bc
mov dword [ebp + 0x34], ebx
mov byte [ebp + 0x33], bl
call fcn.00438eee
add esp, 0xc
push 0x2d
mov byte [ebp + 0x63], al
mov eax, dword [ebp + 0x7c]
pop edi
cmp word [eax], di
mov byte [ebp + 0x4e], bl
mov byte [ebp + 0x4f], bl
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x3c], 0x2a
jne 0x429773
mov dword [ebp + 0x3c], edi
push 8
lea eax, [ebp + 0x7c]
push eax
push str.sysinit
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4297a5
mov eax, dword [ebp + 0x7c]
cmp word [eax], di
mov dword [ebp + 0x3c], 0x2a
jne 0x42992e
mov dword [ebp + 0x3c], edi
jmp 0x42992e
mov eax, dword [ebp + 0x7c]
mov esi, dword [ebp + 0x3c]
cmp si, word [eax]
jne 0x429a98
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x49a8c4
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4297d6
or dword [ebp + 0x5c], 8
jmp 0x4297a5
push ebx
lea eax, [ebp + 0x7c]
push eax
push 0x49895e
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4297f2
or dword [ebp + 0x5c], 4
jmp 0x4297a5
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x7c]
push eax
push 0x49c2ac
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x429a7c
push 4
lea eax, [ebp + 0x7c]
push eax
push 0x49c2a4
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x429a7c
push 8
lea eax, [ebp + 0x7c]
push eax
push str.2sysinit
call fcn.00438eee
add esp, 0xc
test al, al
je 0x429917
push dword [ebp + 0x64]
mov byte [0x4afeba], 1
call fcn.0040f152
push dword [ebp + 0x64]
call fcn.00433c3e
push eax
mov dword [ebp + 0x50], eax
call fcn.00433c50
add esp, 0xc
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
add edi, 5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x42990b
cmp byte [0x4ae290], bl
jle 0x42990b
cmp ecx, ebx
jbe 0x4298fc
cmp ecx, 0x7d0
jbe 0x4298a2
mov ecx, 0x3e8
jmp 0x4298aa
cmp ecx, 0x64
jbe 0x4298aa
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp + 0x44]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x4298fc
cmp esi, ebx
jg 0x4298d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x429904
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x429904
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, ebx
jle 0x4298fc
dec esi
cmp byte [0x4ae290], bl
jg 0x4298be
xor esi, esi
jmp 0x429875
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x429939
push 7
lea eax, [ebp + 0x7c]
push eax
push 0x49c290
call fcn.00438eee
add esp, 0xc
test al, al
je 0x429954
mov dword [ebp + 0x34], 0x49c280
mov byte [ebp + 0x33], 1
mov ecx, dword [ebp + 0x64]
push 0x49b370
push str.__UDM.sysinit
call fcn.00436b54
or byte [ebp + 0x5d], 1
jmp 0x4297a5
mov eax, dword [ebp + 0x7c]
cmp si, word [eax]
jne 0x429a93
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4987c4
call fcn.00438eee
add esp, 0xc
test al, al
je 0x429985
or byte [ebp + 0x4e], 1
jmp 0x4297a5
push edi
lea eax, [ebp + 0x7c]
push eax
push 0x49b1c0
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4299a4
or byte [ebp + 0x4f], 1
jmp 0x4297a5
push 5
lea eax, [ebp + 0x7c]
push eax
push str.local
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4299c8
or dword [ebp + 0x5c], 0x10
or dword [ebp + 0x14], 0x10
jmp 0x4297a5
push 8
lea eax, [ebp + 0x7c]
push eax
push str.EnviMode
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4299ec
or dword [ebp + 0x5c], 0x20
or dword [ebp + 0x14], 0x20
jmp 0x4297a5
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x49b208
call fcn.00438eee
add esp, 0xc
test al, al
je 0x429a0c
or dword [ebp + 0x5c], 0x40
jmp 0x4297a5
push 5
push dword [ebp + 0x7c]
push str.logs:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x429a8b
add dword [ebp + 0x7c], 0xa
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x54], eax
push edi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x54]
push eax
mov dword [ebp + 0x24], ebx
call fcn.00417571
add esp, 0xc
cmp dword [ebp + 0x24], ebx
mov dword [ebp + 0x7c], eax
jle 0x429a6f
push dword [ebp + 0x24]
lea ecx, [ebp + 0x2c]
push dword [ebp + 0x54]
call fcn.004419d9
mov ecx, dword [ebp + 0x64]
push edi
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x2c]
call fcn.0043eb92
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
lea ecx, [ebp + 0x7c]
call fcn.0040c032
jmp 0x4297a5
or word [ebp + 0x5c], 0x204
or byte [ebp + 0x15], 2
jmp 0x4297a5
mov eax, dword [ebp + 0x7c]
sub eax, 4
jmp 0x429a95
dec eax
dec eax
mov dword [ebp + 0x7c], eax
cmp word [eax], 0x2a
mov dword [ebp + 0x3c], eax
jne 0x429aa6
inc eax
inc eax
mov dword [ebp + 0x7c], eax
cmp word [eax], 0x22
jne 0x429ad7
cmp word [eax + 2], 0x2e
jne 0x429ad7
cmp word [eax + 4], 0x22
jne 0x429ad7
lea ecx, [eax + 6]
cmp word [ecx], 0x23
jne 0x429ad7
mov eax, dword [0x4afe10]
mov dword [ebp + 0x38], eax
mov eax, ecx
sub eax, dword [ebp + 0x3c]
sar eax, 1
mov byte [ebp + 0x5b], al
jmp 0x429ada
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x34]
cmp eax, ebx
mov dword [ebp + 0x7c], ecx
je 0x429afd
cmp byte [ebp + 0x63], bl
jne 0x429afd
cmp byte [0x4afeba], bl
jne 0x429afd
mov byte [0x4afeba], 3
mov dword [0x4afebc], eax
cmp word [ecx], 0x22
push 5
push ecx
mov esi, str.map:
push esi
sete byte [ebp + 0x62]
mov dword [ebp + 0x68], ebx
call fcn.00432c59
add esp, 0xc
test al, al
jne 0x429b31
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
jne 0x429b31
add dword [ebp + 0x7c], 2
mov dword [ebp + 0x68], 1
mov edi, dword [ebp + 0x7c]
push 0x21
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x6c], ebx
call fcn.00417571
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp + 0x7c]
mov cx, word [eax]
add esp, 0xc
cmp cx, 0x22
mov edx, eax
jne 0x429b60
lea edx, [eax + 2]
cmp word [edx], 0x5c
jne 0x429b71
cmp word [edx + 2], 0x5c
mov byte [ebp + 0x63], 1
jne 0x429b74
mov byte [ebp + 0x63], bl
cmp cx, 0x2a
jne 0x429b86
inc eax
inc eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x68], 1
lea ecx, [ebp + 0x18]
call fcn.0043717e
mov eax, dword [ebp + 0x2c]
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x70]
call fcn.004419d9
mov eax, dword [ebp + 0x70]
mov cx, word [eax]
cmp cx, 0x22
jne 0x429bd2
push 0x22
pop ecx
cmp cx, 0x22
je 0x429bbe
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x429bae
cmp word [eax], bx
je 0x429bd7
inc eax
inc eax
jmp 0x429bd7
cmp cx, 0x2c
je 0x429bd7
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x429bc7
cmp word [eax], 0x2c
jne 0x429bec
mov word [eax], bx
movzx eax, word [eax + 2]
and eax, 0xffdf
mov dword [ebp + 0x34], eax
mov ecx, dword [ebp + 0x64]
push 1
push ebx
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x70]
call fcn.0043fdd2
mov edi, dword [ebp + 0x18]
cmp word [edi], 0x22
je 0x429c6c
lea eax, [ebp + 0x54]
push eax
mov dword [ebp + 0x54], edi
call fcn.004047e3
mov eax, dword [ebp + 0x54]
cmp word [eax], bx
pop ecx
je 0x429c6c
push edi
lea ecx, [ebp + 0x70]
call fcn.00441a24
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi + 3]
push eax
lea ecx, [ebp + 0x18]
call fcn.004371c5
mov eax, dword [ebp + 0x18]
mov word [eax + edi*2 + 4], bx
mov eax, dword [ebp + 0x18]
push edi
push dword [ebp + 0x70]
add eax, 2
push eax
call fcn.004047cb
mov eax, dword [ebp + 0x18]
mov word [eax + edi*2 + 2], 0x22
mov eax, dword [ebp + 0x18]
mov word [eax], 0x22
mov edi, dword [ebp + 0x18]
add esp, 0xc
push 0x20
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], edi
call fcn.00417571
mov ecx, dword [ebp + 0x64]
add esp, 0xc
push 1
push ebx
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x2c]
call fcn.0043fdd2
push dword [ebp + 0x70]
lea ecx, [ebp + 0x18]
call fcn.004371ec
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x7c], eax
call fcn.00431c4c
mov edi, dword [ebp + 0x7c]
push 5
push edi
push esi
call fcn.00432c59
add esp, 0xc
test al, al
je 0x429cc8
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x7c], edi
mov edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x6c]
add eax, eax
lea esi, [eax + edi]
mov cx, word [esi]
mov word [ebp + 0x10], cx
mov ecx, dword [ebp + 0x28]
cmp ecx, ebx
mov word [esi], bx
mov dword [ebp + 0x20], edi
mov dword [ebp - 0x1c], ebx
je 0x429d67
mov edx, dword [ebp + 0x7c]
mov word [eax + edx], bx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x7c]
add ecx, 0xa
push eax
mov dword [ebp + 0x7c], ecx
mov dword [ebp - 0x18], ebx
call fcn.00439fac
mov eax, dword [ebp - 0x18]
cmp eax, ebx
pop ecx
pop ecx
jg 0x429d1a
mov esi, 0x80070057
jmp 0x42a7e8
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
push ebx
push ebx
push 6
push eax
mov dword [ebp + 0x50], eax
call edi
cmp eax, ebx
jne 0x429d37
xor esi, esi
inc esi
jmp 0x42a7e8
mov ecx, dword [eax]
push eax
mov dword [ebp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
jle 0x429d2f
add eax, 4
push eax
push ebx
push ebx
push 6
push dword [ebp + 0x50]
call edi
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x429d2f
mov edi, dword [ebp + 0x20]
add eax, 4
mov dword [ebp + 4], eax
lea ecx, [ebp - 0xc]
call fcn.0043717e
cmp word [edi], 0x2a
mov eax, edi
jne 0x429d7a
lea eax, [edi + 2]
push 0x2a
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x429e44
cmp word [edi + 2], 0x2a
jne 0x429d96
xor edi, edi
cmp edi, ebx
je 0x429e44
mov ecx, dword [ebp + 0x20]
mov eax, edi
sub eax, ecx
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x22
mov dword [ebp + 0x6c], eax
jne 0x429db6
dec eax
mov dword [ebp + 0x6c], eax
inc edi
inc edi
cmp word [edi], bx
mov dword [ebp + 0x70], edi
je 0x429de2
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.00431c5f
test al, al
jne 0x429ddd
cmp cx, 0x22
je 0x429ddd
inc edi
inc edi
cmp word [edi], bx
jne 0x429dc0
cmp edi, dword [ebp + 0x70]
jne 0x429dea
xor esi, esi
inc esi
jmp 0x42a7e0
cmp byte [ebp + 0x62], bl
je 0x429ec0
cmp word [edi], 0x22
jne 0x429ec0
mov byte [ebp + 0x62], 1
mov word [edi], 0x20
push dword [ebp + 0x70]
lea ecx, [ebp - 0xc]
call fcn.00441a80
sub dword [ebp + 0x70], 2
cmp byte [ebp + 0x62], bl
je 0x429e26
mov eax, dword [ebp + 0x70]
add dword [ebp + 0x70], 2
mov word [eax], 0x22
cmp dword [ebp + 0x70], edi
jae 0x429e44
mov ecx, edi
mov edi, dword [ebp + 0x70]
sub ecx, edi
dec ecx
shr ecx, 1
inc ecx
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
cmp byte [ebp + 0x5b], bl
mov ax, word [ebp + 0x10]
mov word [esi], ax
mov eax, dword [ebp + 0x3c]
jne 0x429e56
mov eax, dword [ebp + 0x20]
movsx edi, byte [ebp + 0x5b]
mov ecx, dword [ebp + 0x6c]
lea esi, [edi + ecx]
lea ecx, [esi + 1]
push ecx
add eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x10]
call fcn.004419d9
mov eax, dword [ebp - 0x10]
mov word [eax + esi*2 + 2], bx
mov eax, dword [ebp - 0x10]
lea esi, [eax + edi*2 + 2]
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x7c], esi
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x10], esi
call fcn.004419bc
cmp word [esi], 0x22
mov dword [ebp + 0x20], ebx
jne 0x429ee0
lea eax, [esi + 2]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x10], eax
push 0x22
lea eax, [ebp + 0x54]
call fcn.00410b80
mov eax, dword [ebp + 0x54]
pop ecx
mov cx, word [eax]
cmp cx, 0x22
jne 0x429ec8
or dword [ebp + 0x68], 0x10
jmp 0x429ecd
mov byte [ebp + 0x62], bl
jmp 0x429e06
cmp cx, bx
je 0x429ed2
mov word [eax], bx
inc eax
inc eax
cmp dword [ebp + 0x68], ebx
je 0x429f5e
mov dword [ebp + 0x70], eax
jmp 0x429f5e
cmp dword [ebp + 0x68], ebx
je 0x429f5e
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
jne 0x429ef7
mov eax, esi
push 0x23
push ebx
push eax
call edi
cmp eax, ebx
mov dword [ebp + 0x70], eax
je 0x429f6b
cmp word [eax], 0x23
mov ecx, eax
jne 0x429f14
inc ecx
inc ecx
cmp word [ecx], 0x23
je 0x429f0c
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00410c71
add esp, 4
cmp al, bl
jne 0x429f2f
mov dword [ebp + 0x70], 0x497994
jmp 0x429f43
inc ecx
xor eax, eax
inc ecx
mov ax, word [ecx]
push eax
call fcn.00410c71
add esp, 4
test al, al
jne 0x429f2f
mov cx, word [ecx]
cmp cx, bx
je 0x429f5e
cmp cx, 0x7c
je 0x429f5e
cmp cx, 0x3a
je 0x429f5e
mov dword [ebp + 0x70], 0x497994
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x429f6b
cmp word [eax], 0x23
je 0x429f73
mov eax, 0x497994
mov dword [ebp + 0x70], eax
cmp word [eax], bx
je 0x429f9f
add eax, 2
cmp word [eax], 0x23
jne 0x429f9f
inc dword [ebp + 0x20]
mov dword [ebp + 0x70], eax
add eax, 2
cmp word [eax], 0x23
je 0x429f81
cmp dword [ebp + 0x20], ebx
jle 0x429f9f
lea eax, [ebp + 0x24]
push eax
call fcn.00404807
pop ecx
cmp byte [ebp + 0x4e], bl
je 0x42a147
push dword [ebp + 0x7c]
call fcn.00410a81
pop ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x7c], eax
call fcn.00437055
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x38], esi
call fcn.004047e3
mov eax, dword [ebp + 0x38]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x6c]
call fcn.004419d9
mov eax, dword [ebp + 0x6c]
cmp word [eax], 0x26
je 0x42a016
mov ecx, dword [ebp + 0x64]
cmp byte [ecx + 9], bl
jne 0x42a016
lea ecx, [ebp + 0x40]
push ecx
push eax
call fcn.004408b8
pop ecx
pop ecx
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x44], eax
jmp 0x42a098
mov esi, 0x4b069c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x64]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x6c]
call fcn.0040d05d
cmp eax, ebx
mov dword [ebp + 0x50], eax
jne 0x42a056
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x6c]
call fcn.00431c4c
lea ecx, [ebp + 0x40]
call fcn.00431c4c
xor esi, esi
inc esi
jmp 0x42a7d0
mov edi, dword [eax + 0xc]
and edi, 0x3fffffff
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x44], edi
call fcn.00437099
mov eax, dword [ebp + 0x50]
push edi
push dword [eax + 4]
push dword [ebp + 0x40]
call fcn.00410b58
mov eax, dword [ebp + 0x40]
push 0x10
add edi, eax
push ebx
push edi
call fcn.004832e0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x4ae280], bl
jge 0x42a0a7
mov byte [0x4ae280], 1
lea eax, [ebp + 0x40]
push 1
push eax
call fcn.0047a39a
call fcn.0040f23b
push ebx
push ebx
push dword [ebp + 0x40]
mov esi, eax
call fcn.0040f296
push ebx
push dword [ebp + 0x64]
lea eax, [ebp + 0x40]
push eax
call fcn.0042939c
push ebx
push dword [ebp + 0x40]
movzx edi, si
call fcn.0040f222
inc eax
inc eax
push eax
push edi
push dword [ebp + 0x40]
call fcn.0040f296
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x40]
push dword [ebp + 0xc]
push eax
push edi
call fcn.004176e5
mov esi, dword [ebp + 0x40]
add esp, 0x48
push 0xffffffffffffffff
push str.mem
lea ecx, [ebp + 0x50]
mov dword [ebp + 0x40], ebx
call fcn.004419f2
mov eax, dword [eax]
mov ecx, dword [ebp + 0x64]
push ebx
shl edi, 0x10
or edi, dword [ebp + 0x5c]
push ebx
or edi, 0x40
push edi
push eax
push dword [ebp + 0x24]
push esi
call fcn.004742af
lea ecx, [ebp + 0x50]
mov dword [ebp + 8], eax
call fcn.00431c4c
lea ecx, [ebp + 0x6c]
call fcn.00431c4c
lea ecx, [ebp + 0x40]
jmp 0x42a765
mov edi, dword [ebp + 0x1c]
cmp edi, ebx
jle 0x42a268
lea ecx, [ebp + 0x40]
call fcn.00437055
lea eax, [edi + 0x14]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
call fcn.00437099
push edi
push dword [ebp + 4]
mov dword [ebp + 0x48], edi
push dword [ebp + 0x40]
mov dword [ebp + 0x44], edi
call fcn.00410b58
mov eax, dword [ebp + 0x40]
push 0x14
add eax, edi
push ebx
push eax
call fcn.004832e0
add esp, 0x18
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp + 0x40]
push 1
push eax
call fcn.0047a39a
call fcn.0040f23b
mov dword [ebp + 0x50], eax
xor eax, eax
mov ah, byte [ebp + 0x7c]
push ebx
mov al, ah
mov edi, eax
movzx eax, di
push eax
push dword [ebp + 0x40]
mov dword [ebp + 0x38], eax
call fcn.0040f296
push dword [ebp + 0x38]
lea eax, [ebp + 0x40]
push dword [ebp + 0x64]
push eax
call fcn.0042939c
push edi
push dword [ebp + 0x40]
call fcn.0040f222
mov edx, dword [ebp + 0x40]
mov ecx, edi
xor ecx, 0xd
mov word [edx + eax*2], cx
mov edx, dword [ebp + 0x40]
inc eax
mov ecx, edi
xor ecx, 0xa
mov word [edx + eax*2], cx
mov ecx, dword [ebp + 0x40]
mov word [ecx + eax*2 + 4], di
mov ecx, dword [ebp + 0x40]
inc eax
add eax, 2
mov word [ecx + eax*2], di
movzx edi, word [ebp + 0x50]
push eax
mov eax, edi
xor eax, dword [ebp + 0x38]
push eax
push dword [ebp + 0x40]
call fcn.0040f296
add esp, 0x34
cmp byte [0x4ae280], bl
jge 0x42a22d
mov byte [0x4ae280], 1
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x40]
push dword [ebp + 0xc]
push eax
push edi
call fcn.004176e5
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x64]
add esp, 0x14
push ebx
shl edi, 0x10
or edi, dword [ebp + 0x5c]
push ebx
or edi, 0x40
push edi
push esi
push dword [ebp + 0x24]
mov dword [ebp + 0x40], ebx
push eax
call fcn.004742af
mov dword [ebp + 8], eax
jmp 0x42a13f
cmp byte [ebp + 0x63], bl
je 0x42a382
mov esi, dword [ebp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push dword [ebp + 0x7c]
mov dword [ebp + 0x50], eax
call edi
mov ecx, dword [ebp + 0x50]
lea eax, [eax + ecx + 0x92a]
push eax
lea ecx, [ebp + 0x38]
call fcn.0043719c
mov edi, dword [ebp + 0x38]
mov dword [ebp + 0x1c], edi
add edi, 0xbca
push edi
push 0x324
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ax, word [esi]
lea ecx, [edi + 0x64a]
mov word [ecx], ax
xor eax, eax
cmp word [esi], 0x22
mov dword [ebp + 0x2c], ecx
sete al
add eax, eax
lea edx, [eax + esi + 2]
add eax, ecx
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
mov dword [ebp + 0x10], edx
jne 0x42a2e3
add dword [ebp + 0x7c], 2
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x5c
jne 0x42a2f0
add dword [ebp + 0x7c], 2
mov ecx, 0x5dc
sub ecx, dword [ebp + 0x6c]
xor eax, eax
cmp word [edi], bx
mov dword [ebp + 0x50], ecx
je 0x42a375
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov cx, word [edi]
cmp cx, word [ebp + 0x34]
jb 0x42a365
cmp eax, dword [ebp + 0x50]
jge 0x42a365
push dword [ebp + 0x7c]
push edi
push str._s_s
push dword [ebp + 0x1c]
call esi
push dword [ebp + 0x1c]
call fcn.00482cde
add esp, 0x14
test eax, eax
je 0x42a365
push dword [ebp + 0x10]
push edi
push str._s_s
push dword [ebp + 0x54]
call esi
mov eax, dword [ebp + 0x5c]
or eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x64]
add esp, 0x10
push dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x1c]
call fcn.00429482
cmp byte [ebp + 0x4f], bl
mov dword [ebp + 8], eax
je 0x42a375
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x42a308
lea ecx, [ebp + 0x38]
call fcn.00431c4c
jmp 0x42a796
mov ecx, dword [ebp + 0x70]
mov ax, word [ecx]
cmp ax, bx
je 0x42a76c
cmp ax, 0x23
mov edi, str.SCRIPT
mov dword [ebp + 0x6c], ecx
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x34], ecx
jne 0x42a3bf
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.00410c71
add esp, 4
test al, al
jne 0x42a3bf
mov ecx, edx
mov dword [ebp + 0x70], ecx
mov esi, ecx
movzx ecx, word [ecx]
xor edx, edx
cmp cx, bx
mov dword [ebp + 0x68], edx
je 0x42a41d
mov eax, ecx
cmp ax, 0x3a
je 0x42a413
cmp ax, 0x7c
je 0x42a3e8
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x42a3d0
jmp 0x42a41d
lea eax, [esi + 2]
cmp word [eax], bx
je 0x42a41d
mov dword [ebp + 0x54], eax
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.00439fac
mov eax, dword [ebp + 0x54]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x42a41a
cmp ax, 0x7c
je 0x42a41a
mov edx, esi
mov dword [ebp + 0x68], edx
jmp 0x42a41d
mov edx, dword [ebp + 0x68]
cmp edx, ebx
mov dword [ebp + 4], edx
mov dword [ebp + 0x20], ebx
je 0x42a45b
mov ax, word [edx]
mov word [ebp + 0x20], ax
mov word [edx], bx
mov eax, dword [ebp + 0x68]
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x7c
mov dword [ebp + 0x34], eax
je 0x42a447
mov edi, eax
mov dword [ebp + 0x1c], edi
mov ax, word [edi]
cmp ax, 0x22
je 0x42a456
cmp ax, 0x27
jne 0x42a45b
inc edi
inc edi
mov dword [ebp + 0x1c], edi
push 0x7c
push dword [ebp + 0x34]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x68], eax
jne 0x42a476
mov dword [ebp + 0x68], 0x497994
jmp 0x42a487
mov cx, word [eax]
mov word [eax], bx
add dword [ebp + 0x68], 2
mov dword [ebp + 4], eax
mov word [ebp + 0x20], cx
cmp word [edi], bx
mov eax, edi
je 0x42a4a9
mov cx, word [eax]
cmp cx, 0x22
je 0x42a4a6
cmp cx, 0x27
je 0x42a4a6
inc eax
inc eax
cmp word [eax], bx
jne 0x42a48e
jmp 0x42a4a9
mov word [eax], bx
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x3c], 0x7fffffff
cmp word [eax], bx
je 0x42a4cd
push 0x7c
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00439d51
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2c
jne 0x42a4e5
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00439fac
pop ecx
pop ecx
cmp dword [ebp + 0x3c], ebx
jle 0x42a5c4
cmp dword [ebp + 0x2c], ebx
jl 0x42a5c4
mov eax, dword [ebp + 0x6c]
mov di, word [eax]
mov esi, dword [ebp + 0x38]
mov word [eax], bx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
mov dword [ebp + 0x34], ebx
je 0x42a525
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x34], esi
je 0x42a04e
mov eax, dword [ebp + 0x6c]
mov word [eax], di
call fcn.0040f23b
xor ecx, ecx
mov ch, al
mov dword [ebp + 0x48], eax
mov cl, al
movzx edi, cx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], edi
shl edi, 0x10
lea ecx, [ebp - 8]
mov dword [ebp + 0x6c], edi
call fcn.00437055
push dword [ebp + 0x70]
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
call fcn.004419bc
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push esi
call fcn.00411356
add esp, 0x14
lea ecx, [ebp + 0x10]
call fcn.00431c4c
or dword [ebp + 0x6c], edi
cmp dword [ebp + 4], ebx
je 0x42a592
mov ax, word [ebp + 0x20]
mov ecx, dword [ebp + 4]
mov word [ecx], ax
cmp dword [ebp + 0x34], ebx
je 0x42a5a0
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x2c]
sub ecx, edx
jns 0x42a5ac
xor ecx, ecx
mov eax, dword [ebp + 0x3c]
cmp eax, ecx
jle 0x42a5b8
mov eax, ecx
mov dword [ebp + 0x3c], eax
cmp eax, ebx
jg 0x42a5ce
lea ecx, [ebp - 8]
call fcn.00431c4c
mov esi, 0x80070057
jmp 0x42a7d0
cmp edx, ebx
mov esi, dword [ebp - 8]
je 0x42a5e6
push eax
lea eax, [esi + edx]
push eax
push esi
call fcn.00410b0e
mov eax, dword [ebp + 0x3c]
add esp, 0xc
movzx ecx, byte [ebp + 0x54]
push 0xc
push ecx
add esi, eax
push esi
mov dword [ebp], eax
mov dword [ebp - 4], eax
call fcn.004832e0
mov eax, dword [ebp + 0x6c]
or eax, 1
push eax
lea eax, [ebp - 8]
push eax
call fcn.0047a39a
add esp, 0x14
push ebx
push dword [ebp + 0x64]
lea ecx, [ebp - 0xd4]
call fcn.00429378
mov ax, word [ebp + 0x54]
push dword [ebp + 0x50]
lea ecx, [ebp - 0xd4]
mov word [ebp - 0xa8], ax
call fcn.00436055
push dword [ebp + 0x6c]
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042939c
or dword [ebp + 0x6c], eax
mov eax, dword [ebp - 4]
movzx esi, word [ebp + 0x48]
shr eax, 1
inc eax
inc eax
push eax
mov eax, esi
xor eax, dword [ebp + 0x50]
push eax
push dword [ebp - 8]
call fcn.0040f296
movzx eax, word [ebp + 0x6c]
mov edi, esi
shl edi, 0x10
add esp, 0x18
or edi, eax
cmp byte [0x4ae280], bl
jge 0x42a683
mov byte [0x4ae280], 1
mov eax, dword [ebp - 8]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x42a6a5
push dword [ebp + 0x24]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.0042256c
add esp, 0x10
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
je 0x42a6ca
mov ecx, dword [ebp + 0x6c]
sub ecx, dword [ebp - 8]
sar ecx, 1
push ecx
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.004176e5
add esp, 0x14
mov dword [ebp + 0x6c], eax
push ebx
lea ecx, [ebp - 0xd4]
call fcn.00429312
lea ecx, [ebp - 0x94]
call fcn.00431c4c
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x28], ebx
je 0x42a733
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x109
push eax
lea ecx, [ebp + 0x28]
call fcn.004371c5
mov eax, dword [ebp + 0x28]
mov word [eax], 0x2a
mov eax, dword [ebp + 0x28]
push 0x104
add eax, 2
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 0x28]
push dword [ebp + 0x7c]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
mov dword [ebp - 8], ebx
je 0x42a75a
or edi, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x64]
push ebx
push dword [ebp + 0x6c]
or edi, 0x40
push edi
push dword [ebp - 0x14]
push dword [ebp + 0x24]
push eax
call fcn.004742af
mov dword [ebp + 8], eax
lea ecx, [ebp + 0x28]
call fcn.00431c4c
lea ecx, [ebp - 8]
call fcn.00431c4c
jmp 0x42a796
push dword [ebp + 0x7c]
call fcn.00410a81
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x64]
push dword [ebp - 0xc]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x5c]
or eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x7c]
call fcn.00429482
mov dword [ebp + 8], eax
cmp byte [0x4afeba], 3
jne 0x42a7a8
push dword [ebp + 0x64]
call fcn.0040f3dd
pop ecx
cmp byte [ebp + 0x33], 1
jne 0x42a7c4
or byte [0x4afeba], 1
push str.sysinit_end
push dword [ebp + 0x64]
call fcn.0040f3c3
pop ecx
pop ecx
mov ecx, dword [ebp + 0x64]
push ebx
call fcn.00449aab
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp - 0x10]
call fcn.00431c4c
lea ecx, [ebp - 0xc]
call fcn.00431c4c
lea ecx, [ebp - 0x1c]
call fcn.00431c4c
lea ecx, [ebp + 0x18]
call fcn.00431c4c
lea ecx, [ebp + 0xc]
call fcn.00431c4c
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4