Function at 0x42ff20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdf00
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2f0], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2f8], ecx
xor esi, esi
mov dword [ebp - 4], esi
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov dword [ebp - 0x2e8], esi
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], esi
mov dword [ebp - 0x1ac], 0x94
lea edx, [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42ffc3
mov eax, 0x25c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x19c]
cmp eax, 2
je 0x42ffde
cmp eax, 1
je 0x4301e2
mov eax, 0x25d
jmp 0x42ffa7
xor ebx, ebx
mov dword [ebp - 0x2ec], ebx
mov edi, 0x4000
mov dword [ebp - 0x2fc], edi
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2dc], eax
cmp eax, esi
je 0x430091
push str.NtQuerySystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2d8], eax
cmp eax, esi
je 0x43006d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x2ec], ebx
cmp ebx, esi
je 0x430063
lea eax, [ebp - 0x308]
push eax
push edi
push ebx
push 5
call dword [ebp - 0x2d8]
mov esi, eax
test esi, esi
je 0x430072
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0xc0000004
je 0x430061
mov esi, 0x260
jmp 0x430072
xor esi, esi
add edi, edi
mov dword [ebp - 0x2fc], edi
jmp 0x430020
mov esi, 0x25f
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x4300a4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x42ffa7
mov esi, 0x25e
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x42ffa7
mov dword [ebp - 0x2d8], ebx
mov edi, dword [ebp - 0x2f0]
cmp dword [ebx + 0x3c], 0
je 0x4301be
push 0
push 0
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0xffffffffffffffff
mov eax, dword [ebx + 0x3c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4301be
mov eax, 1
mov dword [ebp - 0x2e8], eax
mov edx, dword [ebx + 0x44]
mov ecx, dword [ebp - 0x2f8]
mov dword [ecx], edx
cmp dword [ebp + 0x10], eax
jne 0x4301c3
mov ecx, 0x513edc
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x430136
test dl, dl
je 0x430132
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x430136
add eax, 2
add ecx, 2
test dl, dl
jne 0x430116
xor eax, eax
jmp 0x43013b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x430146
call fcn.0042ff00
jmp 0x4301be
mov ecx, 0x513c28
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x430170
test dl, dl
je 0x43016c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x430170
add eax, 2
add ecx, 2
test dl, dl
jne 0x430150
xor eax, eax
jmp 0x430175
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x430180
call fcn.0042e7a0
jmp 0x4301be
mov edx, dword [ebx + 0x44]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4301be
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4301ad
mov dword [ebp - 0x2e4], 1
jmp 0x4301b7
mov dword [ebp - 0x2e0], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx], 0
jne 0x4301d5
mov eax, dword [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x430344
add ebx, dword [ebx]
mov dword [ebp - 0x2ec], ebx
jmp 0x4300b0
push 0x515f78
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2dc], eax
cmp eax, esi
je 0x43034d
push 0x515f4c
mov ebx, eax
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov edi, eax
push 0x515f3c
push ebx
call esi
mov ebx, eax
push 0x515f2c
mov ecx, dword [ebp - 0x2dc]
push ecx
call esi
mov dword [ebp - 0x2d8], eax
test edi, edi
je 0x430337
test eax, eax
je 0x430337
test ebx, ebx
je 0x430337
push 0
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x430337
mov dword [ebp - 0x2d4], 0x128
lea edx, [ebp - 0x2d4]
push edx
push edi
call ebx
mov ebx, dword [ebp - 0x2f0]
mov edi, edi
test eax, eax
je 0x430330
lea eax, [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x2b1]
mov esi, 1
mov dword [ebp - 0x2f4], eax
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4302a6
test cl, cl
je 0x4302a6
sub eax, esi
jmp 0x430291
add eax, esi
mov dword [ebp - 0x2f4], eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x43031d
mov dword [ebp - 0x2e8], esi
cmp dword [ebp + 0x10], esi
jne 0x430330
mov ecx, dword [ebp - 0x2cc]
push ecx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43031d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x43030c
mov dword [ebp - 0x2e4], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x2d4]
push edx
push edi
call dword [ebp - 0x2d8]
jmp 0x430270
mov dword [ebp - 0x2e0], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x2d4]
push edx
push edi
call dword [ebp - 0x2d8]
jmp 0x430270
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x2e8], 0
jne 0x430357
mov eax, 0x25b
jmp 0x42ffa7
mov eax, 1
cmp dword [ebp + 0x10], eax
jne 0x42ffa7
cmp dword [ebp - 0x2e4], 0
jne 0x430378
mov eax, 0x259
jmp 0x42ffa7
cmp dword [ebp - 0x2e0], eax
jne 0x42ffa7
mov eax, 0x25a
jmp 0x42ffa7