Function at 0x42c40d
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c0
lea ebp, [esp - 0x74]
call fcn.004b4900
mov dword [ebp + 0x6c], ecx
lea ecx, [ebp + 0x7c]
call fcn.0040fb41
and dword [ebp + 0x60], 0
and dword [ebp + 0x48], 0
mov dword [ebp + 0x58], 1
mov dword [ebp + 0x28], 0xfffffff6
mov byte [ebp + 0x70], 0
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0x2a
jne 0x42c472
mov byte [ebp + 0x73], 0x2d
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
push ebx
push esi
push edi
push 0x40
pop edi
jne 0x42c6dc
mov esi, dword [ebp + 0x7c]
lea edx, [esi + 2]
xor ebx, ebx
mov bx, word [edx]
cmp bx, 0x41
jb 0x42c6b3
cmp bx, 0x2a
je 0x42c6b3
mov eax, ebx
call fcn.00414dee
test al, al
jne 0x42c6b3
cmp cl, 0x2d
jne 0x42c4cb
mov al, bl
or al, 0x20
cmp al, 0x63
jne 0x42c4cb
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x6d
je 0x42c6b3
cmp cl, 0x2a
jne 0x42c4df
mov eax, ebx
call fcn.0040fb57
test al, al
jne 0x42c6b3
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4cc2e8
mov dword [ebp + 0x7c], edx
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c502
mov byte [ebp + 0x71], 1
jmp 0x42c6a5
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c522
mov byte [ebp + 0x53], 1
jmp 0x42c6a5
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4c7ee0
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c542
mov byte [ebp + 0x68], 1
jmp 0x42c6a5
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c562
mov byte [ebp + 0x68], 0x41
jmp 0x42c6a5
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c582
mov byte [ebp + 0x68], 0x10
jmp 0x42c6a5
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c5a2
mov byte [ebp + 0x68], 0x50
jmp 0x42c6a5
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c5c5
mov dword [ebp + 0x60], 0x10000
jmp 0x42c6a5
push 5
push dword [ebp + 0x7c]
push str.scan:
call fcn.00441277
add esp, 0xc
test al, al
je 0x42c5e7
add dword [ebp + 0x7c], 0xa
lea eax, [ebp + 0x28]
jmp 0x42c68e
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c60a
mov dword [ebp + 0x28], 0x1000
jmp 0x42c6a5
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4cb3e8
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c626
mov dword [ebp + 0x48], edi
jmp 0x42c6a5
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c654
push 1
call fcn.00441c85
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x42cbd3
jmp 0x42c6a5
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42c671
mov byte [ebp + 0x72], 1
jmp 0x42c6a5
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.00441277
add esp, 0xc
test al, al
je 0x42c69b
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00453e89
pop ecx
jmp 0x42c6a4
lea eax, [ebp + 0x7c]
push eax
call fcn.00408f31
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
je 0x42c483
cmp byte [ebp + 0x72], 0
je 0x42c6dc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x4e2e7c]
setne cl
push ecx
push 0x4e34c8
call fcn.00413444
pop ecx
pop ecx
jmp 0x42d136
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x42c701
cmp byte [eax + 2], 0x2d
jne 0x42c701
mov ax, word [eax + 4]
call fcn.0040fb57
test al, al
je 0x42c701
lea eax, [ebp + 0x7c]
push eax
call fcn.00408f31
pop ecx
cmp byte [ebp + 0x68], 0
je 0x42c818
push 0x4e3d84
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x64]
call fcn.0041007e
mov esi, dword [ebp + 0x68]
and esi, edi
push esi
call fcn.00412947
test eax, eax
pop ecx
mov dword [ebp + 0x60], eax
jne 0x42c744
push esi
push dword [ebp + 0x6c]
call fcn.00419944
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
test eax, eax
mov dword [ebp + 0x58], 1
je 0x42c7f9
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.004465ac
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x42c790
push dword [ebp + 0x18]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.004410db
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.00441136
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.0043fe25
cmp dword [ebp + 0x64], 0
je 0x42c808
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4e3d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x42d133
xor esi, esi
cmp dword [ebp + 0x28], esi
jl 0x42c8fc
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x60], str.PressKey
call fcn.0044658e
mov eax, dword [ebp + 0x7c]
cmp word [eax], si
je 0x42c852
push 0x2c
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x48]
add esp, 0xc
mov dword [ebp + 0x60], eax
push 0x3f
xor eax, eax
mov byte [ebp - 0x148], 0
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 0x28]
mov edi, 0x100
cmp eax, edi
mov word [ebp - 0x414c], si
jae 0x42c8a9
movzx eax, byte [ebp + eax - 0x148]
push eax
lea eax, [ebp - 0x414c]
push 0x4cc240
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42c8d1
xor esi, esi
lea ebx, [ebp - 0x414c]
movzx eax, byte [ebp + esi - 0x148]
push eax
push 0x4cc240
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add ebx, 0xa
cmp esi, edi
jl 0x42c8b1
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x374e], 0
lea eax, [ebp - 0x414c]
push eax
push dword [ebp + 0x60]
call fcn.00445c44
lea ecx, [ebp + 0x48]
call fcn.0043fe25
and dword [ebp + 0x58], 0
jmp 0x42d0f9
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x4c], 0xfffffc18
jne 0x42c93e
lea ecx, [edx + 2]
mov ax, word [ecx]
or ax, 0x20
cmp ax, 0x63
je 0x42c93e
cmp ax, 0x64
je 0x42c93e
mov dword [ebp + 0x7c], ecx
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x70], 1
call fcn.0040fb41
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
jne 0x42c94d
mov bl, byte [edx]
inc edx
inc edx
mov dword [ebp + 0x7c], edx
jmp 0x42c94f
xor bl, bl
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.00414d24
add esp, 4
test al, al
je 0x42c9f3
mov eax, dword [ebp + 0x7c]
fld qword [0x4cc238]
mov dword [ebp + 0x5c], eax
fstp qword [ebp + 0x3c]
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x64], esi
call fcn.00453e89
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x42c99c
mov ax, word [ecx]
call fcn.004b1b03
test al, al
jne 0x42c9a1
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x5c]
jb 0x42c98b
cmp dword [ebp + 0x64], 0
jl 0x42c9e4
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x64]
mov dword [ebp + 0x68], edi
jne 0x42c9e4
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00449899
fld qword [ebp + 0x3c]
fcomp qword [0x4c9b78]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x42ca7c
fld qword [ebp + 0x3c]
fadd qword [0x4cc230]
jmp 0x42ca6a
lea eax, [ebp + 0x7c]
push eax
call fcn.00408f31
pop ecx
jmp 0x42ca7c
cmp cx, 0x28
jne 0x42ca7f
fld qword [0x4cc238]
lea eax, [ebp + 0x3c]
push eax
fstp qword [ebp + 0x3c]
lea eax, [ebp + 0x7c]
push eax
call fcn.00449a99
test eax, eax
pop ecx
pop ecx
jle 0x42ca7c
fld qword [ebp + 0x3c]
fcomp qword [0x4c9b78]
fnstsw ax
test ah, 1
jne 0x42ca7c
fld qword [ebp + 0x3c]
fadd qword [0x4cc230]
fld st(0)
call fcn.004b4b58
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.004b4b58
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], edx
fild qword [ebp + 0x3c]
fsubp st(1)
fcom qword [0x4cc228]
fnstsw ax
test ah, 0x41
jne 0x42ca7a
fcom qword [0x4cc220]
fnstsw ax
test ah, 5
jp 0x42ca7a
fmul qword [0x4cc218]
call fcn.004b4b58
mov dword [ebp + 0x4c], eax
jmp 0x42ca7c
fstp st(0)
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2a
je 0x42cc1a
cmp edi, esi
jne 0x42ca97
cmp dword [ebp + 0x4c], 0
jl 0x42cc1a
and word [ebp - 0x46], 0
and word [ebp - 0x48], 0
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x64], str.PressKey
call fcn.0044658e
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x42cadb
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0
je 0x42cadb
mov dword [ebp + 0x64], eax
test bl, bl
jne 0x42cbaf
cmp byte [ebp + 0x70], bl
jne 0x42caf9
test edi, edi
jne 0x42cbb1
cmp dword [ebp + 0x4c], edi
jg 0x42cbe0
test edi, edi
jne 0x42cb08
cmp byte [ebp + 0x70], 0
jne 0x42cb08
push 2
pop eax
jmp 0x42cb0b
xor eax, eax
inc eax
or eax, dword [ebp + 0x60]
push eax
push edi
call fcn.0041b3e0
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x42cb32
cmp ebx, 0x60
jl 0x42cb32
cmp ebx, 0x69
jg 0x42cb32
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4c6b48
jle 0x42cb51
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x48]
jmp 0x42cb56
mov eax, 0x4cc210
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.00445c44
test ebx, ebx
jle 0x42cb99
cmp ebx, 0x41
jl 0x42cb72
cmp ebx, 0x5a
jle 0x42cb7f
push ebx
call fcn.00414d24
add esp, 4
test al, al
je 0x42cb8e
and word [ebp - 0x46], 0
movsx ax, bl
mov word [ebp - 0x48], ax
jmp 0x42cb99
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x64]
call fcn.00445c44
mov esi, 0x80000000
jmp 0x42cc00
test edi, edi
jl 0x42cc00
test bl, bl
je 0x42cbda
and dword [ebp + 0x58], 0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x42cc00
lea ecx, [ebp + 0x5c]
call fcn.0043fe25
xor eax, eax
jmp 0x42d136
cmp dword [ebp + 0x4c], 0
jle 0x42cbe5
mov ecx, dword [ebp + 0x4c]
jmp 0x42cbe7
xor ecx, ecx
test edi, edi
jle 0x42cbef
mov eax, edi
jmp 0x42cbf1
xor eax, eax
push 0
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.0041195d
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x7c]
call fcn.0040fb41
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x70], 0
call fcn.0043fe25
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0
je 0x42d0f9
xor ebx, ebx
mov dword [ebp + 0x54], ebx
or esi, 0xffffffff
cmp word [edx], 0x2a
mov byte [ebp + 0x71], bl
mov byte [ebp + 0x73], bl
jne 0x42cc51
mov eax, dword [ebp + 0x18]
inc edx
xor esi, esi
inc edx
inc esi
mov dword [ebp + 0x54], eax
jmp 0x42cc48
inc esi
inc edx
inc edx
mov dword [ebp + 0x7c], edx
cmp word [edx], 0x2a
je 0x42cc45
cmp esi, ebx
jle 0x42ccc0
mov ax, word [edx]
cmp ax, 0x2d
jne 0x42cc68
inc edx
inc edx
mov dword [ebp + 0x7c], edx
mov dword [ebp + 0x54], ebx
jmp 0x42ccc0
cmp ax, 0x3d
jne 0x42cc74
mov byte [ebp + 0x71], 1
jmp 0x42cc7e
cmp ax, 0x24
jne 0x42cc86
mov byte [ebp + 0x73], 2
inc edx
inc edx
mov dword [ebp + 0x7c], edx
mov dword [ebp + 0x54], ebx
xor eax, eax
mov ax, word [edx]
push eax
call fcn.00414d24
add esp, 4
test al, al
je 0x42cca8
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00453e89
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x42ccc0
cmp byte [ebp + 0x73], 0
jne 0x42ccc0
push esi
push dword [ebp + 0x54]
call fcn.00413352
pop ecx
pop ecx
mov dword [ebp + 0x54], eax
or dword [ebp + 0x34], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040fb41
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x42cce1
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x42cce5
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.00414d24
add esp, 4
test al, al
je 0x42cd04
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00453e89
pop ecx
pop ecx
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x14], ebx
jne 0x42cd15
lea edi, [ebp + 0x14]
mov dword [ebp + 0x4c], edi
jmp 0x42cd1d
lea eax, [ebp + 0x54]
mov dword [ebp + 0x4c], eax
mov edi, eax
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x58], ebx
jne 0x42cd32
cmp dword [ebp + 0x54], ebx
jne 0x42cd3d
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x54], ebx
je 0x42cd69
cmp byte [ebp + 0x73], 0
jne 0x42cd69
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x54]
push ebx
push 0x100000
je 0x42cd54
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x42cd5a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x42cd69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.004465ac
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x30]
call fcn.0045063c
push 0x5c
push dword [ebp + 0x30]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040fb41
lea ecx, [ebp + 0x1c]
call fcn.0044684a
mov dword [ebp + 0x40], ebx
jmp 0x42cef5
cmp byte [0x4e12e4], 0
jle 0x42cf09
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42ce1c
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00453e89
cmp dword [ebp + 0x2c], ebx
pop ecx
pop ecx
jge 0x42cef5
mov dword [ebp + 0x2c], ebx
jmp 0x42cef5
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.004485c7
add esp, 0xc
test al, al
je 0x42ced4
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x38], eax
push 1
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x60], ebx
call fcn.0041a9b6
add esp, 0xc
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x7c], eax
call fcn.0044658e
lea ecx, [ebp + 0x64]
call fcn.0044658e
push dword [ebp + 0x60]
lea ecx, [ebp + 0x64]
push dword [ebp + 0x38]
call fcn.004466b2
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x64]
call fcn.00413993
pop ecx
pop ecx
lea ecx, [ebp + 0x64]
call fcn.0043fe25
cmp dword [ebp + 0x60], ebx
jle 0x42cec2
push 4
call fcn.004b4768
cmp eax, ebx
pop ecx
je 0x42cea6
mov ecx, dword [ebp + 0x5c]
mov dword [eax], ecx
mov dword [ebp + 0x5c], ebx
mov esi, eax
jmp 0x42cea8
xor esi, esi
push 4
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x24]
call fcn.0044680d
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x24]
lea ecx, [ebp + 0x7c]
call fcn.0040fb41
lea ecx, [ebp + 0x5c]
call fcn.0043fe25
jmp 0x42cef5
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x42cf03
lea eax, [ebp + 0x7c]
push eax
call fcn.00408f31
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x42cdd8
jmp 0x42cf09
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x70], 0
je 0x42cf12
neg dword [ebp + 0x68]
cmp dword [ebp + 0x48], ebx
jne 0x42cf24
cmp dword [edi], ebx
je 0x42cf24
push dword [ebp + 0x44]
call fcn.0041249e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], ebx
je 0x42cfb7
jmp 0x42cfae
cmp dword [ebp + 0x68], ebx
je 0x42cfb7
mov edi, 0x3e8
jle 0x42cf5a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x42cfb7
cmp ecx, edi
jge 0x42cf5a
mov edi, ecx
push 0x4ff
push edi
push ebx
push dword [ebp + 0x4c]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x42cfb7
push 0x64
pop edi
jmp 0x42cfa5
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42cfae
dec edi
je 0x42cfae
cmp dword [ebp - 4], 0x12
je 0x42cfae
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4e12e4], 0
jg 0x42cf75
cmp byte [0x4e12e4], 0
jg 0x42cf39
cmp dword [ebp + 0x34], ebx
jl 0x42cfda
cmp byte [ebp + 0x72], 0
je 0x42cfcd
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42cfda
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x34]
call fcn.0041195d
cmp dword [ebp + 0x24], ebx
jle 0x42d0a1
cmp byte [0x4e12e4], 0
jle 0x42d0a1
cmp dword [ebp + 0x48], ebx
jne 0x42cffe
push dword [ebp + 0x44]
call fcn.0041249e
pop ecx
cmp dword [ebp + 0x24], ebx
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x60], eax
jle 0x42d0a1
cmp byte [0x4e12e4], 0
jle 0x42d0a1
mov eax, dword [ebp + 0x24]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x64], eax
jle 0x42d0a1
cmp byte [0x4e12e4], 0
jle 0x42d085
mov eax, dword [ebp + 0x60]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x42d07d
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.0042a3d4
mov eax, dword [esi]
push dword [eax]
call fcn.004b3b87
test edx, edx
pop ecx
jg 0x42d077
jl 0x42d05e
test eax, eax
ja 0x42d077
mov ebx, dword [esi]
test ebx, ebx
je 0x42d072
mov ecx, ebx
call fcn.0043fe25
push ebx
call fcn.004b4664
pop ecx
and dword [esi], 0
jmp 0x42d07d
lea eax, [edi + 1]
mov dword [ebp + 0x38], eax
inc edi
xor ebx, ebx
cmp edi, dword [ebp + 0x64]
jl 0x42d029
mov esi, dword [ebp + 0x38]
cmp esi, ebx
jle 0x42d0a1
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x2c]
call fcn.0041195d
mov dword [ebp + 0x24], esi
jmp 0x42d00d
cmp dword [ebp + 0x48], ebx
jne 0x42d0b6
mov eax, dword [ebp + 0x4c]
cmp dword [eax], ebx
je 0x42d0b6
push dword [ebp + 0x30]
call fcn.0041249e
pop ecx
mov eax, dword [ebp + 0x40]
cmp eax, ebx
je 0x42d0d1
cmp word [eax], bx
je 0x42d0d1
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push ebx
push eax
call fcn.00434f28
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x1c]
call fcn.0045a9f0
lea ecx, [ebp + 0x1c]
call fcn.0043fe25
lea ecx, [ebp + 0x30]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
call fcn.0043fe25
lea ecx, [ebp + 0x14]
call fcn.00402d2b
cmp byte [ebp + 0x53], 0
je 0x42d129
call fcn.0041acbe
test eax, eax
je 0x42d121
push dword [ebp + 0x6c]
call fcn.00413079
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.0041acea
pop ecx
pop ecx
push 0
call fcn.004174f7
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.00470bd7
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4