Function at 0x428650
Capabilities:
Check for time delay via gettickcount
Get disk information
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x148
push ebx
push esi
mov dword [ebp + 0x5c], ecx
xor ebx, ebx
push edi
lea ecx, [ebp + 0x7c]
mov dword [ebp + 4], ebx
call fcn.0040bc51
mov eax, dword [0x4ace04]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x34], eax
mov byte [ebp + 0x5b], bl
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x10], ebx
call fcn.00435d62
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x498f74
mov dword [ebp + 0x30], ebx
mov byte [ebp + 0x23], bl
call fcn.00437ad0
mov byte [ebp + 0x5a], al
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], 0x2d
mov byte [ebp + 0x4f], bl
mov byte [ebp + 0x4e], bl
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x50], ebx
mov byte [ebp + 0x73], 0x2a
jne 0x4286c3
mov byte [ebp + 0x73], 0x2d
push 8
lea eax, [ebp + 0x7c]
push eax
push str.sysinit
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4286f4
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2d
mov byte [ebp + 0x73], 0x2a
jne 0x428848
mov byte [ebp + 0x73], 0x2d
jmp 0x428848
mov eax, dword [ebp + 0x7c]
movsx edi, byte [ebp + 0x73]
movzx ecx, word [eax]
cmp edi, ecx
jne 0x4289a8
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x49761c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x428728
or dword [ebp + 0x50], 8
jmp 0x4286f4
push ebx
lea eax, [ebp + 0x7c]
push eax
push 0x4958ae
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x428744
or dword [ebp + 0x50], 4
jmp 0x4286f4
push 8
lea eax, [ebp + 0x7c]
push eax
push str.2sysinit
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x428831
push dword [ebp + 0x5c]
mov byte [0x4acfed], 1
call fcn.0040e9a4
push dword [ebp + 0x5c]
call fcn.0043287e
push eax
mov dword [ebp + 0x54], eax
call fcn.00432890
add esp, 0xc
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
add edi, 5
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x428825
cmp byte [0x4ab290], bl
jle 0x428825
cmp ecx, ebx
jbe 0x428816
cmp ecx, 0x7d0
jbe 0x4287bc
mov ecx, 0x3e8
jmp 0x4287c4
cmp ecx, 0x64
jbe 0x4287c4
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp + 0x44]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x428816
cmp esi, ebx
jg 0x4287ea
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x42881e
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42881e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, ebx
jle 0x428816
dec esi
cmp byte [0x4ab290], bl
jg 0x4287d8
xor esi, esi
jmp 0x42878f
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x428853
push 7
lea eax, [ebp + 0x7c]
push eax
push 0x498f54
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x42886e
mov dword [ebp + 0x30], 0x498f44
mov byte [ebp + 0x23], 1
mov ecx, dword [ebp + 0x5c]
push 0x498f40
push str.__UDM.sysinit
call fcn.00435749
or byte [ebp + 0x51], 1
jmp 0x4286f4
mov eax, dword [ebp + 0x7c]
movzx ecx, word [eax]
cmp edi, ecx
jne 0x4289a3
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x49572c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4288a1
or byte [ebp + 0x4f], 1
jmp 0x4286f4
push 1
lea eax, [ebp + 0x7c]
push eax
push 0x497f48
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4288c1
or byte [ebp + 0x4e], 1
jmp 0x4286f4
push 5
lea eax, [ebp + 0x7c]
push eax
push str.local
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4288e5
or dword [ebp + 0x50], 0x10
or dword [ebp + 0x14], 0x10
jmp 0x4286f4
push 8
lea eax, [ebp + 0x7c]
push eax
push str.EnviMode
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x428909
or dword [ebp + 0x50], 0x20
or dword [ebp + 0x14], 0x20
jmp 0x4286f4
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x497f90
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x428929
or dword [ebp + 0x50], 0x40
jmp 0x4286f4
push 5
push dword [ebp + 0x7c]
push str.logs:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x42899b
add dword [ebp + 0x7c], 0xa
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x60], eax
push 1
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x38], ebx
call fcn.00416853
add esp, 0xc
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x7c], eax
jle 0x42898e
push dword [ebp + 0x38]
lea ecx, [ebp + 0x3c]
push dword [ebp + 0x60]
call fcn.004403e0
mov ecx, dword [ebp + 0x5c]
push 1
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x3c]
call fcn.0043d5b3
lea ecx, [ebp + 0x3c]
call fcn.0043092f
lea ecx, [ebp + 0x7c]
call fcn.0040bc51
jmp 0x4286f4
mov eax, dword [ebp + 0x7c]
sub eax, 4
jmp 0x4289a5
dec eax
dec eax
mov dword [ebp + 0x7c], eax
cmp word [eax], 0x2a
mov dword [ebp + 0x38], eax
jne 0x4289b6
inc eax
inc eax
mov dword [ebp + 0x7c], eax
cmp word [eax], 0x22
jne 0x4289e9
cmp word [eax + 2], 0x2e
jne 0x4289e9
cmp word [eax + 4], 0x22
jne 0x4289e9
add eax, 6
cmp word [eax], 0x23
jne 0x4289e9
mov ecx, dword [0x4ace04]
mov dword [ebp + 0x7c], eax
sub eax, dword [ebp + 0x38]
mov dword [ebp + 0x34], ecx
sar eax, 1
mov byte [ebp + 0x5b], al
jmp 0x4289ef
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x7c], eax
cmp dword [ebp + 0x30], ebx
je 0x428a70
cmp byte [ebp + 0x5a], bl
jne 0x428a70
cmp byte [0x4acfed], bl
jne 0x428a70
or dword [ebp + 0x3c], 0xffffffff
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x24]
push eax
push str.SysStartuped.load
mov esi, str.SOFTWAREPELOGONRAMDATA
push esi
mov edi, 0x80000002
push edi
mov byte [0x4acfed], 1
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x54], 4
call fcn.0043174a
add esp, 0x18
test eax, eax
jne 0x428a47
cmp dword [ebp + 0x60], ebx
jne 0x428a70
push 4
lea eax, [ebp + 0x3c]
push eax
push 4
push str.SysStartuped.load
push esi
push edi
mov dword [ebp + 0x3c], 1
call fcn.00431794
push dword [ebp + 0x30]
push dword [ebp + 0x5c]
call fcn.0040ec17
add esp, 0x20
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
push 5
push eax
mov esi, str.map:
push esi
sete byte [ebp + 0x73]
mov dword [ebp + 0x64], ebx
call fcn.004318b1
add esp, 0xc
test al, al
jne 0x428aa7
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2a
jne 0x428aa7
add dword [ebp + 0x7c], 2
mov dword [ebp + 0x64], 1
mov edi, dword [ebp + 0x7c]
push 0x21
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 8], ebx
mov dword [ebp + 0x68], ebx
call fcn.00416853
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x7c]
mov cx, word [eax]
add esp, 0xc
cmp cx, 0x22
mov edx, eax
jne 0x428ad6
lea edx, [eax + 2]
cmp word [edx], 0x5c
jne 0x428ae7
cmp word [edx + 2], 0x5c
mov byte [ebp + 0x5a], 1
jne 0x428aea
mov byte [ebp + 0x5a], bl
cmp cx, 0x2a
jne 0x428afc
inc eax
inc eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x64], 1
lea ecx, [ebp + 0x28]
call fcn.00435d62
mov eax, dword [ebp + 0x3c]
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x6c]
call fcn.004403e0
mov eax, dword [ebp + 0x6c]
mov cx, word [eax]
cmp cx, 0x22
jne 0x428b48
push 0x22
pop ecx
cmp cx, 0x22
je 0x428b34
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x428b24
cmp word [eax], bx
je 0x428b4d
inc eax
inc eax
jmp 0x428b4d
cmp cx, 0x2c
je 0x428b4d
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x428b3d
cmp word [eax], 0x2c
jne 0x428b62
mov word [eax], bx
movzx eax, word [eax + 2]
and eax, 0xffdf
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0x5c]
push 1
push ebx
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x6c]
call fcn.0043e7f3
mov edi, dword [ebp + 0x28]
cmp word [edi], 0x22
je 0x428be2
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x60], edi
call fcn.00404579
mov eax, dword [ebp + 0x60]
cmp word [eax], bx
pop ecx
je 0x428be2
push edi
lea ecx, [ebp + 0x6c]
call fcn.0044042b
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, eax
lea eax, [edi + 3]
push eax
lea ecx, [ebp + 0x28]
call fcn.00435da9
mov eax, dword [ebp + 0x28]
mov word [eax + edi*2 + 4], bx
mov eax, dword [ebp + 0x28]
push edi
push dword [ebp + 0x6c]
add eax, 2
push eax
call fcn.00404561
mov eax, dword [ebp + 0x28]
mov word [eax + edi*2 + 2], 0x22
mov eax, dword [ebp + 0x28]
mov word [eax], 0x22
mov edi, dword [ebp + 0x28]
add esp, 0xc
push 0x20
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], edi
call fcn.00416853
mov ecx, dword [ebp + 0x5c]
add esp, 0xc
push 1
push ebx
lea eax, [ebp + 0x6c]
push eax
push dword [ebp + 0x3c]
call fcn.0043e7f3
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x28]
call fcn.00435dd0
mov eax, dword [ebp + 0x28]
lea ecx, [ebp + 0x6c]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x7c], eax
call fcn.0043092f
mov edi, dword [ebp + 0x7c]
push 5
push edi
push esi
call fcn.004318b1
add esp, 0xc
test al, al
je 0x428c3e
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x7c], edi
mov edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x68]
add eax, eax
lea esi, [eax + edi]
mov cx, word [esi]
mov word [ebp + 0x24], cx
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
mov word [esi], bx
mov dword [ebp + 0x2c], edi
mov dword [ebp - 0x1c], ebx
je 0x428cdd
mov edx, dword [ebp + 0x7c]
mov word [eax + edx], bx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x7c]
add ecx, 0xa
push eax
mov dword [ebp + 0x7c], ecx
mov dword [ebp - 0x18], ebx
call fcn.00438b8e
mov eax, dword [ebp - 0x18]
cmp eax, ebx
pop ecx
pop ecx
jg 0x428c90
mov esi, 0x80070057
jmp 0x42974c
mov edi, dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push ebx
push ebx
push ebx
push 6
push eax
mov dword [ebp + 0x54], eax
call edi
cmp eax, ebx
jne 0x428cad
xor esi, esi
inc esi
jmp 0x42974c
mov ecx, dword [eax]
push eax
mov dword [ebp + 0x1c], ecx
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
jle 0x428ca5
add eax, 4
push eax
push ebx
push ebx
push 6
push dword [ebp + 0x54]
call edi
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x428ca5
mov edi, dword [ebp + 0x2c]
add eax, 4
mov dword [ebp + 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.00435d62
cmp word [edi], 0x2a
mov eax, edi
jne 0x428cf0
lea eax, [edi + 2]
push 0x2a
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x428dba
cmp word [edi + 2], 0x2a
jne 0x428d0c
xor edi, edi
cmp edi, ebx
je 0x428dba
mov ecx, dword [ebp + 0x2c]
mov eax, edi
sub eax, ecx
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x22
mov dword [ebp + 0x68], eax
jne 0x428d2c
dec eax
mov dword [ebp + 0x68], eax
inc edi
inc edi
cmp word [edi], bx
mov dword [ebp + 0x6c], edi
je 0x428d58
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0040bc38
test al, al
jne 0x428d53
cmp cx, 0x22
je 0x428d53
inc edi
inc edi
cmp word [edi], bx
jne 0x428d36
cmp edi, dword [ebp + 0x6c]
jne 0x428d60
xor esi, esi
inc esi
jmp 0x429744
cmp byte [ebp + 0x73], bl
je 0x428e36
cmp word [edi], 0x22
jne 0x428e36
mov byte [ebp + 0x73], 1
mov word [edi], 0x20
push dword [ebp + 0x6c]
lea ecx, [ebp - 0xc]
call fcn.00440487
sub dword [ebp + 0x6c], 2
cmp byte [ebp + 0x73], bl
je 0x428d9c
mov eax, dword [ebp + 0x6c]
add dword [ebp + 0x6c], 2
mov word [eax], 0x22
cmp dword [ebp + 0x6c], edi
jae 0x428dba
mov ecx, edi
mov edi, dword [ebp + 0x6c]
sub ecx, edi
dec ecx
shr ecx, 1
inc ecx
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
cmp byte [ebp + 0x5b], bl
mov ax, word [ebp + 0x24]
mov word [esi], ax
mov eax, dword [ebp + 0x38]
jne 0x428dcc
mov eax, dword [ebp + 0x2c]
movsx edi, byte [ebp + 0x5b]
mov ecx, dword [ebp + 0x68]
lea esi, [edi + ecx]
lea ecx, [esi + 1]
push ecx
add eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x10]
call fcn.004403e0
mov eax, dword [ebp - 0x10]
mov word [eax + esi*2 + 2], bx
mov eax, dword [ebp - 0x10]
lea esi, [eax + edi*2 + 2]
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x7c], esi
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x24], esi
call fcn.004403c3
cmp word [esi], 0x22
mov dword [ebp + 0x2c], ebx
jne 0x428e56
lea eax, [esi + 2]
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x24], eax
push 0x22
lea eax, [ebp + 0x60]
call fcn.004754d0
mov eax, dword [ebp + 0x60]
pop ecx
mov cx, word [eax]
cmp cx, 0x22
jne 0x428e3e
or dword [ebp + 0x64], 0x10
jmp 0x428e43
mov byte [ebp + 0x73], bl
jmp 0x428d7c
cmp cx, bx
je 0x428e48
mov word [eax], bx
inc eax
inc eax
cmp dword [ebp + 0x64], ebx
je 0x428ed4
mov dword [ebp + 0x6c], eax
jmp 0x428ed4
cmp dword [ebp + 0x64], ebx
je 0x428ed4
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
jne 0x428e6d
mov eax, esi
push 0x23
push ebx
push eax
call edi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x428ee1
cmp word [eax], 0x23
mov ecx, eax
jne 0x428e8a
inc ecx
inc ecx
cmp word [ecx], 0x23
je 0x428e82
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.004103b8
add esp, 4
cmp al, bl
jne 0x428ea5
mov dword [ebp + 0x6c], 0x4949a4
jmp 0x428eb9
inc ecx
xor eax, eax
inc ecx
mov ax, word [ecx]
push eax
call fcn.004103b8
add esp, 4
test al, al
jne 0x428ea5
mov cx, word [ecx]
cmp cx, bx
je 0x428ed4
cmp cx, 0x7c
je 0x428ed4
cmp cx, 0x3a
je 0x428ed4
mov dword [ebp + 0x6c], 0x4949a4
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x428ee1
cmp word [eax], 0x23
je 0x428ee9
mov eax, 0x4949a4
mov dword [ebp + 0x6c], eax
cmp word [eax], bx
je 0x428f15
add eax, 2
cmp word [eax], 0x23
jne 0x428f15
inc dword [ebp + 0x2c]
mov dword [ebp + 0x6c], eax
add eax, 2
cmp word [eax], 0x23
je 0x428ef7
cmp dword [ebp + 0x2c], ebx
jle 0x428f15
lea eax, [ebp + 0x30]
push eax
call fcn.0040459d
pop ecx
cmp byte [ebp + 0x4f], bl
je 0x4290bd
push dword [ebp + 0x7c]
call fcn.00410209
pop ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x7c], eax
call fcn.00435c39
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x34], esi
call fcn.00404579
mov eax, dword [ebp + 0x34]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x68]
call fcn.004403e0
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x26
je 0x428f8c
mov ecx, dword [ebp + 0x5c]
cmp byte [ecx + 9], bl
jne 0x428f8c
lea ecx, [ebp + 0x40]
push ecx
push eax
call fcn.0043f2f4
pop ecx
pop ecx
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x44], eax
jmp 0x42900e
mov esi, 0x4ad684
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [ebp + 0x5c]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x68]
call fcn.0040cb92
cmp eax, ebx
mov dword [ebp + 0x54], eax
jne 0x428fcc
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp + 0x68]
call fcn.0043092f
lea ecx, [ebp + 0x40]
call fcn.0043092f
xor esi, esi
inc esi
jmp 0x429734
mov edi, dword [eax + 0xc]
and edi, 0x3fffffff
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x44], edi
call fcn.00435c7d
mov eax, dword [ebp + 0x54]
push edi
push dword [eax + 4]
push dword [ebp + 0x40]
call fcn.004102e0
mov eax, dword [ebp + 0x40]
push 0x10
add edi, eax
push ebx
push edi
call fcn.0047fd70
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp byte [0x4ab280], bl
jge 0x42901d
mov byte [0x4ab280], 1
lea eax, [ebp + 0x40]
push 1
push eax
call fcn.004774cc
call fcn.0040ea8d
push ebx
push ebx
push dword [ebp + 0x40]
mov esi, eax
call fcn.0040eae8
push ebx
push dword [ebp + 0x5c]
lea eax, [ebp + 0x40]
push eax
call fcn.0042837b
push ebx
push dword [ebp + 0x40]
movzx edi, si
call fcn.0040ea74
inc eax
inc eax
push eax
push edi
push dword [ebp + 0x40]
call fcn.0040eae8
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x40]
push dword [ebp + 0xc]
push eax
push edi
call fcn.004169c1
mov esi, dword [ebp + 0x40]
add esp, 0x48
push 0xffffffffffffffff
push str.mem
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x40], ebx
call fcn.004403f9
mov eax, dword [eax]
mov ecx, dword [ebp + 0x5c]
push ebx
shl edi, 0x10
or edi, dword [ebp + 0x50]
push ebx
or edi, 0x40
push edi
push eax
push dword [ebp + 0x30]
push esi
call fcn.00471542
lea ecx, [ebp + 0x54]
mov dword [ebp + 4], eax
call fcn.0043092f
lea ecx, [ebp + 0x68]
call fcn.0043092f
lea ecx, [ebp + 0x40]
jmp 0x4296db
mov edi, dword [ebp + 0x1c]
cmp edi, ebx
jle 0x4291de
lea ecx, [ebp + 0x40]
call fcn.00435c39
lea eax, [edi + 0x14]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
call fcn.00435c7d
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0x48], edi
push dword [ebp + 0x40]
mov dword [ebp + 0x44], edi
call fcn.004102e0
mov eax, dword [ebp + 0x40]
push 0x14
add eax, edi
push ebx
push eax
call fcn.0047fd70
add esp, 0x18
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
lea eax, [ebp + 0x40]
push 1
push eax
call fcn.004774cc
call fcn.0040ea8d
mov dword [ebp + 0x54], eax
xor eax, eax
mov ah, byte [ebp + 0x7c]
push ebx
mov al, ah
mov edi, eax
movzx eax, di
push eax
push dword [ebp + 0x40]
mov dword [ebp + 0x34], eax
call fcn.0040eae8
push dword [ebp + 0x34]
lea eax, [ebp + 0x40]
push dword [ebp + 0x5c]
push eax
call fcn.0042837b
push edi
push dword [ebp + 0x40]
call fcn.0040ea74
mov edx, dword [ebp + 0x40]
mov ecx, edi
xor ecx, 0xd
mov word [edx + eax*2], cx
mov edx, dword [ebp + 0x40]
inc eax
mov ecx, edi
xor ecx, 0xa
mov word [edx + eax*2], cx
mov ecx, dword [ebp + 0x40]
mov word [ecx + eax*2 + 4], di
mov ecx, dword [ebp + 0x40]
inc eax
add eax, 2
mov word [ecx + eax*2], di
movzx edi, word [ebp + 0x54]
push eax
mov eax, edi
xor eax, dword [ebp + 0x34]
push eax
push dword [ebp + 0x40]
call fcn.0040eae8
add esp, 0x34
cmp byte [0x4ab280], bl
jge 0x4291a3
mov byte [0x4ab280], 1
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x40]
push dword [ebp + 0xc]
push eax
push edi
call fcn.004169c1
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x5c]
add esp, 0x14
push ebx
shl edi, 0x10
or edi, dword [ebp + 0x50]
push ebx
or edi, 0x40
push edi
push esi
push dword [ebp + 0x30]
mov dword [ebp + 0x40], ebx
push eax
call fcn.00471542
mov dword [ebp + 4], eax
jmp 0x4290b5
cmp byte [ebp + 0x5a], bl
je 0x4292f8
mov esi, dword [ebp + 0x30]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push esi
call edi
push dword [ebp + 0x7c]
mov dword [ebp + 0x54], eax
call edi
mov ecx, dword [ebp + 0x54]
lea eax, [eax + ecx + 0x92a]
push eax
lea ecx, [ebp + 0x34]
call fcn.00435d80
mov edi, dword [ebp + 0x34]
mov dword [ebp + 0x1c], edi
add edi, 0xbca
push edi
push 0x324
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
mov ax, word [esi]
lea ecx, [edi + 0x64a]
mov word [ecx], ax
xor eax, eax
cmp word [esi], 0x22
mov dword [ebp + 0x3c], ecx
sete al
add eax, eax
lea edx, [eax + esi + 2]
add eax, ecx
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
mov dword [ebp + 0x24], edx
jne 0x429259
add dword [ebp + 0x7c], 2
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x5c
jne 0x429266
add dword [ebp + 0x7c], 2
mov ecx, 0x5dc
sub ecx, dword [ebp + 0x68]
xor eax, eax
cmp word [edi], bx
mov dword [ebp + 0x54], ecx
je 0x4292eb
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov cx, word [edi]
cmp cx, word [ebp + 8]
jb 0x4292db
cmp eax, dword [ebp + 0x54]
jge 0x4292db
push dword [ebp + 0x7c]
push edi
push str._s_s
push dword [ebp + 0x1c]
call esi
push dword [ebp + 0x1c]
call fcn.0047f7b4
add esp, 0x14
test eax, eax
je 0x4292db
push dword [ebp + 0x24]
push edi
push str._s_s
push dword [ebp + 0x60]
call esi
mov eax, dword [ebp + 0x50]
or eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x5c]
add esp, 0x10
push dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0x3c]
push dword [ebp + 0x1c]
call fcn.00428461
cmp byte [ebp + 0x4e], bl
mov dword [ebp + 4], eax
je 0x4292eb
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x42927e
lea ecx, [ebp + 0x34]
call fcn.0043092f
jmp 0x42970c
mov ecx, dword [ebp + 0x6c]
mov ax, word [ecx]
cmp ax, bx
je 0x4296e2
cmp ax, 0x23
mov edi, 0x498ed4
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x10], ecx
jne 0x429335
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.004103b8
add esp, 4
test al, al
jne 0x429335
mov ecx, edx
mov dword [ebp + 0x6c], ecx
mov esi, ecx
movzx ecx, word [ecx]
xor edx, edx
cmp cx, bx
mov dword [ebp + 0x64], edx
je 0x429393
mov eax, ecx
cmp ax, 0x3a
je 0x429389
cmp ax, 0x7c
je 0x42935e
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x429346
jmp 0x429393
lea eax, [esi + 2]
cmp word [eax], bx
je 0x429393
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00438b8e
mov eax, dword [ebp + 0x60]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x429390
cmp ax, 0x7c
je 0x429390
mov edx, esi
mov dword [ebp + 0x64], edx
jmp 0x429393
mov edx, dword [ebp + 0x64]
cmp edx, ebx
mov dword [ebp + 8], edx
mov dword [ebp + 0x2c], ebx
je 0x4293d1
mov ax, word [edx]
mov word [ebp + 0x2c], ax
mov word [edx], bx
mov eax, dword [ebp + 0x64]
inc eax
inc eax
mov dword [ebp + 0x64], eax
cmp word [eax], 0x7c
mov dword [ebp + 0x10], eax
je 0x4293bd
mov edi, eax
mov dword [ebp + 0x1c], edi
mov ax, word [edi]
cmp ax, 0x22
je 0x4293cc
cmp ax, 0x27
jne 0x4293d1
inc edi
inc edi
mov dword [ebp + 0x1c], edi
push 0x7c
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jne 0x4293ec
mov dword [ebp + 0x64], 0x4949a4
jmp 0x4293fd
mov cx, word [eax]
mov word [eax], bx
add dword [ebp + 0x64], 2
mov dword [ebp + 8], eax
mov word [ebp + 0x2c], cx
cmp word [edi], bx
mov eax, edi
je 0x42941f
mov cx, word [eax]
cmp cx, 0x22
je 0x42941c
cmp cx, 0x27
je 0x42941c
inc eax
inc eax
cmp word [eax], bx
jne 0x429404
jmp 0x42941f
mov word [eax], bx
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x18], 0x7fffffff
cmp word [eax], bx
je 0x429443
push 0x7c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.00438933
add esp, 0xc
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x2c
jne 0x42945b
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.00438b8e
pop ecx
pop ecx
cmp dword [ebp + 0x18], ebx
jle 0x42953a
cmp dword [ebp + 0x3c], ebx
jl 0x42953a
mov eax, dword [ebp + 0x68]
mov di, word [eax]
mov esi, dword [ebp + 0x34]
mov word [eax], bx
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
mov dword [ebp + 0x10], ebx
je 0x42949b
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x10], esi
je 0x428fc4
mov eax, dword [ebp + 0x68]
mov word [eax], di
call fcn.0040ea8d
xor ecx, ecx
mov ch, al
mov dword [ebp + 0x48], eax
mov cl, al
movzx edi, cx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x54], edi
shl edi, 0x10
lea ecx, [ebp - 8]
mov dword [ebp + 0x68], edi
call fcn.00435c39
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
call fcn.004403c3
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push esi
call fcn.00410a1a
add esp, 0x14
lea ecx, [ebp + 0x24]
call fcn.0043092f
or dword [ebp + 0x68], edi
cmp dword [ebp + 8], ebx
je 0x429508
mov ax, word [ebp + 0x2c]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
cmp dword [ebp + 0x10], ebx
je 0x429516
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x3c]
sub ecx, edx
jns 0x429522
xor ecx, ecx
mov eax, dword [ebp + 0x18]
cmp eax, ecx
jle 0x42952e
mov eax, ecx
mov dword [ebp + 0x18], eax
cmp eax, ebx
jg 0x429544
lea ecx, [ebp - 8]
call fcn.0043092f
mov esi, 0x80070057
jmp 0x429734
cmp edx, ebx
mov esi, dword [ebp - 8]
je 0x42955c
push eax
lea eax, [esi + edx]
push eax
push esi
call fcn.00410296
mov eax, dword [ebp + 0x18]
add esp, 0xc
movzx ecx, byte [ebp + 0x60]
push 0xc
push ecx
add esi, eax
push esi
mov dword [ebp], eax
mov dword [ebp - 4], eax
call fcn.0047fd70
mov eax, dword [ebp + 0x68]
or eax, 1
push eax
lea eax, [ebp - 8]
push eax
call fcn.004774cc
add esp, 0x14
push ebx
push dword [ebp + 0x5c]
lea ecx, [ebp - 0xd4]
call fcn.00428357
mov ax, word [ebp + 0x60]
push dword [ebp + 0x54]
lea ecx, [ebp - 0xd4]
mov word [ebp - 0xa8], ax
call fcn.00434c15
push dword [ebp + 0x68]
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042837b
or dword [ebp + 0x68], eax
mov eax, dword [ebp - 4]
movzx esi, word [ebp + 0x48]
shr eax, 1
inc eax
inc eax
push eax
mov eax, esi
xor eax, dword [ebp + 0x54]
push eax
push dword [ebp - 8]
call fcn.0040eae8
movzx eax, word [ebp + 0x68]
mov edi, esi
shl edi, 0x10
add esp, 0x18
or edi, eax
cmp byte [0x4ab280], bl
jge 0x4295f9
mov byte [0x4ab280], 1
mov eax, dword [ebp - 8]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x42961b
push dword [ebp + 0x30]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.00421650
add esp, 0x10
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
je 0x429640
mov ecx, dword [ebp + 0x68]
sub ecx, dword [ebp - 8]
sar ecx, 1
push ecx
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.004169c1
add esp, 0x14
mov dword [ebp + 0x68], eax
push ebx
lea ecx, [ebp - 0xd4]
call fcn.004282f1
lea ecx, [ebp - 0x94]
call fcn.0043092f
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x38], ebx
je 0x4296a9
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 0x109
push eax
lea ecx, [ebp + 0x38]
call fcn.00435da9
mov eax, dword [ebp + 0x38]
mov word [eax], 0x2a
mov eax, dword [ebp + 0x38]
push 0x104
add eax, 2
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov eax, dword [ebp + 0x38]
push dword [ebp + 0x7c]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
mov dword [ebp - 8], ebx
je 0x4296d0
or edi, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x5c]
push ebx
push dword [ebp + 0x68]
or edi, 0x40
push edi
push dword [ebp - 0x14]
push dword [ebp + 0x30]
push eax
call fcn.00471542
mov dword [ebp + 4], eax
lea ecx, [ebp + 0x38]
call fcn.0043092f
lea ecx, [ebp - 8]
call fcn.0043092f
jmp 0x42970c
push dword [ebp + 0x7c]
call fcn.00410209
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x5c]
push dword [ebp - 0xc]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x50]
or eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x7c]
call fcn.00428461
mov dword [ebp + 4], eax
cmp byte [ebp + 0x23], 1
jne 0x429728
push str.sysinit_end
push dword [ebp + 0x5c]
mov byte [0x4acfed], 1
call fcn.0040ec17
pop ecx
pop ecx
mov ecx, dword [ebp + 0x5c]
push ebx
call fcn.00447ee8
mov esi, dword [ebp + 4]
lea ecx, [ebp - 0x14]
call fcn.0043092f
lea ecx, [ebp - 0x10]
call fcn.0043092f
lea ecx, [ebp - 0xc]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x28]
call fcn.0043092f
lea ecx, [ebp + 0xc]
call fcn.0043092f
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4