Function at 0x4318b0
Capabilities:
Check os version
Create process on windows
Enumerate processes
Get common file path
Get memory capacity
Get process image filename
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x389c
call fcn.004340f0
mov eax, dword [0x45f144]
xor eax, esp
mov dword [esp + 0x3898], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x594]
push ebx
xorps xmm0, xmm0
mov dword [esp + 4], eax
push esi
push edi
movq qword [esp + 0x57c], xmm0
mov word [esp + 0x584], 0
movq qword [esp + 0x588], xmm0
mov word [esp + 0x590], 0
call fcn.00430f50
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x43192a
push 0
push 0x459844
lea eax, [esp + 0x5a8]
push eax
push 0
call esi
call fcn.004306b0
test eax, eax
je 0x431aa8
mov dword [0x46278c], 1
mov dword [esp + 0x450], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push ebx
push 0
push 0x1fffff
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4319ed
push 0x104
lea eax, [esp + 0x1f4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xba0]
push eax
lea eax, [esp + 0x9a4]
push eax
push 0
lea eax, [esp + 0x1fc]
push 0
push eax
call fcn.0043e312
add esp, 0x14
lea eax, [esp + 0x9a0]
push eax
lea eax, [esp + 0x1f4]
push 0x104
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0xba0]
push eax
lea eax, [esp + 0x1f4]
push 0x104
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x450]
xor esi, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x431a5a
lea eax, [esp + 0x450]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x431a5a
nop word [eax + eax]
lea eax, [esp + 0x1f0]
push eax
lea eax, [esp + 0x478]
push eax
call fcn.0043eb34
add esp, 8
test eax, eax
jne 0x431a46
cmp dword [esp + 0x458], ebx
je 0x431a46
inc esi
lea eax, [esp + 0x450]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x431a20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
je 0x431aa8
push 0x1004
push str.Map3D
push str.Another_instance_of_KeyCheck_is_already_running._nAre_you_sure_you_want_to_start_another_instance_
push 0
call esi
cmp eax, 7
jne 0x431aa8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
je 0x431aa8
push eax
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x431aa8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [esp + 0x10a4]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
lea eax, [esp + 0x24a8]
push eax
lea eax, [esp + 0x5ac]
push eax
lea eax, [esp + 0x10b0]
push eax
call fcn.0043e312
add esp, 0x14
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0xca4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x24a0]
push eax
lea eax, [esp + 0xca4]
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0xca0]
push eax
lea eax, [esp + 0x5a4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x5a0]
push str.DISPW.DLL
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x310]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, 0xffffffff
je 0x431b81
push eax
call edi
mov eax, dword [esp + 0x330]
jmp 0x431b85
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0xca0]
push eax
lea eax, [esp + 0x5a4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x5a0]
push str.dispw
push 0x400
push eax
call fcn.0043958a
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x5ac]
add esp, 0xc
push eax
call ebx
test eax, eax
jne 0x431c15
push eax
push eax
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x1010
push str.Map3D___LoadLibrary_dispw
push dword [esp + 0x18]
push 0
call esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x432878
lea eax, [esp + 0xca0]
push eax
lea eax, [esp + 0x5a4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x5a0]
push str.sx32w
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x5a0]
push eax
call ebx
test eax, eax
jne 0x431c89
push eax
push eax
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x1010
push str.Map3D___LoadLibrary_sx32w
jmp 0x431bfe
lea eax, [esp + 0xca0]
push eax
lea eax, [esp + 0x5a4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x5a0]
push str.EXCELCOMPROXY.DLL
push 0x400
push eax
call fcn.0043958a
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x31c]
add esp, 0xc
push eax
lea eax, [esp + 0x5a4]
push eax
call esi
cmp eax, 0xffffffff
je 0x431d29
push eax
call edi
mov eax, dword [esp + 0x330]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
push str._d__d__d
lea eax, [esp + 0x598]
push 0xa
push eax
call fcn.00431830
add esp, 0x18
jmp 0x431d31
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xca0]
push eax
lea eax, [esp + 0x5a4]
push 0x400
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x5a0]
push str.PDF3D.DLL
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x310]
push eax
lea eax, [esp + 0x5a4]
push eax
call esi
cmp eax, 0xffffffff
je 0x431dcb
push eax
call edi
mov eax, dword [esp + 0x330]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
push str._d__d__d
lea eax, [esp + 0x58c]
push 0xa
push eax
call fcn.00431830
add esp, 0x18
jmp 0x431dd3
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
call dword [sym.imp.dispw.dll_dispwdate]
mov edi, eax
mov eax, 0x68db8bad
imul edi
mov ecx, edi
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
imul eax, esi, 0x2710
mov dword [esp + 0x28], esi
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
imul eax, esi, 0x64
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add eax, ecx
mov dword [esp + 0x24], ecx
imul eax, eax, 0x64
sub edi, eax
lea eax, [esp + 0x594]
push edi
push ecx
push esi
push str._d__d__d
push 0xa
push eax
mov dword [esp + 0x38], edi
call fcn.00431830
lea eax, [esp + 0xcb8]
push eax
lea eax, [esp + 0x5bc]
push 0x400
push eax
call fcn.0043e37b
add esp, 0x24
lea eax, [esp + 0x5a0]
push 0x45994c
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043e37b
add esp, 0xc
push 0xfffffffffffffffb
call dword [sym.imp.dispw.dll_get_file]
add esp, 4
push eax
lea eax, [esp + 0x598]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x5ac]
push str.dispw:__d__s__d_n
push 0x400
push eax
call fcn.00431830
lea eax, [esp + 0x5b8]
push eax
lea eax, [esp + 0x14bc]
push 0x1000
push eax
call fcn.0043958a
add esp, 0x24
lea eax, [esp + 0x588]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x5a8]
push str.excel:__d__s_n
push 0x400
push eax
call fcn.00431830
add esp, 0x14
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x57c]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x5a8]
push str.pdf3d:__d__s_n
push 0x400
push eax
call fcn.00431830
add esp, 0x14
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
cmp dword [0x46278c], 0
je 0x431f6d
mov ecx, str.Checking_Map3D_licence
call fcn.00432940
lea eax, [esp + 0x28a0]
push 0x1000
push eax
call dword [sym.imp.dispw.dll_license_chk]
lea ecx, [esp + 0xaa8]
push 0x100
push ecx
call dword [sym.imp.dispw.dll_ngetguid]
mov edi, eax
call dword [sym.imp.dispw.dll_isonline]
mov esi, eax
mov eax, 0x68db8bad
imul esi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx ecx, cx
imul eax, ecx, 0x2710
mov word [0x45fbec], cx
sub esi, eax
lea eax, [esp + 0xab0]
push eax
movzx eax, si
push eax
push ecx
push edi
push str.cpuid:__d__04d_04d_n_s_n
lea eax, [esp + 0x5c4]
mov word [0x45fbc0], si
push 0x400
push eax
call fcn.00431830
add esp, 0x2c
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
push 0x462d40
call dword [sym.imp.dispw.dll_get_numt]
add esp, 4
lea eax, [esp + 0x5a0]
push dword [0x462d5c]
push dword [0x462d58]
push dword [0x462d54]
push dword [0x462d50]
push dword [0x462d4c]
push dword [0x462d48]
push str.Cores_Threads:_t_d__d__d__d__d__d_n
push 0x400
push eax
call fcn.00431830
add esp, 0x24
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
mov edi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x9c]
add esp, 0xc
push eax
call edi
mov esi, dword [esp + 0x9c]
shr esi, 0x14
push str.kernel32
mov dword [esp + 0x10], esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4320db
push str.GlobalMemoryStatusEx
push eax
call esi
test eax, eax
je 0x4320db
lea ecx, [esp + 0xf0]
mov dword [esp + 0xf0], 0x40
push ecx
call eax
mov ecx, dword [esp + 0x100]
mov eax, dword [esp + 0x104]
shrd ecx, eax, 0x14
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xb0]
push eax
call edi
mov edi, dword [esp + 0xb8]
push str.kernel32
shr edi, 0x14
call ebx
test eax, eax
je 0x43212d
push str.GlobalMemoryStatusEx
push eax
call esi
test eax, eax
je 0x43212d
lea ecx, [esp + 0x130]
mov dword [esp + 0x130], 0x40
push ecx
call eax
mov edi, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
shrd edi, eax, 0x14
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ebx, dword [esp + 0x8c]
push str.kernel32
shr ebx, 0x14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x432184
push str.GlobalMemoryStatusEx
push eax
call esi
test eax, eax
je 0x432184
lea ecx, [esp + 0x170]
mov dword [esp + 0x170], 0x40
push ecx
call eax
mov ebx, dword [esp + 0x1a0]
mov eax, dword [esp + 0x1a4]
shrd ebx, eax, 0x14
lea eax, [esp + 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, dword [esp + 0xec]
push str.kernel32
shr esi, 0x14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4321e2
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4321e2
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x1b0], 0x40
push ecx
call eax
mov esi, dword [esp + 0x1d8]
mov eax, dword [esp + 0x1dc]
shrd esi, eax, 0x14
push dword [esp + 0xc]
lea eax, [esp + 0x5a4]
push edi
push ebx
push esi
push str.Mem:Virt_Phys:_t_d__d__d__d_n
push 0x400
push eax
call fcn.00431830
add esp, 0x1c
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
cmp dword [0x46278c], 0
je 0x432233
mov ecx, str.Checking_Sentinel_Key
call fcn.00432940
push 0x404
push 0x462d80
call fcn.00401000
movzx esi, ax
test esi, esi
jne 0x4322ac
push 0x462d80
call fcn.00401060
movzx esi, ax
test esi, esi
jne 0x4322ac
push 0x459a0c
push 0x462d80
call fcn.004010b0
movzx esi, ax
test esi, esi
jne 0x4322ac
push esi
push 0x462d80
call fcn.00401230
movzx esi, ax
test esi, esi
jne 0x4322ac
push 0x27
push 0x45fbc4
push 0x462d80
call fcn.00401290
movzx esi, ax
test esi, esi
jne 0x4322ac
push 0x9ace
push 0x462d80
call fcn.00401110
movzx esi, ax
cmp dword [0x46278c], 0
je 0x4322bf
mov ecx, str.Checking_Sentinel_Key
call fcn.00432940
test esi, esi
jne 0x43234a
push esi
push esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
call int.0042e4cc
test eax, eax
jne 0x4322fc
mov word [0x463184], ax
cmp dword [esp + 0xc], eax
je 0x432356
mov eax, 0x1b
mov esi, 0x80
mov word [0x463184], ax
jmp 0x4323c1
cmp eax, 1
jne 0x432316
mov eax, 0x1b
mov esi, 0x81
mov word [0x463184], ax
jmp 0x4323c1
cmp eax, 2
jne 0x432330
mov eax, 0x1b
mov esi, 0x82
mov word [0x463184], ax
jmp 0x4323c1
cmp eax, 3
jne 0x432347
mov eax, 0x1b
mov esi, 0x83
mov word [0x463184], ax
jmp 0x4323c1
lea esi, [eax + 0x7f]
xor eax, eax
mov word [0x463184], ax
test esi, esi
jne 0x43236a
push 0x462790
push 0
push 0x462d80
call fcn.00401170
movzx esi, ax
mov eax, 0x10
mov word [0x463184], ax
test esi, esi
jne 0x43238c
push 0x45fbec
push eax
push 0x462d80
call fcn.00401170
movzx esi, ax
mov eax, 0x1b
mov word [0x463184], ax
test esi, esi
jne 0x4323c1
push 0x45fbc0
push eax
push 0x462d80
call fcn.00401170
movzx esi, ax
test esi, esi
jne 0x4323c1
push esi
push esi
push 0x462d80
call fcn.004011d0
movzx esi, ax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.dispw.dll_get_info]
add esp, 0x44
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4324b8
push 0x100
push eax
mov dword [esp + 0x1fc], eax
mov dword [esp + 0x200], eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
lea eax, [esp + 0x20c]
push eax
mov dword [esp + 0x1fc], 0x11c
call fcn.00435af0
add esp, 0xc
mov dword [esp + 0x308], 0x10000
xor eax, eax
mov dword [esp + 0x304], eax
push 1
push 0x80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x80
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x4324b8
xor eax, eax
jmp 0x4324bd
mov eax, 1
push eax
push ecx
call fcn.004306b0
add esp, 4
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x5ac]
push esi
push str.Key_codes:_t_d__d__d__d_n
push 0x400
push eax
call fcn.00431830
add esp, 0x1c
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
movzx eax, word [0x45fbc0]
add esp, 0xc
push eax
movzx eax, word [0x45fbec]
push eax
movzx eax, word [0x462790]
push eax
push 0
push str.Local:_t_d__d__d__d_n_n
lea eax, [esp + 0x5b4]
push 0x400
push eax
call fcn.00431830
add esp, 0x1c
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
cmp dword [0x46278c], 0
je 0x432568
mov ecx, str.Checking_Sentinel_Key
call fcn.00432940
lea eax, [esp + 0x5a0]
push 0x400
push eax
call dword [sym.imp.dispw.dll_key_chk]
call dword [sym.imp.dispw.dll_end_chk]
push 0x45994c
lea eax, [esp + 0x5ac]
push 0x400
push eax
call fcn.0043958a
add esp, 0x14
lea eax, [esp + 0x5a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
cmp dword [0x46278c], 0
je 0x4325cb
mov ecx, 0x459705
call fcn.00432940
lea eax, [esp + 0x28a0]
push eax
lea eax, [esp + 0x14a4]
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x14a0]
push 0x45994c
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x10a0]
push eax
push 0
push 0
push 0x8010
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4326c1
lea edi, [esp + 0x10a0]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x432630
mov ax, word [0x459bbc]
lea ecx, [esp + 0x10a0]
mov word [edi], ax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432650
sub ecx, edx
je 0x4326c1
push str.KEY.LOG
lea eax, [esp + 0x10a4]
push 0x400
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x10a0]
push 0x459a54
push eax
call fcn.0043dfb2
mov esi, eax
add esp, 8
test esi, esi
je 0x4326c1
lea eax, [esp + 0x14a0]
push esi
push eax
call fcn.0043e4fe
push esi
call fcn.0043e040
add esp, 0xc
lea eax, [esp + 0x14a0]
push str._nThese_results_have_been_saved_to_your_DESKTOP_as_KEY.LOG_n
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x14a0]
push 0x1010
push str.Key_Check
push eax
push 0
call esi
push 0x1014
push str.Key_Check
push str.Would_you_like_to_email_these_results_to__support_map3d.com__
push 0
call esi
cmp eax, 6
jne 0x43286c
push str.mailto:support_map3d.com_admin_map3d.com_subjectKeyCheck
lea eax, [esp + 0x28a4]
push 0x1000
push eax
call fcn.0043e37b
add esp, 0xc
lea eax, [esp + 0x28a0]
push str.body
push 0x1000
push eax
call fcn.0043958a
add esp, 0xc
lea eax, [esp + 0x14a0]
push eax
lea eax, [esp + 0x28a4]
push 0x1000
push eax
call fcn.0043958a
lea ecx, [esp + 0x28ac]
mov byte [esp + 0x14ac], 0
add esp, 0xc
lea edx, [ecx + 1]
xor ebx, ebx
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432760
sub ecx, edx
je 0x432851
nop
push 1
lea esi, [esp + 0x28a4]
add esi, ebx
push 0x459840
push esi
call fcn.0043e3e0
add esp, 0xc
test eax, eax
je 0x432816
push 1
push 0x459b30
push esi
call fcn.0043e3e0
add esp, 0xc
test eax, eax
je 0x432816
push 1
push 0x45994c
push esi
call fcn.0043e3e0
add esp, 0xc
test eax, eax
jne 0x4327ed
lea eax, [esp + 0x14a0]
dec eax
mov cl, byte [eax + 1]
lea eax, [eax + 1]
test cl, cl
jne 0x4327c5
mov ecx, dword [str._0D_0A]
mov dword [eax], ecx
mov cx, word [0x459b38]
mov word [eax + 4], cx
mov cl, byte [0x459b3a]
mov byte [eax + 6], cl
jmp 0x432831
push 1
push 0x459b3c
push esi
call fcn.0043e3e0
add esp, 0xc
test eax, eax
je 0x432816
push 1
lea eax, [esp + 0x14a4]
push esi
push eax
call fcn.0043e5f0
add esp, 0xc
jmp 0x432831
lea edi, [esp + 0x14a0]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x432820
mov eax, dword [0x459b2c]
mov dword [edi], eax
lea ecx, [esp + 0x28a0]
inc ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432840
sub ecx, edx
cmp ebx, ecx
jb 0x432770
push 1
push 0
push 0
lea eax, [esp + 0x14ac]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x5a0]
call fcn.004310c0
mov ecx, dword [esp + 0x38a4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004339a8
mov esp, ebp
pop ebp
ret 0x10