Function at 0x42cfc0
Capabilities:
Contain obfuscated stackstrings
Copy file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x5c], 0x73ce71c3
mov dword [esp + 0x60], 0x7fdf7dd1
mov dword [esp + 0x64], 0x7b8c79cd
mov dword [esp + 0x68], 0x47fe45e9
mov dword [esp + 0x6c], 0x434241ed
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x13
ja 0x42d05b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x5c]
push dword [esp + 0x10]
push eax
call fcn.004308a0
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x14
jb 0x42d030
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x48]
push eax
call fcn.00442ef0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4516dc]
lea ecx, [esp + 0x48]
push 0x410
call fcn.004430f0
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4516e4]
jmp dword [0x451788]
mov dword [esp + 0x5c], 0x7aa56c7b
mov dword [esp + 0x60], 0x54765b7c
mov dword [esp + 0x64], 0x404f4567
mov dword [esp + 0x68], 0x7d4a4e63
mov dword [esp + 0x6c], 0x5c6d6a7a
mov dword [esp + 0x70], 0x55686e6b
mov dword [esp + 0x74], 0x5253766e
mov dword [esp + 0x78], 0x5e895079
mov dword [esp + 0x7c], 0x7e746e76
mov dword [esp + 0x80], 0xa67d936f
mov dword [esp + 0x84], 0x396e8787
mov byte [esp + 0x88], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x2c
ja 0x42d13b
nop
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x5c]
push dword [esp + 0x10]
push eax
call fcn.00430900
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x2d
jb 0x42d110
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push 0
push 0x2b
lea edx, [esp + 0x64]
push edx
push eax
call fcn.00443c20
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
xor eax, eax
cmp edx, edi
sete al
jmp dword [eax*4 + 0x4516ec]
mov eax, edi
xor eax, edx
mov ecx, edx
not ecx
and ecx, edi
add ecx, ecx
sub ecx, eax
sar ecx, 3
imul eax, ecx, 0x421
push eax
mov esi, edx
call fcn.0040ca60
mov edx, esi
add esp, 4
mov dword [esp + 0x2c], 0
xor ecx, ecx
mov dword [esp + 0x34], edi
cmp esi, edi
setne cl
mov edi, eax
mov dword [esp + 0x1c], eax
jmp dword [ecx*4 + 0x4516f4]
add edx, 8
xor eax, eax
cmp edx, dword [esp + 0x34]
setne al
jmp dword [eax*4 + 0x4516f4]
mov dword [esp + 0x3c], edi
mov esi, dword [edx]
mov dword [esp + 0x38], edx
mov edi, dword [edx + 4]
push 0x400
push 0
lea ebx, [esp + 0x64]
push ebx
call fcn.0040cae0
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0x48]
push eax
push 0
push 0x400
push ebx
push edi
push esi
call fcn.00443a00
cmp eax, 0xc0000000
setae al
mov ecx, dword [esp + 8]
or ecx, dword [esp + 0xc]
sete cl
or cl, al
movzx ecx, cl
mov eax, 1
jmp dword [ecx*4 + 0x451704]
xor eax, eax
jmp dword [0x451714]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
jmp dword [eax*4 + 0x45171c]
mov byte [esp + 0x45b], 0
movzx eax, byte [esp + 0x5c]
xor ebx, ebx
test al, al
je 0x42d261
lea ecx, [esp + 0x5c]
nop
nop
cmp al, 0x2e
je 0x42d25f
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x42d250
jmp 0x42d261
mov ebx, ecx
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x451724]
movzx eax, byte [ebx + 1]
inc ebx
xor esi, esi
test al, al
je 0x42d291
mov ecx, ebx
nop
nop
nop
nop
cmp al, 0x2e
je 0x42d28f
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x42d280
jmp 0x42d291
mov esi, ecx
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x45172c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], ebx
jmp dword [0x451738]
jmp dword [0x451758]
mov dword [esp + 8], 0xb9dc3011
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x42d30b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 8]
push dword [esp + 4]
push eax
call fcn.00430980
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x42d2e0
lea eax, [esp + 8]
push eax
push esi
call fcn.00404460
add esp, 8
jmp case.0x42d298.11
lea eax, [esp + 8]
push eax
push esi
call fcn.00404460
add esp, 8
jmp dword [0x451760]
mov dword [esp + 8], 0xb9dc3011
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x42d320
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 8]
push dword [esp + 4]
push eax
call fcn.00430980
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x42d360
jmp 0x42d320
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x451764]
jmp 0x42d3c6
movzx ecx, byte [eax]
test cl, cl
je 0x42d3bb
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], cl
inc edi
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x42d3b0
mov byte [edi], 0
mov word [edi], 0x203a
add edi, 2
movzx eax, byte [esp + 0x5c]
test al, al
je 0x42d3eb
lea ecx, [esp + 0x5d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x42d3e0
mov byte [edi], 0xa
inc edi
mov al, 1
mov dword [esp + 0x2c], eax
jmp case.0x42d298.8
mov esi, dword [esp + 0x30]
sub esi, ebx
je case.0x42d298.3
mov edi, 2
jmp 0x42d41c
lea eax, [edi + 4]
add edi, 2
cmp edi, esi
mov edi, eax
jae case.0x42d298.3
movzx eax, byte [ebx + edi - 2]
push eax
call fcn.00422260
add esp, 4
movzx eax, byte [ebx + edi - 1]
push eax
call fcn.00422260
add esp, 4
cmp edi, esi
jae 0x42d410
movzx eax, byte [ebx + edi]
push eax
call fcn.00422260
add esp, 4
cmp al, 0x40
je 0x42d410
lea eax, [edi + 1]
cmp eax, esi
jae 0x42d410
movzx eax, byte [ebx + edi + 1]
push eax
call fcn.00422260
add esp, 4
jmp 0x42d410
mov esi, dword [esp + 0x30]
mov edx, esi
sub edx, ebx
lea edi, [edx + edx*2]
shr edi, 2
movzx eax, byte [esi - 1]
cmp eax, 0x3d
je 0x42d48c
cmp eax, 0x2e
jne 0x42d48d
dec edi
mov eax, edx
xor eax, 2
mov ecx, edx
and ecx, 0xfffffffd
add ecx, ecx
sub ecx, eax
movzx eax, byte [ebx + ecx]
cmp eax, 0x3d
mov dword [esp + 0x28], edx
je 0x42d4ad
cmp eax, 0x2e
jne 0x42d4ae
dec edi
mov dword [esp + 0x58], edi
lea eax, [edi + 1]
push eax
call fcn.0040ca60
add esp, 4
mov dword [esp + 0x20], eax
cmp esi, ebx
je 0x42d5c0
xor edi, edi
mov esi, 2
jmp 0x42d4f6
mov edx, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [esi + 4]
add esi, 2
mov edi, edx
cmp esi, ecx
mov esi, eax
mov ebx, dword [esp + 0x24]
jae 0x42d5c0
movzx eax, byte [ebx + esi - 2]
push eax
call fcn.00422260
add esp, 4
mov ecx, ebx
mov ebx, eax
movzx eax, byte [ecx + esi - 1]
push eax
call fcn.00422260
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
mov ecx, dword [esp + 0x20]
mov byte [ecx + edi], al
lea edx, [edi + 1]
mov ecx, dword [esp + 0x28]
cmp esi, ecx
jae 0x42d4e0
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x24]
movzx eax, byte [eax + esi]
push eax
mov edi, edx
call fcn.00422260
mov edx, edi
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp al, 0x40
je 0x42d4e0
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
mov edi, dword [esp + 0x44]
lea edx, [edi + 2]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x20]
mov byte [edx + edi + 1], al
lea eax, [esi + 1]
cmp eax, ecx
jae 0x42d4d3
mov eax, dword [esp + 0x24]
movzx eax, byte [eax + esi + 1]
push eax
call fcn.00422260
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp al, 0x40
mov edx, dword [esp + 0x40]
je 0x42d4e0
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x44]
mov byte [edx + edi + 2], al
add edi, 3
mov edx, edi
jmp 0x42d4e0
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x20]
mov byte [esi + eax], 0
jmp dword [0x451740]
push esi
call fcn.00403bd0
add esp, 4
mov ebx, eax
jmp dword [0x451744]
push esi
call fcn.0040ca70
add esp, 4
push ebx
call fcn.004046a0
add esp, 4
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov edi, dword [esp + 0x3c]
jmp dword [eax*4 + 0x45174c]
push ebx
call fcn.00404c50
add esp, 4
mov edx, dword [esp + 0x38]
add edx, 8
xor eax, eax
cmp edx, dword [esp + 0x34]
setne al
jmp dword [eax*4 + 0x4516f4]
mov ebx, dword [esp + 0x2c]
mov eax, ebx
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x4516fc]
jmp dword [0x45177c]
xor ebx, ebx
test edx, edx
jne 0x42d7d4
jmp 0x42d7e1
mov esi, dword [ebp + 8]
mov byte [edi], 0
sub edi, dword [esp + 0x1c]
jmp dword [0x451770]
mov dword [esp + 0x5c], 0x6d6a6b33
mov dword [esp + 0x60], 0x79090a6f
mov dword [esp + 0x64], 0x7c707273
mov dword [esp + 0x68], 0x6721231
mov dword [esp + 0x6c], 0x153b7803
mov dword [esp + 0x70], 0x77d0279
mov dword [esp + 0x74], 0x90e4109
mov word [esp + 0x78], 0x9f0c
mov dword [esp + 0x7a], 0
mov word [esp + 0x7e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x23
ja 0x42d6eb
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x5c]
push dword [esp + 8]
push eax
call fcn.004309e0
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x24
jb 0x42d6c0
lea eax, [esp + 0x5c]
mov ecx, esi
push edi
push dword [esp + 0x20]
push eax
call fcn.0040d770
jmp dword [0x451774]
mov dword [esp + 0x5c], 0x6d6a6b33
mov dword [esp + 0x60], 0x79090a6f
mov dword [esp + 0x64], 0x7c707273
mov dword [esp + 0x68], 0x6721231
mov dword [esp + 0x6c], 0x153b7803
mov dword [esp + 0x70], 0x77d0279
mov dword [esp + 0x74], 0x90e4109
mov word [esp + 0x78], 0x9f0c
mov dword [esp + 0x7a], 0
mov word [esp + 0x7e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x23
ja 0x42d79b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x5c]
push dword [esp + 8]
push eax
call fcn.004309e0
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x24
jb 0x42d770
lea eax, [esp + 0x5c]
mov ecx, esi
push edi
push dword [esp + 0x20]
push eax
call fcn.0040d770
jmp case.0x42d298.17
mov ebx, eax
jmp dword [0x45177c]
push dword [esp + 0x1c]
call fcn.0040ca70
add esp, 4
and bl, 1
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test edx, edx
je 0x42d7e1
cmp edx, edi
je 0x42d7e1
push edx
call fcn.0040ca70
add esp, 4
jmp dword [0x451788]
lea ecx, [esp + 0x48]
call fcn.00443250
lea ecx, [esp + 0x48]
call fcn.00443250
jmp dword [0x451790]
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
sub esp, 0x18
mov esi, esp
sub esp, 0x50
mov edi, esp
mov dword [esi], 0xf968fb0b
mov dword [esi + 4], 0xe57ae765
mov dword [esi + 8], 0xe176e30b
mov dword [esi + 0xc], 0xed1eef74
mov dword [esi + 0x10], 0xe976eb03
mov dword [esi + 0x14], 0x95969700
mov word [esi + 0x18], 0
mov byte [esi + 0x1a], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x1a
ja 0x42d894
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [esi + eax]
push dword [ebp - 0x14]
push eax
call fcn.00431130
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [esi + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x1b
jb 0x42d870
mov dword [edi], 0xe93ceb38
mov dword [edi + 4], 0xed27ef23
mov dword [edi + 8], 0xf127f323
mov dword [edi + 0xc], 0xf520f724
mov dword [edi + 0x10], 0xf926fb2b
mov dword [edi + 0x14], 0xfd39ff2b
mov dword [edi + 0x18], 0x814a8339
mov dword [edi + 0x1c], 0x8554874f
mov dword [edi + 0x20], 0x89568b4f
mov dword [edi + 0x24], 0x8d5f8f5d
mov dword [edi + 0x28], 0x91469346
mov dword [edi + 0x2c], 0x95519749
mov dword [edi + 0x30], 0x99519b42
mov dword [edi + 0x34], 0x9d449f44
mov dword [edi + 0x38], 0xa14ea37b
mov dword [edi + 0x3c], 0xa54da75a
mov dword [edi + 0x40], 0xa97fab78
mov dword [edi + 0x44], 0xad45af5c
mov dword [edi + 0x48], 0xb141b34b
mov dword [edi + 0x4c], 0xb7b0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x4f
ja 0x42d954
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [edi + eax]
push dword [ebp - 0x14]
push eax
call fcn.00431180
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [edi + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x50
jb 0x42d930
push esi
push edi
call fcn.0043fa80
add esp, 8
jmp case.0x42d298.27
push ebx
push esi
call fcn.0043fa80
add esp, 8
jmp dword [0x4517a0]
push eax
sub esp, 0x18
mov ebx, esp
sub esp, 0x50
mov esi, esp
sub esp, 0xc
mov dword [ebp - 0x28], esp
sub esp, 0x28
mov edi, esp
sub esp, 0x30
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x20
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x38], esp
sub esp, 0x44
mov dword [ebp - 0x3c], esp
sub esp, 0x44
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 0x28
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0x5c], esp
sub esp, 8
mov dword [ebp - 0x64], esp
sub esp, 8
mov dword [ebp - 0x4c], esp
sub esp, 0x20
mov dword [ebp - 0x58], esp
mov dword [ebx], 0xf968fb0b
mov dword [ebx + 4], 0xe57ae765
mov dword [ebx + 8], 0xe176e30b
mov dword [ebx + 0xc], 0xed1eef74
mov dword [ebx + 0x10], 0xe976eb03
mov dword [ebx + 0x14], 0x95969700
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x1a
ja 0x42da44
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebx + eax]
push dword [ebp - 0x14]
push eax
call fcn.00431130
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [ebx + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x1b
jb 0x42da20
mov dword [esi], 0xe93ceb38
mov dword [esi + 4], 0xed27ef23
mov dword [esi + 8], 0xf127f323
mov dword [esi + 0xc], 0xf520f724
mov dword [esi + 0x10], 0xf926fb2b
mov dword [esi + 0x14], 0xfd39ff2b
mov dword [esi + 0x18], 0x814a8339
mov dword [esi + 0x1c], 0x8554874f
mov dword [esi + 0x20], 0x89568b4f
mov dword [esi + 0x24], 0x8d5f8f5d
mov dword [esi + 0x28], 0x91469346
mov dword [esi + 0x2c], 0x95519749
mov dword [esi + 0x30], 0x99519b42
mov dword [esi + 0x34], 0x9d449f44
mov dword [esi + 0x38], 0xa14ea37b
mov dword [esi + 0x3c], 0xa54da75a
mov dword [esi + 0x40], 0xa97fab78
mov dword [esi + 0x44], 0xad45af5c
mov dword [esi + 0x48], 0xb141b34b
mov dword [esi + 0x4c], 0xb7b0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x4f
ja 0x42d960
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [esi + eax]
push dword [ebp - 0x14]
push eax
call fcn.00431180
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [esi + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x50
jb 0x42daf0
jmp 0x42d960
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4517a4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x42db50
mov esi, eax
cmp ecx, 0xffffffd9
jge 0x42db7d
mov ecx, 0xffffffff
jmp 0x42db80
jmp dword [0x4517b8]
xor eax, eax
jmp 0x42ef0b
add ecx, 0x26
push ecx
call fcn.0040ca60
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [edi], 0x59ff5be8
mov dword [edi + 4], 0x5dec5fe9
mov dword [edi + 8], 0x51ed53e6
mov dword [edi + 0xc], 0x55fa57e9
mov dword [edi + 0x10], 0xa91babf1
mov dword [edi + 0x14], 0xad14af1a
mov dword [edi + 0x18], 0xa11ba313
mov dword [edi + 0x1c], 0xa52ca7d2
mov dword [edi + 0x20], 0xb900bb00
mov dword [edi + 0x24], 0xbfb8
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x27
mov ebx, dword [ebp - 0x38]
ja 0x42dc14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [edi + eax]
push dword [ebp - 0x14]
push eax
call fcn.004311f0
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [edi + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x28
jb 0x42dbf0
mov eax, esi
movzx edx, word [esi]
mov ecx, dword [ebp - 0x2c]
test dx, dx
je 0x42dc41
mov esi, eax
add esi, 2
mov ecx, dword [ebp - 0x2c]
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x42dc30
mov word [ecx], 0
movzx edx, word [edi]
test dx, dx
je 0x42dd30
add edi, 2
mov esi, dword [ebp - 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x42dc60
mov word [ecx], 0
jmp dword [0x4517bc]
push eax
call fcn.0040ca70
add esp, 4
xor eax, eax
cmp word [esi], 0x2a
sete al
mov edi, dword [ebp - 0x34]
jmp dword [eax*4 + 0x4517c4]
mov dword [edi], 0x93589153
mov dword [edi + 4], 0xaf4dad48
mov dword [edi + 8], 0xab5ca95f
mov dword [edi + 0xc], 0xa75fa55a
mov dword [edi + 0x10], 0xa346a15f
mov dword [edi + 0x14], 0xbf49bd5f
mov dword [edi + 0x18], 0xbb44b94e
mov dword [edi + 0x1c], 0xb749b54d
mov dword [edi + 0x20], 0xb33cb186
mov dword [edi + 0x24], 0x4fb04db0
mov word [edi + 0x28], 0x4948
mov dword [edi + 0x2a], 0
mov word [edi + 0x2e], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x2f
ja 0x42dd24
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [edi + eax]
push dword [ebp - 0x14]
push eax
call fcn.00431250
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [edi + ecx], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x30
jb 0x42dd00
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp case.0x42d298.38
mov esi, dword [ebp - 0x2c]
mov word [ecx], 0
jmp dword [0x4517bc]
xor eax, eax
cmp word [esi], 0x2a
sete al
mov edi, dword [ebp - 0x34]
jmp dword [eax*4 + 0x4517c4]
push 0x60
push 3
push 0x120089
mov edi, dword [ebp - 0x48]
push edi
push esi
call fcn.00449320
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4517cc]
jmp dword [0x45181c]
push 0
push dword [ebp - 0x18]
push dword [edi]
call fcn.004496a0
add esp, 0xc
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4517d4]
mov ebx, edi
jmp dword [0x4517e0]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
lea eax, [esi + 1]
push eax
call fcn.0040ca60
add esp, 4
push 0
push esi
push eax
push dword [ebx]
call fcn.00449780
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
lea eax, [esi + 1]
push eax
call fcn.0040ca60
add esp, 4
mov edi, eax
push 0
push esi
mov esi, dword [ebp - 0x18]
push eax
push dword [ebx]
call fcn.00449780
add esp, 0x10
jmp dword [0x4517e8]
mov esi, dword [edi]
mov dword [ebp - 0x14], 0xf4f5f6f7
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, 6
ja 0x42df96
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x14]
push dword [ebp - 0x24]
push eax
call fcn.00431eb0
add esp, 8
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x14], al
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 7
jb 0x42df70
mov eax, dword [0x455464]
test eax, eax
je 0x42dfcc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov edi, dword [0x455468]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x7e776f1
je 0x42dfc0
inc edx
cmp eax, edx
jne 0x42dfb0
jmp 0x42dfcc
mov eax, dword [edi + edx*8 + 4]
cmp eax, ecx
jne 0x42e5d9
mov esi, dword [ebp - 0x2c]
jmp dword [0x45181c]
push esi
push 1
push dword [0x45546c]
push eax
call fcn.00445e20
add esp, 0x10
mov esi, dword [ebp - 0x2c]
jmp dword [0x45181c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret