Function at 0x42e10a
Capabilities:
Create process on windows
Create process suspended
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x574
mov al, byte [edx + 0x50]
mov edi, dword [edx + 0x4c]
and dword [esp + 0x130], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
test al, al
sete cl
test edi, edi
sete ah
and ah, cl
mov byte [esp + 0x2c], ah
je 0x42e149
mov dword [esp + 0xc], 0
jmp 0x42e836
and dword [esp + 0x50], 0
and dword [esp + 0x58], 0
test al, al
jne 0x42e290
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x430334
mov edi, eax
mov dword [esp + 4], eax
cmp word [edi], 0
mov esi, edi
je 0x42e27f
push 0xfffffffffffffffe
pop ecx
xor ebx, ebx
dec ebx
cmp word [esi + ebx*2 + 2], 0
mov eax, ecx
lea ebx, [ebx + 1]
lea ecx, [ecx + 2]
jne 0x42e184
test ebx, ebx
je 0x42fc50
lea edi, [esi + ebx*2 + 2]
xor ebp, ebp
test eax, eax
je 0x42e172
cmp word [esi + ebp*2 + 2], 0x3d
je 0x42e1b4
inc ebp
add eax, 0xfffffffe
jmp 0x42e1a2
cmp ebp, ebx
jae 0x42fc50
lea eax, [ebp + 1]
lea ecx, [esp + 0x5c]
mov edx, esi
push eax
call fcn.004295b1
pop eax
add ebp, 2
sub ebx, ebp
jb 0x42fc50
lea edx, [esi + ebp*2]
lea ecx, [esp + 0x184]
push ebx
call fcn.004295b1
pop eax
movsd xmm0, qword [esp + 0x5c]
movsd xmm1, qword [esp + 0x64]
movsd xmm2, qword [esp + 0x184]
movsd qword [esp + 0x8c], xmm0
movsd qword [esp + 0x94], xmm1
movsd xmm1, qword [esp + 0x18c]
movsd qword [esp + 0x174], xmm0
movsd qword [esp + 0x9c], xmm2
cmp dword [esp + 0x8c], 0x80000000
movsd qword [esp + 0xa4], xmm1
je 0x42e27f
lea esi, [esp + 0x174]
lea edx, [esp + 0x8c]
mov ecx, esi
call fcn.00430342
lea eax, [esp + 0x9c]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x50]
push eax
push esi
call fcn.0042ba51
pop eax
pop ecx
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
call fcn.00417dd1
jmp 0x42e172
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov edx, dword [esp + 0x10]
mov edi, dword [esp]
mov eax, dword [edx + 0x44]
mov ebp, dword [edx + 0x48]
xor ecx, ecx
test eax, eax
setne cl
cmove edi, eax
xor ebx, ebx
mov dword [esp + 4], ecx
sub edi, 1
jb 0x42e740
cmp dword [esp + 4], 0
je 0x42fc50
test ebx, ebx
jne 0x42e2d8
mov ebx, eax
sub ebp, 1
jb 0x42e2cd
mov ebx, dword [ebx + 0x1ec]
jmp 0x42e2c0
xor ebp, ebp
xor eax, eax
inc eax
mov dword [esp + 4], eax
xor eax, eax
mov ecx, ebp
mov esi, ebx
movzx edx, word [esi + 0x1ea]
cmp ecx, edx
jb 0x42e301
mov edx, dword [esi + 0xb0]
test edx, edx
je 0x42fc50
movzx ecx, word [esi + 0x1e8]
inc eax
mov esi, edx
jmp 0x42e2dc
test eax, eax
mov dword [esp], edi
je 0x42e31e
lea edx, [esi + ecx*4 + 0x1f0]
mov ebx, dword [edx]
dec eax
lea edx, [ebx + 0x1ec]
jne 0x42e30f
xor ebp, ebp
jmp 0x42e323
lea ebp, [ecx + 1]
mov ebx, esi
imul eax, ecx, 0x1c
shl ecx, 4
cmp dword [esi + ecx], 0x80000000
lea edi, [esi + eax + 0xb4]
je 0x42e3c3
add esi, ecx
lea ecx, [esp + 0x8c]
mov edx, edi
call fcn.00430393
mov edx, dword [edi + 0x14]
lea ecx, [esp + 0x184]
push dword [edi + 0x18]
call fcn.0042c5ea
pop eax
movsd xmm0, qword [esp + 0x8c]
movsd xmm1, qword [esp + 0x94]
lea edi, [esp + 0x8c]
mov edx, esi
mov ecx, edi
movsd qword [esp + 0x17c], xmm1
movsd qword [esp + 0x174], xmm0
call fcn.00430393
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x50]
push edi
lea eax, [esp + 0x178]
push eax
call fcn.0042ba51
pop eax
pop ecx
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
call fcn.00417dd1
mov edi, dword [esp]
xor eax, eax
jmp 0x42e2a6
mov edx, dword [esp + 0x50]
mov esi, 0x80000000
test edx, edx
je 0x42e3f3
lea ecx, [esp + 0x108]
push dword [edi + 0x18]
push dword [edi + 0x14]
push dword [esp + 0x5c]
call fcn.0042b3fe
add esp, 0xc
cmp dword [esp + 0x108], 0
je 0x42e408
mov edi, dword [esp]
mov edx, dword [esp + 0x28]
mov ecx, esi
call fcn.00417dd1
xor eax, eax
jmp 0x42e2a6
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x114]
mov byte [esp + 0x150], 0
test eax, eax
je 0x42e510
lea ecx, [ecx + edx*4 + 0x1ec]
dec eax
mov ecx, dword [ecx]
sub eax, 1
movzx edx, word [ecx + 0x1ea]
jb 0x42e44c
lea ecx, [ecx + edx*4 + 0x1ec]
jmp 0x42e435
mov dword [esp + 0xfc], ecx
and dword [esp + 0x100], 0
dec edx
lea eax, [esp + 0x150]
lea ecx, [esp + 0x174]
mov dword [esp + 0x104], edx
lea edx, [esp + 0xfc]
push eax
call fcn.0042b49d
pop eax
mov eax, dword [esp + 0x18c]
movsd xmm1, qword [esp + 0x17c]
movsd xmm0, qword [esp + 0x184]
movsd xmm3, qword [esp + 0x174]
mov edx, dword [esp + 0x1a4]
mov esi, dword [esp + 0x1a8]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x184]
movsd qword [esp + 0x3c], xmm1
movsd qword [esp + 0x44], xmm0
movsd qword [esp + 0x34], xmm3
movsd xmm2, qword [eax + 0xc]
movsd xmm1, qword [eax + 0x14]
mov eax, dword [esp + 0x1a0]
movsd qword [esp + 0xd0], xmm2
movsd qword [esp + 0xd8], xmm1
movzx ecx, word [eax + 0x1ea]
cmp esi, ecx
jb 0x42e549
mov ecx, dword [eax + 0xb0]
test ecx, ecx
je 0x42e54f
movzx esi, word [eax + 0x1e8]
inc edx
mov eax, ecx
jmp 0x42e4ef
mov dword [esp + 0x174], ecx
and dword [esp + 0x178], 0
lea esi, [esp + 0x174]
lea eax, [esp + 0x150]
mov dword [esp + 0x17c], edx
lea ecx, [esp + 0x8c]
mov edx, esi
push eax
call fcn.0042b49d
pop eax
jmp 0x42e657
mov ecx, edx
mov edx, esi
jmp 0x42e553
mov ecx, eax
xor eax, eax
mov esi, edx
imul edi, edx, 0x1c
shl esi, 4
test ecx, ecx
mov dword [esp + 0x14], esi
mov esi, dword [eax + edi + 0xcc]
mov dword [esp + 0x74], esi
mov esi, dword [esp + 0x4c]
movsd xmm0, qword [eax + edi + 0xc4]
movsd qword [esp + 0x6c], xmm0
movsd xmm0, qword [eax + edi + 0xb4]
movsd xmm1, qword [eax + edi + 0xbc]
movsd qword [esp + 0x64], xmm1
movsd qword [esp + 0x5c], xmm0
mov dword [eax + edi + 0xcc], esi
lea esi, [esp + 0x78]
movsd xmm0, qword [esp + 0x44]
movsd qword [eax + edi + 0xc4], xmm0
movsd xmm0, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x3c]
movsd qword [eax + edi + 0xbc], xmm1
movsd qword [eax + edi + 0xb4], xmm0
mov edi, dword [esp + 0x14]
movsd xmm2, qword [esp + 0xd0]
movsd xmm1, qword [eax + edi + 8]
movsd xmm0, qword [eax + edi]
movsd qword [esi + 8], xmm1
movsd xmm1, qword [esp + 0xd8]
movsd qword [esi], xmm0
movsd qword [eax + edi], xmm2
movsd qword [eax + edi + 8], xmm1
je 0x42e629
lea edx, [eax + edx*4 + 0x1f0]
lea edi, [esp + 0x8c]
mov eax, dword [edx]
dec ecx
lea edx, [eax + 0x1ec]
jne 0x42e61a
xor edx, edx
jmp 0x42e631
inc edx
lea edi, [esp + 0x8c]
push 0xb
pop ecx
lea esi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xb8], eax
lea esi, [esp + 0x174]
and dword [esp + 0xbc], 0
mov dword [esp + 0xc0], edx
mov eax, dword [esp + 0x8c]
push 0xa
pop ecx
mov edx, esi
mov edi, esi
lea esi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
dec dword [esp + 0x58]
cmp byte [esp + 0x150], 0
je 0x42e6cf
mov ecx, dword [esp + 0x50]
lea esi, [esp + 0x8c]
test ecx, ecx
je 0x42fc50
mov eax, dword [esp + 0x54]
test eax, eax
je 0x42fc50
mov edx, dword [ecx + 0x1ec]
dec eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
and dword [edx + 0xb0], 0
push 4
pop edx
call fcn.004128d0
push 0xa
pop edx
mov ecx, edx
mov eax, esi
mov edi, esi
lea esi, [esp + 0x174]
jmp 0x42e6df
mov esi, edx
push 0xa
pop ecx
lea eax, [esp + 0x8c]
mov edx, ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edi, [esp + 0x5c]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, 0x80000000
mov eax, dword [esp + 0x14]
mov edi, dword [esp]
cmp eax, 0x80000000
je 0x42e3f6
mov dword [esp + 0x174], eax
push 0xa
pop ecx
mov eax, edi
lea edi, [esp + 0x178]
lea esi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea ecx, [esp + 0x174]
mov eax, dword [esp + 0x194]
mov esi, dword [esp + 0x190]
mov dword [esp + 0x28], eax
call fcn.0042a831
jmp 0x42e3f6
mov eax, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
lea esi, [esp + 0x8c]
mov edx, 0x454d81
mov ecx, esi
mov dword [esp + 0x1c], eax
push 4
call fcn.0042d82c
pop eax
lea ecx, [esp + 0x174]
mov edx, esi
call fcn.00430342
test edi, edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
je 0x42e826
mov eax, dword [esp + 0x188]
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov eax, dword [esp + 0x18c]
mov dword [esp + 4], eax
xor eax, eax
dec eax
movzx ecx, word [edi + 0x1ea]
lea esi, [edi + 0xb4]
mov ebx, eax
mov dword [esp + 0x28], edi
imul ebp, ecx, 0x1c
mov dword [esp + 0x30], ecx
test ebp, ebp
je 0x42e7f0
mov ecx, dword [esp]
mov edx, dword [esp + 4]
lea edi, [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
call fcn.0042b3d4
pop ecx
pop edx
add ebp, 0xffffffe4
inc ebx
cmp al, 1
mov esi, edi
je 0x42e7c2
movzx eax, al
test eax, eax
je 0x42e811
jmp 0x42e7f4
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
xor eax, eax
dec eax
sub ecx, 1
jb 0x42e826
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov edi, dword [edi + ebx*4 + 0x1ec]
jmp 0x42e7a8
mov ecx, dword [esp + 0x28]
shl ebx, 4
mov eax, dword [ecx + ebx + 4]
mov ebp, dword [ecx + ebx + 8]
mov dword [esp + 0xc], eax
jmp 0x42e826
lea ecx, [esp + 0x174]
call fcn.0042a831
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0x20]
mov esi, dword [edx + 0x1c]
mov edi, 0x454f80
test ebx, ebx
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], ebx
je 0x42e881
mov ecx, esi
mov edx, ebx
push 4
push 0x454e82
call fcn.00428c69
pop ecx
pop edx
test al, al
movzx eax, byte [ebx + esi - 1]
mov ecx, 0x4303c8
mov edx, 0x4303d1
cmovne edx, ecx
push eax
call edx
pop ecx
test al, al
je 0x42e8dc
push 2
pop esi
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov dword [eax + 4], edi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [eax + 8], 2
cmp byte [esp + 0x2c], 0
jne 0x42e90f
test esi, esi
je 0x42e8f7
mov edx, dword [esp + 0x1c]
and dword [esp + 0x178], 0
mov dword [esp + 0x17c], esi
mov dword [esp + 0x180], edi
and dword [esp + 0x188], 0
xor eax, eax
mov dword [esp + 0x18c], esi
mov dword [esp + 0x190], edi
inc eax
jmp 0x42e8fb
cmp ebx, 3
ja 0x42e92d
mov ecx, esi
mov edx, ebx
call fcn.004303e2
test al, al
jne 0x42e987
jmp 0x42eaa3
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x174]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x20], edx
call fcn.0042c66a
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x134]
call fcn.00431590
add esp, 0x574
pop esi
pop edi
pop ebx
pop ebp
ret
add esi, ebx
push 0xfffffffffffffffc
pop eax
mov edi, eax
test eax, eax
je 0x42e968
mov al, byte [esi + edi]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
mov al, byte [edi + 0x454f40]
mov edx, eax
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
lea eax, [edi + 1]
cmp cl, dl
je 0x42e932
mov esi, dword [esp + 0xec]
mov ebx, dword [esp + 0xf0]
mov ecx, esi
mov edx, ebx
call fcn.004303e2
test al, al
je 0x42ea9b
lea edi, [esp + 0x174]
lea eax, [esi + ebx]
mov dword [edi], esi
mov dword [edi + 4], eax
and word [edi + 8], 0
mov ecx, edi
call fcn.00428dea
cmp ax, 1
jne 0x42e9ad
test dx, dx
jne 0x42e99b
cmp ax, 1
mov edi, 0x454f30
je 0x42e881
mov ecx, esi
mov edx, ebx
push 0x2e
call fcn.0042e0f5
pop ecx
mov byte [esp + 0xb], al
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42eb7c
lea esi, [esp + 0x5c]
add ebp, eax
lea edi, [esp + 0x174]
mov dword [esi], eax
mov dword [esi + 4], ebp
and word [esi + 8], 0
mov byte [esi + 0xc], 1
mov ecx, edi
mov edx, esi
call fcn.0042d77b
mov ecx, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
cmp ecx, 0x80000000
je 0x42eb72
mov eax, dword [esp + 0x17c]
test eax, eax
je 0x42ea91
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], eax
lea eax, [esp + 0x8c]
lea edx, [esp + 0xec]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x8c], ecx
lea ecx, [esp + 0x15c]
push eax
lea eax, [esp + 0xf]
push eax
call fcn.00430868
pop eax
pop ecx
mov ebx, dword [esp + 0x15c]
mov ebp, dword [esp + 0x160]
cmp ebx, 0x80000000
jne 0x42ecdd
mov ecx, 0x80000000
mov edx, ebp
call fcn.00430e48
jmp 0x42e9f3
call fcn.00412c7a
jmp 0x42e9f3
test edi, edi
je 0x42ec4f
lea edi, [esp + 0x8c]
mov edx, esi
mov ecx, edi
push ebx
call fcn.0042d82c
pop eax
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
lea esi, [esp + 0x174]
mov edx, str..exeprogram_not_found
mov ecx, esi
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
push 4
call fcn.0042d86d
pop eax
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
lea ebx, [esp + 0x168]
mov ecx, ebx
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
mov esi, dword [edi + 4]
mov edx, esi
push dword [edi + 8]
call fcn.00430401
pop eax
cmp dword [ebx], 0x80000000
jne 0x42eb3f
lea esi, [esp + 0x8c]
mov edx, 0x454ad8
mov ecx, esi
push 0
call fcn.0042df60
pop eax
mov edi, dword [esi + 4]
lea ecx, [esp + 0x118]
mov edx, edi
push dword [esi + 8]
call fcn.0043046c
pop eax
mov ecx, dword [esi]
mov edx, edi
jmp 0x42eb68
mov eax, dword [esp + 0x170]
movsd xmm0, qword [esp + 0x168]
mov ecx, dword [esp + 0x8c]
mov edx, esi
mov dword [esp + 0x120], eax
movsd qword [esp + 0x118], xmm0
call fcn.00412c7a
jmp 0x42f226
mov ecx, 0x80000000
call fcn.00417dd1
lea eax, [esp + 0x8c]
mov esi, 0x200
xor edi, edi
and dword [eax], 0
mov dword [eax + 4], 2
and dword [eax + 8], 0
push 2
pop eax
mov dword [esp + 4], eax
cmp esi, 0x201
jae 0x42ebb9
lea ebp, [esp + 0x174]
mov dword [esp], 0x200
mov ebx, esi
jmp 0x42ebe7
sub esi, edi
lea ecx, [esp + 0x8c]
mov edx, esi
call fcn.00429c1d
mov edi, dword [esp + 0x8c]
mov ebp, dword [esp + 0x90]
mov ebx, edi
mov dword [esp + 0x94], edi
mov dword [esp + 4], ebp
mov dword [esp], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
test eax, eax
jne 0x42ec09
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42ec64
cmp esi, ebx
jne 0x42ec2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42fc50
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x42eb9f
ja 0x42eb9f
cmp esi, dword [esp]
ja 0x42fc50
lea ecx, [esp + 0xd0]
mov edx, ebp
push esi
call fcn.00429cbb
pop eax
jmp 0x42ec79
lea ecx, [esp + 0x118]
mov edx, esi
push ebx
call fcn.0043046c
pop eax
jmp 0x42f226
lea esi, [esp + 0xd4]
mov ecx, esi
call fcn.00429caa
mov dword [esi - 4], 0x80000000
mov edx, dword [esp + 4]
mov ecx, edi
call fcn.00429576
mov ebp, dword [esp + 0xd0]
cmp ebp, 0x80000000
jne 0x42eca4
lea ecx, [esp + 0xd0]
call fcn.0042958f
jmp 0x42ee86
mov edx, dword [esp + 0xd4]
mov edi, dword [esp + 0xd8]
lea esi, [esp + 0x5c]
mov ecx, esi
mov dword [esp], edx
push edi
call fcn.00429645
pop eax
lea ebx, [esp + 0x34]
mov edx, esi
mov ecx, ebx
call fcn.0042a96b
mov al, byte [ebx]
cmp al, 0xa
jne 0x42ece9
mov ecx, dword [esp]
jmp 0x42ee33
mov esi, dword [esp + 0x164]
jmp 0x42f211
add al, 0xfa
cmp al, 3
ja 0x42ecd5
movzx eax, al
dec eax
cmp eax, 2
ja 0x42ecd5
mov al, byte [esp + 0x64]
mov esi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
cmp al, 6
je 0x42ed31
mov ecx, dword [esp + 0x74]
movsd xmm0, qword [esp + 0x65]
movsd xmm1, qword [esp + 0x6d]
mov dword [esp + 0x183], ecx
movsd qword [esp + 0x17c], xmm1
movsd qword [esp + 0x174], xmm0
mov dl, byte [esp + 0x78]
mov ch, byte [esp + 0x79]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x94], al
movsd xmm0, qword [esp + 0x174]
movsd xmm1, qword [esp + 0x17c]
mov cl, byte [esp + 0x7a]
mov eax, dword [esp + 0x183]
cmp dl, 2
movsd qword [esp + 0x9d], xmm1
movsd qword [esp + 0x95], xmm0
mov dword [esp + 0xa4], eax
mov byte [esp + 0xaa], cl
mov byte [esp + 0xa8], dl
mov byte [esp + 4], ch
mov byte [esp + 0xa9], ch
jne 0x42ede4
test ebx, ebx
je 0x42ede4
lea ecx, [esp + 0x174]
lea edx, [esp + 0x8c]
call fcn.004291eb
cmp byte [esp + 0x178], 0xa
jne 0x42ede4
mov eax, dword [esp + 0x174]
sub ebx, eax
jb 0x42fc50
add esi, eax
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], ebx
jmp 0x42eda2
cmp byte [esp + 4], 2
jne 0x42ee2b
lea esi, [esp + 0x8c]
mov ecx, esi
call fcn.004299a7
cmp ebx, eax
jbe 0x42ee2b
lea ecx, [esp + 0x174]
mov edx, esi
call fcn.004299d1
cmp byte [esp + 0x178], 0xa
jne 0x42ee2b
sub ebx, dword [esp + 0x174]
jb 0x42fc50
mov dword [esp + 0x90], ebx
jmp 0x42edf2
mov ecx, dword [esp]
cmp edi, ebx
cmovae edi, ebx
lea eax, [esp + 0x174]
lea esi, [esp + 0x150]
lea edx, [esp + 0xec]
mov dword [eax], ebp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xdc]
mov dword [eax + 8], edi
lea edi, [esp + 0xb]
mov dword [eax + 0xc], ecx
mov ecx, esi
push eax
push edi
call fcn.00430868
pop eax
pop ecx
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
cmp ebx, 0x80000000
jne 0x42f0ae
mov ecx, 0x80000000
mov edx, ebp
call fcn.00430e48
lea eax, [esp + 0x5c]
mov esi, 0x200
xor ebp, ebp
and dword [eax], 0
mov dword [eax + 4], 2
and dword [eax + 8], 0
push 2
pop eax
mov dword [esp + 4], eax
cmp esi, 0x201
jae 0x42eec0
lea ebx, [esp + 0x174]
mov dword [esp], 0x200
mov edi, esi
jmp 0x42eee2
sub esi, ebp
lea ecx, [esp + 0x5c]
mov edx, esi
call fcn.00429c1d
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov edi, ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 4], ebx
mov dword [esp], ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x42ef02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42ef7d
cmp esi, edi
jne 0x42ef24
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42fc50
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x42eea6
ja 0x42eea6
cmp esi, dword [esp]
ja 0x42fc50
lea edi, [esp + 0x8c]
mov edx, ebx
mov ecx, edi
push esi
call fcn.004295b1
pop eax
lea esi, [esp + 0x50]
lea eax, [esp + 0xb]
lea edx, [esp + 0xec]
mov ecx, esi
push edi
push eax
call fcn.00430868
pop eax
pop ecx
mov edx, dword [esp + 4]
mov ecx, ebp
call fcn.00429576
mov ebx, dword [esi]
cmp ebx, 0x80000001
jle 0x42ef9a
mov ebp, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
jmp 0x42f211
lea esi, [esp + 0x54]
mov ecx, esi
call fcn.00429caa
mov edx, dword [esp + 4]
mov ecx, ebp
mov dword [esi - 4], 0x80000001
call fcn.00429576
lea ecx, [esp + 0x50]
call fcn.00430e57
lea eax, [esp + 0x5c]
mov esi, 0x200
xor ebp, ebp
and dword [eax], 0
mov dword [eax + 4], 2
and dword [eax + 8], 0
push 2
pop eax
mov dword [esp + 4], eax
cmp esi, 0x201
jae 0x42efdd
lea ebx, [esp + 0x174]
mov dword [esp], 0x200
mov edi, esi
jmp 0x42efff
sub esi, ebp
lea ecx, [esp + 0x5c]
mov edx, esi
call fcn.00429c1d
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov edi, ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 4], ebx
mov dword [esp], ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test eax, eax
jne 0x42f023
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42f0ba
cmp esi, edi
jne 0x42f048
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42fc50
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x42efc3
ja 0x42efc3
cmp esi, dword [esp]
ja 0x42fc50
lea edi, [esp + 0x8c]
mov edx, ebx
mov ecx, edi
push esi
call fcn.004295b1
pop eax
lea esi, [esp + 0xfc]
lea eax, [esp + 0xb]
lea edx, [esp + 0xec]
mov ecx, esi
push edi
push eax
call fcn.00430868
pop eax
pop ecx
mov edx, dword [esp + 4]
mov ecx, ebp
call fcn.00429576
mov ebx, dword [esi]
cmp ebx, 0x80000002
jl 0x42f0da
mov ebp, dword [esp + 0x100]
mov esi, dword [esp + 0x104]
jmp 0x42f211
mov esi, dword [esp + 0x158]
jmp 0x42f211
lea esi, [esp + 0x100]
mov ecx, esi
call fcn.00429caa
mov edx, dword [esp + 4]
mov ecx, ebp
mov dword [esi - 4], 0x80000001
call fcn.00429576
lea ecx, [esp + 0xfc]
call fcn.00430e57
lea esi, [esp + 0x34]
mov edx, 0x454d81
mov ecx, esi
push 4
call fcn.0042d54f
pop eax
mov eax, dword [esi]
cmp eax, 0x80000000
je 0x42f1ea
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
lea esi, [esp + 0x5c]
lea edi, [esp + 0x174]
mov dword [esp], eax
add edx, ecx
mov dword [esi], ecx
mov dword [esp + 4], ecx
mov dword [esi + 4], edx
and word [esi + 8], 0
mov byte [esi + 0xc], 1
mov ecx, edi
mov edx, esi
call fcn.0042d77b
mov ecx, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
cmp ecx, 0x80000000
je 0x42f1d4
mov eax, dword [esp + 0x17c]
test eax, eax
je 0x42f1ca
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], eax
lea eax, [esp + 0x8c]
lea edx, [esp + 0xec]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x8c], ecx
lea ecx, [esp + 0x108]
push eax
lea eax, [esp + 0xf]
push eax
call fcn.00430868
pop eax
pop ecx
mov ebx, dword [esp + 0x108]
mov ebp, dword [esp + 0x10c]
cmp ebx, 0x80000000
jne 0x42f1fe
mov ecx, 0x80000000
mov edx, ebp
call fcn.00430e48
jmp 0x42f130
call fcn.00412c7a
jmp 0x42f130
mov ecx, 0x80000000
call fcn.00417dd1
mov ecx, dword [esp]
mov edx, dword [esp + 4]
call fcn.00412c7a
mov ecx, 0x80000000
call fcn.00430e48
mov edi, 0x454f54
jmp 0x42e881
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov esi, dword [esp + 0x110]
call fcn.00412c7a
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebp
mov dword [esp + 0x120], esi
mov eax, dword [esp + 0x118]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x11c]
mov edi, dword [esp + 0x120]
cmp eax, 0x80000000
je 0x42e884
mov ecx, dword [esp + 0x11c]
cmp edi, 5
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
jb 0x42f27a
lea eax, [esi + edi*2 - 0xa]
test eax, eax
je 0x42f27a
cmp word [eax], 0x2e
jne 0x42f27a
lea eax, [esi + edi*2]
cmp word [eax - 2], 0
je 0x42f5df
mov edx, ebx
mov ecx, dword [ebx + 0x1c]
mov al, byte [ebx + 0x65]
mov edi, dword [ebx + 0x2c]
mov ebx, dword [ebx + 0x20]
lea esi, [esp + 0x8c]
imul ebp, dword [edx + 0x30], 0x14
and dword [esi], 0
mov dword [esi + 4], 2
and dword [esi + 8], 0
mov dword [esp + 4], ecx
mov byte [esp], al
add ebx, ecx
push 0x22
pop edx
mov ecx, esi
call fcn.0042d0d6
mov eax, dword [esp + 4]
lea edx, [esp + 0x174]
mov ecx, esi
mov dword [edx], eax
mov dword [edx + 4], ebx
and word [edx + 8], 0
call fcn.0042d0b6
mov ecx, esi
push 0x22
pop edx
call fcn.0042d0d6
movzx esi, byte [esp]
test ebp, ebp
je 0x42f327
lea ebx, [esp + 0x8c]
mov ecx, ebx
push 0x20
pop edx
call fcn.0042d0d6
lea ecx, [esp + 0x174]
mov edx, ebx
push esi
push edi
call fcn.00430e79
pop eax
pop ecx
cmp byte [esp + 0x174], 4
je 0x42f31f
mov ebx, dword [esp + 0x174]
cmp bl, 4
jne 0x42f59b
add edi, 0x14
add ebp, 0xffffffec
jmp 0x42f2de
mov eax, dword [esp + 0x8c]
mov ebx, dword [esp + 0x90]
mov esi, dword [esp + 0x94]
cmp eax, 0x80000000
je 0x42f5b5
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov cl, 1
mov dword [esp + 0x88], 0
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x30], edx
lea ecx, [esp + 0x108]
xor edx, edx
xor ebp, ebp
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], esi
call fcn.0042d0d6
mov ebx, dword [esp + 0x10]
mov eax, 0x400
mov ecx, 0x608
cmp byte [ebx + 0x64], 0
cmove ecx, eax
or ecx, dword [ebx + 0x54]
mov dword [esp + 0xe8], ecx
push 2
pop eax
cmp byte [esp + 0x2c], 0
mov esi, 0
mov edx, eax
mov ecx, 0
jne 0x42f64c
mov ecx, dword [esp + 0x1c]
and dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 2
and dword [esp + 0xd8], 0
test ecx, ecx
jne 0x42f3f1
lea ecx, [esp + 0xd0]
xor edx, edx
call fcn.0042d0d6
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
xor eax, eax
lea edi, [esp + 0x174]
lea ebp, [esp + 0x5c]
test edx, edx
setne al
cmove ecx, edx
mov dword [edi], eax
and dword [edi + 4], 0
mov dword [edi + 8], edx
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
and dword [edi + 0x14], 0
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], ecx
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x174]
call fcn.00429419
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x42f60c
mov ebx, dword [esp + 0x94]
imul edx, ebx, 0x1c
mov ecx, dword [eax + edx + 0xb4]
cmp ecx, 0x80000000
je 0x42f60c
lea edx, [eax + edx + 0xb4]
shl ebx, 4
mov edi, dword [edx + 0x10]
lea esi, [eax + ebx]
movsd xmm0, qword [esi + 8]
lea esi, [esp + 0x8c]
mov dword [esp + 0x2c], edi
mov edi, dword [eax + ebx]
mov eax, dword [eax + ebx + 4]
mov ebx, dword [edx + 0x18]
mov dword [esp + 4], edi
mov edi, ebp
mov ebp, dword [edx + 0x14]
mov dword [esp + 0x8c], ecx
movsd qword [esp + 0xfc], xmm0
mov dword [esp], eax
lea ecx, [esp + 0x90]
mov eax, dword [edx + 0xc]
mov dword [ecx + 8], eax
movsd xmm0, qword [edx + 4]
mov edx, esi
movsd qword [ecx], xmm0
mov ecx, edi
call fcn.00430fd7
mov ecx, dword [esp + 0x5c]
cmp ecx, 0x80000000
je 0x42f6ec
mov edx, dword [esp + 0x60]
call fcn.00412c7a
lea ecx, [esp + 0xd0]
mov edx, ebp
push ebx
mov ebx, ecx
call fcn.00429541
pop eax
mov ecx, dword [esp + 0x2c]
mov edx, ebp
call fcn.00429576
mov ecx, ebx
push 0x3d
pop edx
call fcn.0042d0d6
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x100]
mov dword [esp + 0x94], edx
mov edx, esi
mov dword [esp + 0x98], ecx
mov ecx, edi
call fcn.00430fd7
mov esi, dword [esp + 0x5c]
cmp esi, 0x80000000
je 0x42f70d
mov ebp, edi
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov ecx, ebx
lea edx, [esp + 0x34]
add eax, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
and word [esp + 0x3c], 0
call fcn.0042d0b6
mov ecx, esi
mov edx, edi
call fcn.00412c7a
mov ecx, ebx
xor edx, edx
call fcn.0042d0d6
lea ecx, [esp + 0x8c]
jmp 0x42f431
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x90]
mov esi, dword [esp + 0x178]
call fcn.00429576
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
call fcn.00429576
jmp 0x42e89c
movzx ecx, word [eax - 8]
cmp ecx, 0x42
je 0x42f929
cmp ecx, 0x43
je 0x42f94b
cmp ecx, 0x62
je 0x42f929
cmp ecx, 0x63
je 0x42f94b
jmp 0x42f27a
lea ecx, [esp + 0x174]
call fcn.0042c66a
lea esi, [esp + 0xd0]
xor edx, edx
mov ecx, esi
call fcn.0042d0d6
mov ecx, dword [esi]
mov esi, dword [esi + 4]
cmp ecx, 0x80000000
jne 0x42f641
mov edi, dword [esp + 0xd8]
jmp 0x42f734
mov ebx, dword [esp + 0x10]
mov edx, esi
xor ebp, ebp
push 2
pop eax
cmp dword [ebx + 0x34], 0x80000000
mov dword [esp + 0x20], edx
mov edx, 0
mov dword [esp + 0xf8], esi
mov dword [esp + 0x2c], ecx
je 0x42f74b
lea esi, [esp + 0x5c]
lea edx, [ebx + 0x34]
mov ecx, esi
call fcn.00431048
cmp byte [esi], 4
jne 0x42f686
mov eax, dword [esp + 0x60]
jmp 0x42f693
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
cmp dl, 4
jne 0x42f6d7
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
lea edx, [esp + 0x174]
lea esi, [esp + 0x8c]
add eax, ecx
mov dword [edx], ecx
mov ecx, esi
mov dword [edx + 4], eax
and word [edx + 8], 0
call fcn.0043109a
mov ecx, esi
xor edx, edx
call fcn.0042d0d6
mov ebp, dword [esi]
mov edx, dword [esi + 4]
cmp ebp, 0x80000000
jne 0x42f749
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov dword [ecx], edx
mov dword [ecx + 8], 2
jmp 0x42ffe9
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
call fcn.00412c7a
mov ecx, dword [esp + 0x2c]
mov edx, ebp
call fcn.00429576
jmp 0x42f715
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
lea ecx, [esp + 0x174]
call fcn.0042c66a
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd4]
call fcn.00429576
mov eax, dword [esp + 0x18]
mov dword [eax + 4], edi
mov dword [eax], esi
mov dword [eax + 8], 2
jmp 0x42fff6
mov eax, edx
xorps xmm0, xmm0
mov ecx, 0x457be0
mov dword [esp + 0x12c], edx
mov dword [esp + 0x24], eax
movups xmmword [esp + 0x5c], xmm0
call fcn.0042d701
lea eax, [esp + 0x138]
lea ecx, [esp + 0x130]
mov edx, ebx
lea edi, [ebx + 8]
lea esi, [ebx + 0x10]
and dword [eax], 0
and dword [eax + 8], 0
and dword [eax + 0x10], 0
cmp dword [ebx], 6
cmove edx, ecx
cmp dword [ebx + 8], 6
cmove edi, ecx
cmp dword [ebx + 0x10], 6
lea ebx, [esp + 0x174]
cmove esi, ecx
mov ecx, ebx
push eax
push 0xfffffffffffffff6
call fcn.00431138
pop eax
pop ecx
cmp byte [ebx], 4
jne 0x42f7c2
mov eax, dword [esp + 0x178]
mov dword [esp + 0x1c], eax
jmp 0x42f7dc
mov eax, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
cmp al, 4
jne 0x42fb93
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x140]
lea ebx, [esp + 0x174]
mov edx, edi
mov ecx, ebx
push eax
push 0xfffffffffffffff5
call fcn.00431138
pop eax
pop ecx
cmp byte [ebx], 4
jne 0x42f806
mov edi, dword [esp + 0x178]
jmp 0x42f81c
mov eax, dword [esp + 0x174]
mov edi, dword [esp + 0x178]
cmp al, 4
jne 0x42fba8
lea eax, [esp + 0x148]
lea ebx, [esp + 0x174]
mov edx, esi
mov ecx, ebx
push eax
push 0xfffffffffffffff4
call fcn.00431138
pop eax
pop ecx
cmp byte [ebx], 4
jne 0x42f846
mov edx, dword [esp + 0x178]
jmp 0x42f85c
mov eax, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
cmp al, 4
jne 0x42fbda
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
and dword [esp + 0xcc], 0
xorps xmm0, xmm0
test edx, edx
movups xmmword [esp + 0xbc], xmm0
movups xmmword [esp + 0xac], xmm0
movups xmmword [esp + 0x9c], xmm0
movups xmmword [esp + 0x8c], xmm0
jne 0x42f89b
test edi, edi
jne 0x42f89b
test eax, eax
je 0x42f8bb
mov dword [esp + 0xb8], 0x100
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], edi
mov dword [esp + 0xcc], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x128], edx
mov dword [esp + 0xf4], edi
mov ebx, dword [eax + 0x60]
test ebx, ebx
je 0x42fbbd
lea edi, [esp + 0xd0]
mov dword [esp + 0x8c], 0x48
and dword [edi], 0
push edi
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [edi]
test esi, esi
je 0x42fc10
js 0x42fc50
mov ecx, esi
mov edx, esi
not ecx
shr ecx, 0x1f
call fcn.00428c89
test eax, eax
mov dword [esp], eax
je 0x42fc50
mov eax, esi
jmp 0x42fc18
movzx edx, word [eax - 6]
or edx, 0x20
cmp edx, 0x61
jne 0x42f941
movzx edx, word [eax - 4]
or edx, 0x20
cmp edx, 0x74
je 0x42f96b
cmp cx, 0x43
jne 0x42f27a
movzx ecx, word [eax - 6]
or ecx, 0x20
cmp ecx, 0x6d
jne 0x42f27a
movzx eax, word [eax - 4]
or eax, 0x20
cmp eax, 0x64
jne 0x42f27a
mov dword [esp + 0xe8], esi
push 2
pop eax
lea ecx, [esp + 0x5c]
mov ebp, 0x200
mov dword [esp + 0xc], eax
mov dword [esp], 0
and dword [ecx], 0
mov dword [ecx + 4], 2
and dword [ecx + 8], 0
cmp ebp, 0x201
jae 0x42f9b2
lea esi, [esp + 0x174]
mov dword [esp + 4], 0x200
mov ebx, ebp
jmp 0x42f9d7
sub ebp, dword [esp]
lea ecx, [esp + 0x5c]
mov edx, ebp
call fcn.00429c1d
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
mov dword [esp + 0x64], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
test eax, eax
jne 0x42f9fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42fbef
cmp ebp, ebx
jne 0x42fa20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42fc50
lea ebp, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs ebp, eax
jmp 0x42f997
ja 0x42f997
cmp ebp, dword [esp + 4]
ja 0x42fc50
lea ebx, [esp + 0x8c]
mov edx, esi
mov ecx, ebx
push ebp
call fcn.0042c5ea
pop eax
mov eax, ebx
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov esi, dword [ebx]
mov ebx, dword [ebx + 4]
mov ebp, dword [eax + 8]
call fcn.00429576
cmp esi, 0x80000000
je 0x42fc69
lea eax, [esp + 0x34]
lea edx, [esp + 0x184]
lea ecx, [0x454f9e]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebp
xor eax, eax
inc eax
mov dword [edx - 0x10], eax
and dword [edx - 0xc], 0
mov dword [edx - 8], eax
mov eax, 0x454f96
and word [edx - 4], 0
mov dword [edx], eax
mov dword [edx + 4], ecx
and word [edx + 8], 0
test eax, eax
je 0x42fabf
lea ecx, [esp + 0x184]
call fcn.00428ebc
test ax, ax
je 0x42fab7
mov esi, edx
jmp 0x42faf1
and dword [esp + 0x184], 0
cmp dword [esp + 0x174], 0
je 0x42fc52
mov eax, dword [esp + 0x178]
cmp dword [esp + 0x17c], eax
je 0x42fc52
inc eax
mov dword [esp + 0x178], eax
movzx esi, word [esp + 0x180]
cmp ebp, dword [esp + 0x34]
jne 0x42fb7e
mov edx, dword [esp + 0x184]
mov ecx, dword [esp + 0x174]
test edx, edx
je 0x42fb54
mov eax, dword [esp + 0x188]
sub eax, edx
movzx edx, word [esp + 0x18c]
add eax, 2
mov word [esp], dx
xor edx, edx
push 3
pop ebx
div ebx
cmp word [esp], 1
mov edx, eax
sbb edx, 0xffffffff
test ecx, ecx
je 0x42fb6a
mov eax, dword [esp + 0x17c]
sub eax, dword [esp + 0x178]
add edx, eax
mov eax, 0xffffffff
cmovb edx, eax
jmp 0x42fb6d
test ecx, ecx
je 0x42fb68
mov edx, dword [esp + 0x17c]
sub edx, dword [esp + 0x178]
jmp 0x42fb6a
xor edx, edx
xor eax, eax
dec eax
inc edx
lea ecx, [esp + 0x34]
cmove edx, eax
call fcn.00428d0a
mov ebx, dword [esp + 0x38]
mov word [ebx + ebp*2], si
inc ebp
mov eax, dword [esp + 0x184]
mov dword [esp + 0x3c], ebp
jmp 0x42fa9e
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov dword [ecx], eax
mov dword [ecx + 8], 2
jmp 0x42ff93
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], edi
mov dword [ecx], eax
mov dword [ecx + 8], 2
jmp 0x42ff88
mov edx, dword [esp + 0xe8]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x8c]
mov dword [ebx], 0x44
jmp 0x42fdf9
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov dword [ecx], eax
mov dword [ecx + 8], 2
jmp 0x42ff81
lea esi, [esp + 0x8c]
mov ecx, esi
call fcn.00429caa
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
call fcn.00429576
jmp 0x42fc69
xor eax, eax
inc eax
mov dword [esp], eax
xor eax, eax
cmp esi, 1
mov ecx, esi
adc ecx, 0
test esi, esi
cmove ecx, esi
cmp eax, ecx
mov dword [esp + 0xe0], ecx
jbe 0x42fc98
test esi, esi
je 0x42fc86
mov ecx, dword [esp]
mov edx, eax
push dword [esp + 0xe0]
push 1
call fcn.004128f0
pop ecx
pop edx
test eax, eax
mov dword [esp], eax
jne 0x42fc98
ud2
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
cmp eax, 0x80000000
jne 0x430036
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov dword [eax + 8], 2
jmp 0x42f5cd
mov ecx, dword [esp]
xor esi, esi
inc esi
mov edx, esi
push eax
call fcn.004012f6
pop eax
mov dword [esp], esi
push edi
push 0
push ebx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea esi, [esp + 0x34]
mov edx, eax
mov ecx, esi
call fcn.0042a61d
cmp byte [esi], 4
je 0x42fcc3
cmp byte [esp + 0x34], 4
jne 0x42ff46
mov ecx, dword [esp + 0x10]
mov edi, ebx
mov dword [esp + 0x124], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 0x58]
mov esi, dword [ecx + 0x5c]
xor ecx, ecx
test eax, eax
setne cl
cmove edi, eax
xor ebp, ebp
mov dword [esp + 4], ecx
test ebx, ebx
je 0x42fdc2
test edi, edi
je 0x42fdc2
cmp dword [esp + 4], 0
je 0x42fc50
test ebp, ebp
jne 0x42fd23
mov ebp, eax
sub esi, 1
jb 0x42fd18
mov ebp, dword [ebp + 0xb8]
jmp 0x42fd0b
xor esi, esi
xor eax, eax
inc eax
mov dword [esp + 4], eax
xor eax, eax
dec ebx
dec edi
mov edx, esi
mov ecx, ebp
movzx esi, word [ecx + 0xb6]
cmp edx, esi
jb 0x42fd4a
mov esi, dword [ecx]
test esi, esi
je 0x42fc50
movzx edx, word [ecx + 0xb4]
inc eax
mov ecx, esi
jmp 0x42fd29
test eax, eax
je 0x42fd64
lea esi, [ecx + edx*4 + 0xbc]
mov ebp, dword [esi]
dec eax
lea esi, [ebp + 0xb8]
jne 0x42fd55
xor esi, esi
jmp 0x42fd69
lea esi, [edx + 1]
mov ebp, ecx
imul eax, edx, 0xc
push 0
push 0
push dword [ecx + eax + 0x38]
push dword [ecx + eax + 0x30]
push dword [ecx + edx*4 + 4]
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea ecx, [esp + 0x34]
mov edx, eax
call fcn.0042a61d
cmp byte [esp + 0x34], 4
jne 0x42fda1
xor eax, eax
jmp 0x42fcea
xor eax, eax
cmp byte [esp + 0x34], 4
je 0x42fcea
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x124]
jmp 0x42ff4e
mov edx, dword [esp + 0xe8]
or edx, 0x80000
push 0x11
pop ecx
lea ebx, [esp + 0x174]
lea esi, [esp + 0x8c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov ebp, dword [esp + 0x124]
mov dword [esp + 0x1b8], eax
mov esi, dword [esp + 0x10c]
lea eax, [esp + 0x5c]
push eax
push ebx
push dword [esp + 0x134]
push dword [esp + 0x104]
push edx
push 1
push 0
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea edi, [esp + 0x34]
mov edx, eax
mov ecx, edi
call fcn.0042a61d
cmp byte [edi], 4
jne 0x42fe3b
mov edx, dword [esp + 0x10]
jmp 0x42fe52
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0xf4]
mov edx, dword [esp + 0x10]
cmp al, 4
jne 0x42ff1d
test edx, edx
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
movsd xmm1, qword [esp + 0x140]
movsd xmm0, qword [esp + 0x138]
mov dword [edx], eax
mov dword [edx + 4], ecx
movsd qword [edx + 0x10], xmm1
movsd xmm1, qword [esp + 0x148]
movsd qword [edx + 8], xmm0
movsd qword [edx + 0x18], xmm1
je 0x42fea7
mov ecx, dword [esp]
mov edx, dword [esp + 0xe0]
call fcn.00431570
mov esi, dword [esp + 0x10c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x128]
call edi
push dword [esp + 0xf4]
call edi
push dword [esp + 0x1c]
call edi
push 2
pop ecx
call fcn.00431590
mov ecx, 0x457be0
call fcn.0042cc83
mov edx, dword [esp + 0x24]
mov ecx, ebp
call fcn.00429576
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
call fcn.00429576
mov ecx, dword [esp + 0x108]
mov edx, esi
call fcn.00429576
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
call fcn.00429576
cmp byte [esp + 0xe4], 0
jne 0x42e90f
jmp 0x430024
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
test edx, edx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 2
je 0x42ff74
mov ecx, dword [esp]
mov edx, dword [esp + 0xe0]
call fcn.00431570
jmp 0x42ff74
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ecx, dword [esp]
mov edx, dword [esp + 0xe0]
call fcn.00431570
mov eax, dword [esp + 0x18]
mov dword [eax + 4], edi
mov edi, dword [esp + 0xf4]
mov dword [eax], esi
mov dword [eax + 8], 2
push dword [esp + 0x128]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
pop ecx
call fcn.00431590
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
call fcn.0043159d
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
call fcn.0043159d
mov ecx, dword [esp + 0x148]
mov edx, dword [esp + 0x14c]
call fcn.0043159d
mov ecx, 0x457be0
call fcn.0042cc83
mov edx, dword [esp + 0x24]
mov ecx, ebp
call fcn.00429576
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
call fcn.00429576
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x10c]
call fcn.00429576
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
call fcn.00429576
cmp byte [esp + 0x88], 0
je 0x42e90f
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
call fcn.00429576
jmp 0x42e90f
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 0x2c]
mov dword [esp], eax
mov eax, dword [ecx + 0x30]
mov dword [esp + 0xf8], eax
mov al, byte [ecx + 0x65]
lea ecx, [esp + 0x5c]
test al, al
mov byte [esp + 0xe4], al
mov eax, str.cmd.exe__d__c__
mov dword [ecx], eax
lea eax, [0x454e1f]
setne byte [esp + 0x88]
mov dword [ecx + 4], eax
and word [ecx + 8], 0
call fcn.00428ebc
test ax, ax
je 0x430182
mov eax, dword [esp + 0x60]
movzx ecx, word [esp + 0x64]
mov ebp, edx
xor edx, edx
sub eax, dword [esp + 0x5c]
add eax, 2
push 3
pop esi
div esi
cmp cx, 1
sbb eax, 0xffffffff
cmp eax, 4
cmovb eax, esi
lea esi, [esp + 0x174]
lea edx, [eax + 1]
mov ecx, esi
call fcn.00428cd6
mov eax, dword [esi + 4]
mov word [eax], bp
lea eax, [esp + 0x8c]
movsd xmm0, qword [esi]
mov ecx, dword [esp + 0x64]
mov dword [eax + 8], 1
movsd qword [eax], xmm0
movsd xmm0, qword [esp + 0x5c]
mov dword [esi + 8], ecx
movsd qword [esi], xmm0
mov ecx, esi
call fcn.00428ebc
cmp ax, 1
jne 0x430166
mov ebx, dword [esp + 0x94]
mov ebp, edx
cmp ebx, dword [esp + 0x8c]
jne 0x430151
mov eax, dword [esp + 0x178]
movzx ecx, word [esp + 0x17c]
xor edx, edx
sub eax, dword [esp + 0x174]
mov word [esp + 4], cx
mov ecx, esi
add eax, 2
push 3
pop esi
div esi
cmp word [esp + 4], 1
mov esi, ecx
lea ecx, [esp + 0x8c]
sbb eax, 0xffffffff
lea edx, [eax + 1]
call fcn.00428d0a
mov eax, dword [esp + 0x90]
mov word [eax + ebx*2], bp
inc ebx
mov dword [esp + 0x94], ebx
jmp 0x4300f1
movsd xmm0, qword [esp + 0x8c]
mov eax, dword [esp + 0x94]
movsd qword [esp + 0x34], xmm0
mov dword [esp + 0x3c], eax
jmp 0x430194
and dword [esp + 0x34], 0
mov dword [esp + 0x38], 2
and dword [esp + 0x3c], 0
lea ecx, [esp + 0x34]
push 0x22
pop edx
call fcn.0042d0d6
mov ebx, dword [esp + 0xe8]
lea eax, [edi + edi]
xor ecx, ecx
cmp eax, ecx
je 0x4301bc
cmp word [ebx + ecx], 0x22
lea ecx, [ecx + 2]
jne 0x4301ac
jmp 0x4301c4
cmp word [ebx + edi*2 - 2], 0x5c
jne 0x4301fb
mov esi, 0x454e58
push 2
pop ebx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00429576
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
call fcn.00429576
jmp 0x42f5c5
xor edx, edx
lea esi, [edi - 1]
lea ecx, [ebx + edi*2 - 2]
inc edx
push 1
push 0x454e20
call fcn.0042ab1f
pop ecx
pop edx
xor edx, edx
test al, al
cmovne edx, ebx
test edx, edx
cmove edx, ebx
cmove esi, edi
lea eax, [edx + esi*2]
lea esi, [esp + 0x34]
mov ecx, esi
push eax
call fcn.00429531
pop eax
push 0x22
pop edx
mov ecx, esi
call fcn.0042d0d6
imul eax, dword [esp + 0xf8], 0x14
add eax, dword [esp]
mov dword [esp + 4], eax
push 0x16
pop ebp
mov eax, dword [esp + 4]
cmp dword [esp], eax
je 0x4302fa
mov ecx, esi
push 0x20
pop edx
call fcn.0042d0d6
cmp byte [esp + 0xe4], 0
mov bl, byte [esp + 0x88]
jne 0x4302ac
mov eax, dword [esp]
mov bl, byte [esp + 0x88]
cmp dword [eax], 0
jne 0x4302ac
mov eax, dword [esp]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
test edi, edi
setne bl
je 0x4302ac
movzx eax, byte [esi]
inc esi
mov ecx, str._t_____________
mov edx, ebp
push eax
call fcn.0042e0f5
pop ecx
dec edi
test al, al
je 0x43028e
lea esi, [esp + 0x34]
movzx eax, bl
lea ecx, [esp + 0x174]
mov edx, esi
push eax
mov eax, dword [esp + 4]
push eax
add eax, 0x14
mov dword [esp + 8], eax
call fcn.00430e79
pop eax
pop ecx
cmp byte [esp + 0x174], 4
je 0x43024e
mov ebx, dword [esp + 0x174]
cmp bl, 4
je 0x43024e
mov esi, dword [esp + 0x178]
jmp 0x4301cc
lea esi, [esp + 0x34]
push 0x22
pop edx
mov ecx, esi
call fcn.0042d0d6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, 0x80000000
je 0x4301d9
mov cl, 1
mov dword [esp + 0xe4], 0
mov dword [esp + 0x88], ecx
jmp 0x42f36b
lea ecx, [esp + 0x174]
call fcn.00429caa
ud2