Function at 0x42694d
Capabilities:
Create process on windows
Encode data using base64
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x540
mov esi, esp
mov dword [esi + 0x528], ebp
lea eax, [esi + 0x530]
mov dword [esi + 0x50], ecx
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x42a450
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, edx
mov edx, edi
mov dword fs:[0], eax
call fcn.00419cb0
test al, al
mov dword [esi + 0x1c], ebx
je 0x426d43
mov edx, ebx
lea ebx, [esi + 0x100]
mov ecx, ebx
push edi
call fcn.00422ae0
add esp, 4
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov dword [esi + 8], eax
mov dword [esi], ecx
xor eax, eax
lea ebx, [esi + 0x128]
xor ecx, ecx
mov edx, 0x44018d
inc eax
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov byte [ebx + 0xc], 1
mov ecx, ebx
push eax
call fcn.0041d930
add esp, 4
mov ecx, ebx
mov edx, edi
push dword [esi]
call fcn.0041d930
add esp, 4
cmp dword [esi + 8], 0
je 0x426a08
mov ecx, edi
call fcn.0042627a
lea ebx, [esi + 0x128]
mov edx, 0x44018e
mov ecx, ebx
push 9
call fcn.0041d930
add esp, 4
mov eax, dword [ebx]
mov ecx, dword [esi + 0x1c]
mov edx, dword [ebp + 8]
mov dword [esi + 0xc4], 0x440197
lea edi, [esi + 0x94]
xorps xmm0, xmm0
movaps xmmword [esi + 0x70], xmm0
mov dword [esi + 0x58], eax
mov eax, 0xd
add edx, ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], 0x4401a4
mov dword [esi + 0xd0], eax
xor eax, eax
inc eax
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 4]
mov dword [ebx], 0x44
add edx, dword [esi + 0x58]
mov dword [esi + 0x8c], ecx
mov ecx, edi
xor edi, edi
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x3c], edi
mov ebx, ecx
mov word [ecx + 0xc], di
lea ecx, [esi + 0x110]
mov dword [esi], edx
mov edx, ebx
call fcn.0042848b
mov edx, dword [esi + 0x58]
mov ecx, dword [esi]
xor eax, eax
inc eax
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
lea ecx, [esi + 0x11c]
lea edx, [esi + 0x94]
mov word [ebx + 0xc], di
call fcn.0042848b
cmp dword [ebp + 0x18], 0
je 0x426f0f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x426f21
mov edi, eax
xor ecx, ecx
cmp ecx, 0x7fffffff
je 0x427b03
xor eax, eax
cmp word [edi + ecx*2], 0
jne 0x426b28
xor eax, eax
cmp word [edi + ecx*2 + 2], 0
sete al
inc ecx
test eax, eax
je 0x426b08
xor edx, edx
mov ebx, ecx
call fcn.00429064
lea ecx, [esi + 0x38]
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, ebx
mov dword [ecx + 8], 0
mov eax, dword [esi + 0xc]
mov dword [esi], eax
mov eax, edx
sub eax, 1
jb 0x426bf0
inc eax
mov dword [esi + 4], edx
add edx, edx
mov ecx, 0xfffffffe
mov dword [esi + 8], eax
xor eax, eax
mov edi, dword [esi]
movzx ebx, word [edi + eax*2]
test bx, bx
je 0x426b8f
lea edi, [edx + ecx - 2]
inc eax
add ecx, 0xfffffffe
cmp edi, 0xfffffffe
jne 0x426b6d
mov edi, dword [esi]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], edi
jmp 0x426b9f
mov edi, dword [esi]
mov edx, eax
not edx
add dword [esi + 4], edx
mov edx, edi
sub edx, ecx
mov dword [esi + 0xc], edx
mov edx, dword [esi + 4]
test edi, edi
lea edi, [esi + 0x38]
je 0x426bf0
test eax, eax
je 0x426be7
mov ecx, dword [esi]
cmp word [ecx], 0x3d
je 0x426be7
mov dword [esi + 4], edx
mov edx, dword [esi]
mov ecx, edi
push eax
call fcn.00428443
add esp, 4
mov edx, dword [esi + 0x40]
cmp edx, dword [esi + 0x3c]
jne 0x426bd7
mov ecx, edi
call fcn.0042914f
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
mov word [eax + edx*2], 0
inc edx
mov dword [esi + 0x40], edx
mov edx, dword [esi + 4]
test bx, bx
je 0x426b4d
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
shl eax, 4
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi + 0x94], 1
lea edx, [esi + 0x94]
add ecx, eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ecx
lea ecx, [esi + 0xb8]
mov word [esi + 0xa0], 0
call fcn.0042848b
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x427a5f
mov edx, dword [esi + 0xb8]
lea edi, [esi + 0x38]
dec eax
mov ecx, edi
mov dword [esi + 4], edx
push eax
call fcn.00428443
add esp, 4
mov edx, dword [esi + 0x40]
cmp edx, dword [esi + 0x3c]
jne 0x426c6d
mov ecx, edi
call fcn.0042914f
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
mov word [eax + edx*2], 0x3d
inc edx
mov dword [esi + 0x94], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x40], edx
lea edx, [esi + 0x94]
add ecx, eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ecx
lea ecx, [esi + 0x5c]
mov word [esi + 0xa0], 0
call fcn.0042848b
mov eax, dword [esi + 0x64]
test eax, eax
je 0x427a70
mov dword [esi], ebx
mov ebx, dword [esi + 0x5c]
dec eax
lea ecx, [esi + 0x38]
mov edx, ebx
push eax
call fcn.00428443
add esp, 4
mov edi, dword [esi + 0x40]
cmp edi, dword [esi + 0x3c]
jne 0x426ce3
lea ecx, [esi + 0x38]
mov edx, edi
call fcn.0042914f
mov edi, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
mov word [eax + edi*2], 0
inc edi
mov dword [esi + 0xc], eax
cmp dword [esi + 0x60], 0
mov dword [esi + 0x40], edi
je 0x426d00
mov ecx, ebx
call fcn.0042627a
cmp dword [esi + 0xbc], 0
je 0x426d11
mov ecx, dword [esi + 4]
call fcn.0042627a
mov ebx, dword [esi]
add ebx, 0x10
cmp ebx, dword [esi + 8]
jne 0x426bfe
mov eax, dword [esi + 0x3c]
cmp edi, eax
jne 0x426fa1
lea ebx, [esi + 0x38]
mov edx, edi
mov ecx, ebx
call fcn.0042914f
mov eax, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, dword [ebx]
jmp 0x426fa4
lea edi, [esi + 0xc4]
mov ecx, edi
call fcn.004192c0
cmp byte [edi + 0xc], 2
mov eax, dword [edi + 4]
mov dword [esi + 0x18], eax
jne 0x426d6c
mov eax, dword [esi + 0xc4]
mov ebx, eax
shr ebx, 8
jmp 0x4276cc
mov edx, dword [esi + 0xc4]
lea edi, [esi + 0xd4]
mov ecx, edi
mov dword [esi + 0x28], edx
push dword [ebp + 8]
push ebx
push dword [esi + 0xcc]
call fcn.00420070
add esp, 0xc
mov edx, dword [edi]
mov eax, dword [edi + 8]
movaps xmm0, xmmword [0x43a3e0]
lea edi, [esi + 0x94]
xor ecx, ecx
lea ebx, [esi + 0x128]
mov dword [edi + 0x1c], ecx
mov word [edi + 0x20], 0
mov dword [edi + 0x10], 7
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov ecx, ebx
movups xmmword [edi], xmm0
mov dword [esi + 0x20], edx
push edi
push eax
call fcn.0041db10
add esp, 8
mov al, byte [ebx]
cmp al, 4
jne 0x426f7e
mov eax, dword [esi + 0x12c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov edi, 0x200
xor ebx, ebx
mov dword [esi + 0x14], 2
mov dword [esi + 8], 0
mov dword [edx], 2
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [esi + 0xc], eax
cmp edi, 0x201
jae 0x426e26
lea eax, [esi + 0x128]
mov dword [esi + 4], ebx
mov dword [esi + 0x10], 0x200
mov ebx, edi
jmp 0x426e61
mov eax, dword [esi + 8]
sub edi, ebx
sub eax, ebx
cmp eax, edi
jae 0x426e52
mov dword [esi + 0x538], 0
lea ecx, [esi + 0x5c]
mov edx, ebx
push edi
call fcn.004397d0
add esp, 4
mov eax, dword [esi + 0x5c]
mov ebx, dword [esi + 0x60]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x64], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov dword [esi], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
push dword [esi]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
test eax, eax
jne 0x426e8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x427656
cmp edi, ebx
jne 0x426eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x427b17
lea edi, [ebx + ebx]
test ebx, ebx
mov ebx, dword [esi + 4]
mov eax, 0xffffffff
cmovs edi, eax
jmp 0x426e0a
mov ebx, dword [esi + 4]
ja 0x426e0a
mov edx, dword [esi + 0x10]
mov dword [esi + 0x538], 0
cmp edi, edx
ja 0x427b62
mov edx, dword [esi]
lea ecx, [esi + 0x70]
push edi
call fcn.00419ae0
add esp, 4
mov cl, byte [esi + 0x7f]
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x74]
movzx edx, word [esi + 0x7d]
mov edi, dword [esi + 0x78]
mov byte [esi + 0xba], cl
mov cl, byte [esi + 0x7c]
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
shr ebx, 8
mov word [esi + 0xb8], dx
jmp 0x427668
lea ebx, [esi + 0x128]
mov dword [esi + 0xc], 0
jmp 0x426fbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x20
xor edx, edx
mov edi, eax
call fcn.00429029
mov dword [esi], edx
push 0x20
push 0x440696
mov dword [esi + 4], eax
push eax
call fcn.0042b110
add esp, 0xc
cmp dword [esi + 0x120], 0
je 0x426f5e
mov ecx, dword [esi + 0x11c]
call fcn.0042627a
cmp dword [esi + 0x114], 0
je 0x426f72
mov ecx, dword [esi + 0x110]
call fcn.0042627a
mov edx, 0x20
xor ebx, ebx
jmp 0x427128
mov dword [esi + 0x10], eax
movzx eax, byte [esi + 0x12b]
movzx ebx, word [esi + 0x129]
mov dl, 2
shl eax, 0x10
or ebx, eax
mov eax, dword [esi + 0x12c]
jmp 0x42768b
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], eax
mov dword [esi + 0xc], ecx
mov word [ecx + edi*2], 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ebx, [esi + 0x128]
mov edi, dword [esi + 0x11c]
mov edx, dword [esi + 0x110]
lea eax, [esi + 0x70]
xor ecx, ecx
push eax
push ebx
push ecx
push dword [esi + 0xc]
push 0x401
push ecx
push ecx
push ecx
mov dword [esi + 0x1c], edi
push edi
mov dword [esi + 0x14], edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42700f
mov eax, dword [esi + 0x70]
mov edx, dword [esi + 0x74]
mov dword [esi + 4], 2
mov dword [esi], eax
lea eax, [esi + 0xc4]
mov dword [esi + 8], eax
mov al, 5
mov dword [esi + 0x10], eax
jmp 0x427045
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x18
xor edx, edx
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0
call fcn.00429029
mov dword [esi], edx
push 0x18
push 0x44067e
mov dword [esi + 4], eax
push eax
call fcn.0042b110
mov edx, 0x18
add esp, 0xc
cmp dword [esi + 0xc], 0
mov ebx, edx
je 0x42705d
cmp dword [esi + 0x18], 0
je 0x42705d
mov ecx, dword [esi + 0xc]
call fcn.0042627a
mov edx, ebx
cmp dword [esi + 0x120], 0
je 0x427070
mov ecx, dword [esi + 0x1c]
call fcn.0042627a
mov edx, ebx
cmp dword [esi + 0x114], 0
mov edi, dword [esi + 8]
je 0x427086
mov ecx, dword [esi + 0x14]
call fcn.0042627a
mov edx, ebx
mov ebx, dword [esi + 0x10]
cmp bl, 5
jne 0x427128
mov eax, dword [esi + 4]
mov dword [esi + 0xd4], edi
mov ecx, 0x10
mov dword [esi + 0xd8], eax
mov eax, dword [esi]
mov dword [esi + 0xdc], eax
mov dword [esi + 0xe0], edx
call fcn.004261ac
test eax, eax
je 0x427b51
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov dword [esi + 0x48], eax
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], 0x4401b1
mov dword [eax + 0xc], 0xa
mov dword [esi + 0x94], eax
mov eax, 1
test dl, dl
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
je 0x427151
lea edi, [esi + 0x128]
mov edx, 0x4401bb
mov ecx, edi
push 0x10
call fcn.0041b500
add esp, 4
mov al, byte [edi + 0xc]
cmp al, 2
jne 0x427160
xor eax, eax
mov dword [esi + 4], 0
inc eax
jmp 0x42773d
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 4]
mov byte [eax + 3], 0
mov word [eax + 1], 0
mov dword [eax + 4], edi
mov edi, dword [esi]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edx
mov byte [eax], bl
mov byte [eax + 0x14], 2
jmp 0x427a20
mov ebx, dword [esi + 0x48]
mov dword [esi + 4], 0
jmp 0x427743
mov ecx, dword [esi + 0x128]
mov edi, dword [esi + 0x12c]
mov edx, dword [esi + 0x130]
test al, al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x2c], edx
jne 0x4271eb
cmp dword [esi + 0x2c], 0
je 0x4271eb
mov edi, dword [esi + 0x34]
mov ecx, dword [esi + 0x2c]
add ecx, edi
mov ah, byte [edi]
lea edx, [edi + 1]
test ah, ah
jns 0x4271e5
cmp ah, 0xe0
jae 0x4271a5
add edi, 2
cmp edx, ecx
cmovne edx, edi
jmp 0x4271e5
cmp ah, 0xed
jne 0x4271c6
cmp edx, ecx
je 0x4271eb
lea edx, [edi + 2]
cmp edx, ecx
je 0x4271eb
cmp byte [edi + 1], 0x9f
ja 0x427acc
add edi, 3
mov edx, edi
jmp 0x4271e5
add edi, 2
cmp edx, ecx
cmove edi, edx
xor edx, edx
cmp edi, ecx
setne dl
add edx, edi
cmp ah, 0xf0
jb 0x4271e5
xor ebx, ebx
cmp edx, ecx
setne bl
add edx, ebx
cmp edx, ecx
mov edi, edx
jne 0x42718d
mov edx, dword [esi + 0x34]
lea ebx, [esi + 0x128]
mov ecx, ebx
push 1
push 0x4401cb
push dword [esi + 0x2c]
call fcn.00407220
add esp, 0xc
mov edi, dword [ebx + 0x1c]
mov eax, dword [ebx]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
mov dword [esi + 8], edi
mov edi, dword [ebx + 0x24]
mov dword [esi + 0xf8], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x6c], edx
mov edx, dword [ebx + 0x18]
mov dword [esi + 0x1c], edi
mov edi, dword [ebx + 0x30]
mov dword [esi + 0xfc], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xe8], edx
mov dword [esi + 0x10], edi
mov edi, dword [ebx + 0x34]
mov dword [esi + 0x18], eax
mov dword [esi + 0xc], edi
mov edi, dword [ebx + 0x38]
mov dword [esi + 4], edi
mov edi, dword [ebx + 0x3c]
mov ebx, eax
shr ebx, 0x10
mov dword [esi + 0x54], ebx
mov ebx, eax
and eax, 0xff00ff00
mov dword [esi + 0xec], eax
mov eax, dword [esi + 0x6c]
mov ebx, edi
mov dword [esi + 0x14], edi
sub ebx, edx
mov dword [esi + 0xe4], ebx
neg eax
mov dword [esi + 0xf0], eax
mov eax, edi
lea eax, [edi - 1]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x90], eax
xor eax, eax
xor edx, edx
inc eax
cmp dword [esi + 0xf8], 0
mov dword [esi + 0x44], edx
je 0x427416
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x90]
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0x10]
add eax, ebx
cmp eax, edi
jae 0x427431
mov dword [esi + 0x28], ecx
movzx ecx, byte [esi + 0x54]
mov edi, dword [esi + 0x1c]
shl ecx, 0x10
mov dword [esi + 0x68], edi
mov dword [esi + 0x20], edi
mov dword [esi], ecx
movzx ecx, byte [esi + 0x18]
or ecx, dword [esi + 0xec]
or ecx, dword [esi]
mov dword [esi + 0x24], ecx
mov cl, byte [edx + eax]
xor eax, eax
xor edi, edi
mov dword [esi], ebx
mov ebx, edx
inc edi
mov edx, edi
shld eax, edi, cl
shl edx, cl
test cl, 0x20
mov ecx, 0
cmovne eax, edx
cmovne edx, ecx
and eax, dword [esi + 0x24]
and edx, dword [esi + 0xfc]
or edx, eax
je 0x42737e
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x6c]
cmp eax, ecx
mov edx, ecx
mov ecx, dword [esi]
cmova edx, eax
cmp dword [esi + 0x1c], 0xffffffff
lea edi, [ebx + ecx]
mov ebx, ecx
cmove edx, eax
mov eax, dword [esi + 0x14]
mov dword [esi + 8], edi
mov ecx, edx
mov dword [esi + 0xf4], edx
cmp edx, eax
cmova eax, edx
cmp eax, ecx
je 0x427394
mov edx, dword [esi + 0xc]
lea edi, [ebx + ecx]
cmp edi, edx
jae 0x427964
mov edx, dword [esi + 4]
lea edi, [ecx + 1]
mov bl, byte [edx + ecx]
mov edx, dword [esi + 8]
cmp bl, byte [edx + ecx]
mov ebx, dword [esi]
mov ecx, edi
je 0x42733b
add ebx, dword [esi + 0xf0]
xor eax, eax
add ebx, edi
cmp dword [esi + 0x1c], 0xffffffff
je 0x42740e
mov edi, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
jmp 0x4273f3
mov ecx, dword [esi]
xor eax, eax
mov edi, dword [esi + 0xc]
mov edx, ebx
add ecx, dword [esi + 0x14]
cmp dword [esi + 0x1c], 0xffffffff
mov ebx, ecx
jne 0x4273f3
jmp 0x4273f9
cmp dword [esi + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x20]
mov eax, 0
mov edi, dword [esi + 0xc]
cmove ecx, eax
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0x6c]
cmp dword [esi + 8], ecx
jae 0x42744c
dec ecx
cmp ecx, dword [esi + 0x14]
jae 0x427a45
lea eax, [ecx + ebx]
cmp eax, edi
jae 0x427a4f
mov edx, edi
mov edi, dword [esi + 4]
mov bl, byte [edi + ecx]
mov edi, dword [esi + 0x10]
cmp bl, byte [edi + eax]
mov ebx, dword [esi]
mov edi, edx
je 0x4273ac
add ebx, dword [esi + 0xe8]
cmp dword [esi + 0x1c], 0xffffffff
mov eax, dword [esi + 0xe4]
mov edx, dword [esi + 0x10]
je 0x4273f9
mov dword [esi + 0x68], eax
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x90]
add eax, ebx
cmp eax, edi
jb 0x4272df
jmp 0x4275aa
mov edi, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
jmp 0x4273f9
cmp byte [esi + 0x54], 0
mov edx, dword [esi + 0x10]
je 0x427482
mov edi, dword [esi + 0x44]
mov ebx, dword [esi + 0x2c]
mov dword [esi + 0x20], 0
jmp 0x4275c6
mov dword [esi + 8], edi
mov edi, dword [esi + 0x44]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], edi
mov ebx, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
jmp 0x4275c9
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x68]
lea ebx, [ebx + eax]
mov eax, 0
cmovne ecx, eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
mov dword [esi + 8], ebx
mov bl, 1
mov edi, dword [esi + 0x44]
mov dword [esi + 0x20], ebx
mov ebx, dword [esi]
jmp 0x4275c9
mov ebx, dword [esi + 8]
mov dword [esi + 0x30], eax
test ecx, ecx
mov eax, edi
je 0x4274a5
mov eax, edi
sub eax, ecx
jbe 0x42749f
cmp byte [edx + ecx], 0xbf
jg 0x4274a5
jmp 0x427b3a
jne 0x427b3a
test eax, eax
je 0x42755e
mov dl, byte [edx + ecx]
movzx eax, dl
test dl, dl
jns 0x427518
mov ebx, dword [esi + 0x10]
and eax, 0x1f
movzx edi, byte [ebx + ecx + 1]
and edi, 0x3f
cmp dl, 0xdf
jbe 0x427500
mov dword [esi + 0x28], ecx
movzx ecx, byte [ebx + ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x42750a
mov edi, dword [esi + 0x28]
and eax, 7
shl ecx, 6
shl eax, 0x12
movzx edx, byte [ebx + edi + 3]
mov ebx, edi
mov edi, dword [esi + 0xc]
and edx, 0x3f
or edx, ecx
mov ecx, ebx
or eax, edx
jmp 0x427515
shl eax, 6
or eax, edi
mov edi, dword [esi + 0xc]
jmp 0x427515
shl eax, 0xc
mov edi, dword [esi + 0xc]
or eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0x18]
test dl, dl
jne 0x42757b
cmp eax, 0x110000
je 0x42758e
mov edx, ecx
cmp eax, 0x80
mov ecx, 1
jb 0x42754d
mov ecx, 2
cmp eax, 0x800
jb 0x42754d
cmp eax, 0x10000
mov ecx, 4
sbb ecx, 0
add edx, ecx
mov al, 1
mov ecx, edx
mov edx, dword [esi + 0x10]
mov dword [esi + 0x18], eax
jmp 0x427488
mov eax, dword [esi + 0x18]
test al, al
je 0x42763d
xor al, 1
mov dword [esi + 0x24], ecx
mov dword [esi], ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x30]
jmp 0x427470
mov eax, dword [esi + 0x30]
xor dl, 1
mov dword [esi + 0x24], ecx
mov dword [esi], ecx
mov dword [esi + 0x18], edx
jmp 0x42746d
mov al, 1
mov edi, dword [esi + 0x44]
mov ebx, dword [esi + 0x2c]
mov edx, dword [esi + 0x10]
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov al, 1
mov dword [esi + 0x54], eax
jmp 0x4275c3
mov eax, dword [esi + 0x68]
mov dword [esi + 8], edi
mov edi, dword [esi + 0x44]
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x24], edi
sub ebx, edi
cmp eax, dword [esi + 0x98]
lea edx, [edx + edi]
mov dword [esi + 0x28], ecx
jne 0x4275f8
mov edi, edx
lea ecx, [esi + 0x94]
mov edx, eax
call fcn.00425ef2
mov ecx, dword [esi + 0x94]
mov eax, dword [esi + 0x9c]
mov edx, edi
jmp 0x4275fb
mov ecx, dword [esi + 0x48]
shl eax, 4
mov edi, dword [esi + 0xc]
mov dword [esi + 0x48], ecx
mov dword [ecx + eax], edx
mov dword [ecx + eax + 4], ebx
mov dword [ecx + eax + 8], 0x4401b1
mov dword [ecx + eax + 0xc], 0xa
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x9c]
inc eax
cmp byte [esi + 0x20], 0
mov dword [esi + 0x9c], eax
jne 0x427292
jmp 0x427738
mov edi, dword [esi + 0x44]
mov al, 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov al, 1
mov dword [esi + 0x54], eax
jmp 0x42743e
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, 2
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov byte [esi + 4], cl
test eax, eax
je 0x42767a
mov ecx, dword [esi + 0x14]
call fcn.0042627a
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dl, byte [esi + 4]
mov ecx, edi
cmp dword [esi + 0xd8], 0
mov dword [esi], ecx
mov byte [esi + 4], dl
je 0x4276aa
mov ecx, dword [esi + 0x20]
mov edi, eax
call fcn.0042627a
mov dl, byte [esi + 4]
mov ecx, dword [esi]
mov eax, edi
cmp dword [esi + 0x18], 0
je 0x4276c1
mov ecx, dword [esi + 0x28]
mov edi, eax
call fcn.0042627a
mov dl, byte [esi + 4]
mov ecx, dword [esi]
mov eax, edi
cmp dl, 2
jne 0x4276f5
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
shl ebx, 8
movzx edi, al
mov edx, dword [esi + 0x1c]
or edi, ebx
mov ebx, dword [esi + 0x50]
lea ecx, [ebx + 8]
push dword [ebp + 8]
call fcn.00422ae0
add esp, 4
mov eax, dword [esi + 0x18]
mov dword [ebx], edi
mov dword [ebx + 4], eax
jmp 0x427a31
movzx edi, byte [esi + 0x10]
shl ebx, 8
mov dword [esi + 8], eax
or edi, ebx
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov byte [esi + 0x10c], dl
movzx edx, word [esi + 0xb8]
mov cl, byte [esi + 0xba]
mov word [esi + 0x10d], dx
mov byte [esi + 0x10f], cl
jmp 0x4269c6
mov cl, 1
mov dword [esi + 4], ecx
mov ebx, dword [esi + 0x94]
lea edi, [esi + 0x128]
lea edx, [esi + 0xd4]
mov ecx, edi
push eax
mov dword [esi + 0x48], ebx
push ebx
call fcn.00422cc8
add esp, 8
cmp byte [edi], 5
jne 0x427881
mov edi, dword [esi + 0x130]
mov eax, dword [esi + 0x134]
mov dword [esi], eax
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
call sub.KERNEL32.dll_DebugActiveProcessStop
push edi
call sub.KERNEL32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x4278bd
lea ebx, [esi + 0x128]
mov edx, edi
mov ecx, ebx
call fcn.00428983
mov dl, byte [ebx]
cmp dl, 5
jne 0x4278f7
xor edx, edx
mov ecx, 0xc
mov dword [esi + 0x5c], 0xc
inc edx
call fcn.00429029
xor edi, edi
mov dword [esi + 8], edx
mov ecx, 0xc
xor edx, edx
mov ebx, eax
add eax, edi
mov dword [esi + 0x128], edx
sub ecx, edi
push edx
lea edx, [esi + 0x128]
push edx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42792c
add edi, dword [esi + 0x128]
jb 0x427aef
cmp edi, 0xc
mov eax, ebx
mov dword [esi + 0x70], edi
jb 0x4277c9
mov edx, dword [esi]
lea ecx, [esi + 0x128]
call fcn.00428983
lea eax, [esi + 0x128]
mov dl, byte [eax]
cmp dl, 5
jne 0x42797b
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x4c]
cmp edi, 0xc
jne 0x427b73
mov eax, dword [ebx + 4]
mov edi, dword [ebx]
cmp dword [esi + 8], 0
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x14], eax
je 0x42785a
mov ecx, ebx
call fcn.0042627a
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x34]
test edi, edi
je 0x427a90
cmp edi, 1
je 0x427a89
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
cmp edi, 2
jne 0x427ac5
mov dl, 6
jmp 0x427ac7
mov eax, dword [esi + 0x138]
mov edi, dword [esi + 0x50]
movsd xmm0, qword [esi + 0x128]
movsd xmm1, qword [esi + 0x130]
mov dword [edi + 0x10], eax
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
push 1
push dword [esi + 0xdc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [edi + 0x14], 2
jmp 0x4279fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x15
xor edx, edx
mov edi, eax
mov dword [esi], 0x15
call fcn.00429029
mov ebx, eax
mov dword [esi + 0xc], edx
push 0x15
push 0x4408c7
push eax
call fcn.0042b110
xor edx, edx
mov ecx, edi
add esp, 0xc
xor edi, edi
jmp 0x4279ca
movzx eax, byte [esi + 0x12b]
movzx edi, word [esi + 0x129]
mov ecx, dword [esi + 0x12c]
mov ebx, dword [esi + 0x130]
shl eax, 0x10
or edi, eax
mov eax, dword [esi + 0x134]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x138]
mov dword [esi], eax
jmp 0x4279ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x28
xor edx, edx
mov edi, eax
mov dword [esi], 0x28
call fcn.00429029
mov dword [esi + 0xc], edx
push 0x28
push str.Error_while_reading_child_processs_pipe_
mov dword [esi + 0x10], eax
push eax
call fcn.0042b110
xor edx, edx
mov ecx, edi
add esp, 0xc
xor edi, edi
jmp 0x4279ae
mov ecx, dword [esi + 0xf4]
add ecx, ebx
cmp edx, ecx
cmova ecx, edx
push 0x43ff98
jmp 0x427a58
movzx eax, byte [esi + 0x12b]
movzx edi, word [esi + 0x129]
mov ecx, dword [esi + 0x12c]
shl eax, 0x10
or edi, eax
mov eax, dword [esi + 0x130]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x134]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x138]
mov dword [esi], eax
cmp dword [esi + 8], 0
je 0x4279c7
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 8], edx
call fcn.0042627a
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
shl edi, 8
movzx eax, dl
or eax, edi
mov edi, dword [esi + 0x50]
mov dword [edi], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 4], ecx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
mov eax, dword [esi]
mov dword [edi + 0x10], eax
push 1
push dword [esi + 0xdc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [edi + 0x14], 3
mov ebx, dword [esi + 4]
cmp dword [esi + 0x98], 0
mov ecx, dword [esi + 0x48]
je 0x427a0e
call fcn.0042627a
test bl, bl
je 0x427a20
cmp dword [esi + 0x4c], 0
je 0x427a20
mov ecx, dword [esi + 0x34]
call fcn.0042627a
cmp dword [esi + 0x8c], 0
je 0x427a31
mov ecx, dword [esi + 0x58]
call fcn.0042627a
mov eax, dword [esi + 0x530]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esi + 0x14]
push 0x43ffa8
jmp 0x427a58
mov ecx, eax
mov edx, edi
push 0x43ffb8
call fcn.00438ae0
jmp 0x427a84
mov ecx, str.attempt_to_subtract_with_overflow
mov edx, 0x21
push 0x4406b8
jmp 0x427a7f
mov ecx, str.attempt_to_subtract_with_overflow
mov edx, 0x21
push 0x4406f4
call fcn.00438c30
add esp, 4
ud2
mov dl, 5
jmp 0x4279c4
mov eax, dword [esi + 0x50]
cmp dword [esi + 0x98], 0
mov byte [eax + 0x14], 4
je 0x427aae
mov ecx, dword [esi + 0x48]
call fcn.0042627a
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x34]
cmp byte [esi + 4], 0
je 0x427a20
test edx, edx
jne 0x427a1b
jmp 0x427a20
mov dl, 7
jmp 0x4279ca
xor edi, edi
inc edi
cmp al, 2
je 0x427ae1
cmp dword [esi + 0x4c], 0
je 0x427ae1
mov ecx, dword [esi + 0x34]
call fcn.0042627a
mov eax, edi
mov dword [esi + 4], 0
jmp 0x42773d
mov ecx, str.attempt_to_add_with_overflow
mov edx, 0x1c
push 0x440868
jmp 0x427a7f
mov ecx, str.attempt_to_add_with_overflow
mov edx, 0x1c
push 0x440e18
jmp 0x427a7f
mov dword [esi + 0x538], 0
mov ecx, str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len__rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22library_alloc_src_string.rs
mov edx, 0x28
push 0x43f3e0
call fcn.00438c30
add esp, 4
jmp 0x427b71
mov eax, ecx
mov ecx, edx
mov edx, edi
push 0x43ffd8
push edi
push eax
call fcn.00438ff0
add esp, 0xc
ud2
mov ecx, 4
mov edx, 0x10
call fcn.004389b0
ud2
mov ecx, edi
push 0x43f3f0
call fcn.00438bc0
add esp, 4
ud2
mov dword [esi + 0x128], 0
lea ecx, [esi + 0x70]
lea edx, [esi + 0x5c]
push eax
call fcn.00439933
jmp 0x427a84