Function at 0x427b10
Capabilities:
Create directory
Create process on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45737d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
xor esi, esi
push esi
call fcn.0043cb47
add esp, 4
mov dword [esp + 0x1e0], 3
cmp dword [esp + 0x1fc], esi
jne 0x427c2e
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x200], edi
jb 0x427b92
mov eax, dword [esp + 0x1ec]
push eax
call fcn.0043c853
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x200], ebx
mov dword [esp + 0x1fc], esi
mov byte [esp + 0x1ec], 0
cmp dword [esp + 0x21c], edi
jb 0x427bc6
mov ecx, dword [esp + 0x208]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x218], esi
mov byte [esp + 0x208], 0
cmp dword [esp + 0x238], edi
jb 0x427bf5
mov edx, dword [esp + 0x224]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x238], ebx
mov dword [esp + 0x234], esi
mov byte [esp + 0x224], 0
cmp dword [esp + 0x254], edi
jb 0x427c24
mov eax, dword [esp + 0x240]
push eax
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
jmp 0x429025
cmp dword [esp + 0x218], esi
jne 0x427cf9
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x200], edi
jb 0x427c59
mov ecx, dword [esp + 0x1ec]
push ecx
call fcn.0043c853
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x200], ebx
mov dword [esp + 0x1fc], esi
mov byte [esp + 0x1ec], 0
cmp dword [esp + 0x21c], edi
jb 0x427c8d
mov edx, dword [esp + 0x208]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x218], esi
mov byte [esp + 0x208], 0
cmp dword [esp + 0x238], edi
jb 0x427cbc
mov eax, dword [esp + 0x224]
push eax
call fcn.0043c853
add esp, 4
cmp dword [esp + 0x254], edi
mov dword [esp + 0x238], ebx
mov dword [esp + 0x234], esi
mov byte [esp + 0x224], 0
jb 0x427c24
mov ecx, dword [esp + 0x240]
push ecx
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
jmp 0x429025
call fcn.00403c90
test eax, eax
je 0x427d0c
call fcn.00438a50
call fcn.00419cc0
cmp dword [esp + 0x234], esi
jne 0x427dd7
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x200], edi
jb 0x427d37
mov edx, dword [esp + 0x1ec]
push edx
call fcn.0043c853
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x200], ebx
mov dword [esp + 0x1fc], esi
mov byte [esp + 0x1ec], 0
cmp dword [esp + 0x21c], edi
jb 0x427d6b
mov eax, dword [esp + 0x208]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x218], esi
mov byte [esp + 0x208], 0
cmp dword [esp + 0x238], edi
jb 0x427d9a
mov ecx, dword [esp + 0x224]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x238], ebx
mov dword [esp + 0x234], esi
mov byte [esp + 0x224], 0
cmp dword [esp + 0x254], edi
jb 0x427c24
mov edx, dword [esp + 0x240]
push edx
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
jmp 0x429025
call fcn.004178d0
lea ebp, [edi + 0x2f0]
mov dword [esp + 0x1e0], 3
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
je 0x427e7a
jmp 0x427e10
cmp dword [esp + 0x200], 0x10
jb 0x427e27
mov ecx, dword [esp + 0x1ec]
mov dword [esp + 0x20], ecx
jmp 0x427e32
lea edx, [esp + 0x1ec]
mov dword [esp + 0x20], edx
push ebx
mov eax, ebp
call fcn.00429b80
cmp dword [eax + 0x18], 0x10
jb 0x427e45
mov eax, dword [eax + 4]
jmp 0x427e48
add eax, 4
mov ecx, dword [esp + 0x20]
push ecx
push eax
call fcn.0043cd92
add esp, 8
test eax, eax
je 0x427f88
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
jb 0x427e10
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
mov eax, 0xf
add ebx, edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x15c], eax
mov dword [esp + 0x158], esi
mov byte [esp + 0x148], 0
mov dword [esp + 0x178], eax
mov dword [esp + 0x174], esi
mov byte [esp + 0x164], 0
mov dword [esp + 0x194], eax
mov dword [esp + 0x190], esi
mov byte [esp + 0x180], 0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x1f0]
push ecx
lea ecx, [esp + 0x150]
mov byte [esp + 0x1ec], 8
call fcn.00402ea0
push esi
mov dword [esp + 0x19c], esi
call fcn.0043cb47
add esp, 4
push 0xffffffffffffffff
push esi
add edi, 0x260
push edi
lea ecx, [esp + 0x16c]
call fcn.00402ea0
mov eax, dword [esp + 0x174]
cmp eax, esi
je 0x427f69
lea edi, [eax - 1]
cmp eax, edi
ja 0x427f38
call fcn.0043b6d1
cmp dword [esp + 0x178], 0x10
mov eax, dword [esp + 0x164]
jae 0x427f50
lea eax, [esp + 0x164]
cmp byte [eax + edi], 0x5c
je 0x427f69
push 0x5c
mov eax, 1
lea edi, [esp + 0x164]
call fcn.00412820
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call edi
lea edx, [esp + 0x1c]
cmp eax, edx
jle 0x427f91
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x427f95
mov dword [esp + 0x20], ebx
jmp 0x428057
push 0xe
call edi
push 0
lea eax, [esp + 0x208]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x168]
mov dword [esp + 0x1e8], 8
call fcn.004031f0
mov eax, dword [esp + 0x174]
test eax, eax
je 0x428001
lea esi, [eax - 1]
cmp eax, esi
ja 0x427fd0
call fcn.0043b6d1
cmp dword [esp + 0x178], 0x10
mov eax, dword [esp + 0x164]
jae 0x427fe8
lea eax, [esp + 0x164]
cmp byte [esi + eax], 0x5c
je 0x428001
push 0x5c
mov eax, 1
lea edi, [esp + 0x164]
call fcn.00412820
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x168]
push ecx
lea ecx, [esp + 0x188]
call fcn.00402ea0
push 0
lea edx, [esp + 0x224]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x168]
call fcn.004031f0
lea eax, [esp + 0x144]
push eax
mov edi, ebp
call fcn.00429c20
lea esi, [esp + 0x144]
mov byte [esp + 0x1e0], 3
call fcn.00429050
xor esi, esi
push ebx
mov eax, ebp
call fcn.00429b80
cmp dword [eax + 0x54], 3
push ebx
mov eax, ebp
jbe 0x42822f
call fcn.00429b80
cmp dword [eax + 0x18], 0x10
jb 0x42807c
mov eax, dword [eax + 4]
jmp 0x42807f
add eax, 4
push eax
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
mov dword [esp + 0x40], esp
cmp eax, ebx
jb 0x4280b0
mov ecx, dword [edi]
jmp 0x4280b2
mov ecx, edi
cmp ecx, str.6WRUHX_W
ja 0x4280eb
cmp eax, ebx
jb 0x4280c2
mov ecx, dword [edi]
jmp 0x4280c4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.6WRUHX_W
jbe 0x4280eb
cmp eax, ebx
jb 0x4280d7
mov edi, dword [edi]
push 0x1b
mov eax, str.6WRUHX_W
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x42812d
cmp eax, 0x1b
jae 0x4280fd
mov ecx, dword [esi + 0x14]
push ecx
push 0x1b
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x428108
mov eax, dword [edi]
jmp 0x42810a
mov eax, edi
push 0x1b
push str.6WRUHX_W
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
mov dword [esi + 0x14], 0x1b
cmp dword [esi + 0x18], ebx
jb 0x428129
mov edi, dword [edi]
mov byte [edi + 0x1b], 0
lea esi, [esp + 0x168]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e8], 0xb
call fcn.00401db0
mov byte [esp + 0x1e4], 0xc
cmp dword [eax + 0x18], ebx
jb 0x42815a
mov eax, dword [eax + 4]
jmp 0x42815d
add eax, 4
mov edx, dword [esp + 0x1c]
push eax
push 1
push edx
call fcn.0041c440
add esp, 0x10
cmp dword [esp + 0x58], ebx
jb 0x428180
mov eax, dword [esp + 0x44]
push eax
call fcn.0043c853
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x144]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebp
mov byte [esp + 0x44], 0
call fcn.00429050
cmp dword [esp + 0x200], ebx
jb 0x4281b7
mov ecx, dword [esp + 0x1ec]
push ecx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x200], edi
mov dword [esp + 0x1fc], ebp
mov byte [esp + 0x1ec], 0
cmp dword [esp + 0x21c], ebx
jb 0x4281e6
mov edx, dword [esp + 0x208]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x21c], edi
mov dword [esp + 0x218], ebp
mov byte [esp + 0x208], 0
cmp dword [esp + 0x238], ebx
jb 0x428215
mov eax, dword [esp + 0x224]
push eax
call fcn.0043c853
add esp, 4
cmp dword [esp + 0x254], ebx
mov dword [esp + 0x238], edi
mov dword [esp + 0x234], ebp
jmp 0x427cd1
call fcn.00429b80
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
add eax, 0x1c
push esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push eax
mov byte [ecx + 4], 0
call fcn.00402ea0
call fcn.0041c740
cmp eax, esi
jge 0x428d11
lea edx, [esp + 0x7c]
push edx
call fcn.0042a300
mov byte [esp + 0x1e0], 0xd
call fcn.0043c831
cdq
mov ecx, 0x14
idiv ecx
mov edi, edx
inc edi
call fcn.0043c831
cdq
idiv edi
cmp edx, edi
jg 0x42829b
mov eax, edi
cdq
idiv edi
cmp edx, esi
je 0x4282b2
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00419f50
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebx, [esp + 0x40]
mov dword [esp + 0x38], esp
cmp eax, 0x10
jb 0x4282df
mov ecx, dword [edi]
jmp 0x4282e1
mov ecx, edi
cmp ecx, 0x45cbd0
ja 0x42831c
cmp eax, 0x10
jb 0x4282f2
mov ecx, dword [edi]
jmp 0x4282f4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45cbd0
jbe 0x42831c
cmp eax, 0x10
jb 0x428308
mov edi, dword [edi]
push 0xb
mov eax, 0x45cbd0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x428360
cmp eax, 0xb
jae 0x42832e
mov ecx, dword [esi + 0x14]
push ecx
push 0xb
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42833a
mov eax, dword [edi]
jmp 0x42833c
mov eax, edi
push 0xb
push 0x45cbd0
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0xb
jb 0x42835c
mov edi, dword [edi]
mov byte [edi + 0xb], 0
lea esi, [esp + 0x160]
call fcn.00401900
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x1e0], 0xe
call fcn.00401a70
mov byte [esp + 0x1e0], 0xf
cmp dword [eax + 0x18], 0x10
jb 0x428390
mov edx, dword [eax + 4]
jmp 0x428393
lea edx, [eax + 4]
mov eax, edx
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4283b0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x48]
call fcn.004033f0
lea edx, [esp + 0x40]
push edx
lea ebx, [esp + 0x80]
mov byte [esp + 0x1e4], pe_nt_image_headers32
call fcn.004297d0
cmp dword [esp + 0x58], 0x10
jb 0x4283f1
mov eax, dword [esp + 0x44]
push eax
call fcn.0043c853
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x3c], 0x10
mov edi, 0xf
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jb 0x428418
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x144]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x1e0], 0xd
call fcn.00429050
lea edx, [esp + 0x24]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], edi
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x42845d
mov ecx, dword [edi]
jmp 0x42845f
mov ecx, edi
cmp ecx, 0x45cbdc
ja 0x42849a
cmp eax, 0x10
jb 0x428470
mov ecx, dword [edi]
jmp 0x428472
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45cbdc
jbe 0x42849a
cmp eax, 0x10
jb 0x428486
mov edi, dword [edi]
push 5
mov eax, 0x45cbdc
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x4284dd
cmp eax, 5
jae 0x4284ac
mov ecx, dword [esi + 0x14]
push ecx
push 5
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4284b8
mov eax, dword [edi]
jmp 0x4284ba
mov eax, edi
push 5
push 0x45cbdc
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 5
jb 0x4284da
mov edi, dword [edi]
mov byte [edi + 5], bl
lea esi, [esp + 0x164]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e4], 0x11
call fcn.00401b50
mov byte [esp + 0x1e0], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x42850b
mov eax, dword [eax + 4]
jmp 0x42850e
add eax, 4
push eax
lea ecx, [esp + 0x44]
call fcn.00402c00
lea edx, [esp + 0x40]
push edx
lea ebx, [esp + 0x80]
mov byte [esp + 0x1e4], 0x13
call fcn.004297d0
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x58], esi
jb 0x428549
mov eax, dword [esp + 0x44]
push eax
call fcn.0043c853
add esp, 4
xor ebx, ebx
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
cmp dword [esp + 0x3c], esi
jb 0x42856e
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x144]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov byte [esp + 0x1e0], 0xd
call fcn.00429050
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x34], esp
push edx
lea ecx, [esp + 0x98]
call fcn.00429660
mov edi, dword [esp + 0x38]
push edi
mov eax, ebp
mov byte [esp + 0x1fc], 0x14
call fcn.00429b80
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402ea0
mov ecx, dword [esp + 0x4c]
add ecx, 0x18
mov byte [esp + 0x214], 0xd
call fcn.00436690
cmp eax, ebx
push edi
mov eax, ebp
jge 0x4287a2
call fcn.00429b80
inc dword [eax + 0x54]
add eax, 0x54
call fcn.00403c90
test eax, eax
je 0x428618
call fcn.00419bf0
call fcn.00418ac0
push edi
mov eax, ebp
call fcn.00429b80
cmp dword [eax + 0x18], 0x10
jb 0x42862b
mov eax, dword [eax + 4]
jmp 0x42862e
add eax, 4
push eax
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x21
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x45cbe4
mov byte [ecx + 4], bl
call fcn.004033f0
lea esi, [esp + 0x168]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e8], 0x15
call fcn.00401db0
mov byte [esp + 0x1e4], 0x16
cmp dword [eax + 0x18], 0x10
jb 0x428684
mov eax, dword [eax + 4]
jmp 0x428687
add eax, 4
mov ecx, dword [esp + 0x1c]
push eax
push 1
push ecx
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00402c70
lea esi, [esp + 0x144]
mov byte [esp + 0x1e0], 0xd
call fcn.00429050
call fcn.00417960
test eax, eax
je 0x4286c7
call fcn.00419cc0
call fcn.00419d80
push edi
mov eax, ebp
call fcn.00429b80
cmp dword [eax + 0x18], 0x10
jb 0x4286da
mov eax, dword [eax + 4]
jmp 0x4286dd
add eax, 4
push eax
lea edx, [esp + 0x28]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x45cc08
mov byte [ecx + 4], bl
call fcn.004033f0
lea esi, [esp + 0x168]
call fcn.00401900
push eax
mov byte [esp + 0x1ec], 0x17
call fcn.00401c70
mov byte [esp + 0x1e4], 0x18
cmp dword [eax + 0x18], 0x10
jb 0x428732
mov eax, dword [eax + 4]
jmp 0x428735
add eax, 4
push eax
mov eax, dword [esp + 0x20]
push 2
push eax
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00402c70
lea esi, [esp + 0x144]
call fcn.00429050
call fcn.00417b10
lea esi, [esp + 0x7c]
call fcn.00429780
lea ecx, [esp + 0x1e8]
call fcn.00402c70
lea ecx, [esp + 0x204]
call fcn.00402c70
lea ecx, [esp + 0x220]
call fcn.00402c70
lea ecx, [esp + 0x23c]
call fcn.00402c70
mov eax, 0x80004005
jmp 0x429025
call fcn.00429b80
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00402c40
call fcn.0041c740
mov esi, eax
mov dword [esp + 0x1b4], 0xf
mov dword [esp + 0x1b0], ebx
mov byte [esp + 0x1a0], bl
mov byte [esp + 0x1e0], 0x1b
call fcn.004178a0
sub eax, 1
jne 0x4287f5
call fcn.00419e50
call fcn.00438a50
cmp esi, ebx
jge 0x428b81
mov esi, dword [esp + 0x20]
push esi
mov eax, ebp
call fcn.00429b80
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x64]
call fcn.00402cd0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push esi
mov eax, ebp
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
call fcn.00429b80
mov edi, eax
add edi, 0x1c
lea ebx, [esp + 0x64]
call fcn.00410830
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x98], eax
mov dword [esp + 0x1c], 0
lea esi, [esp + 0x9c]
call fcn.0040f750
mov byte [esp + 0x1e0], 0x1c
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
push ecx
push ebx
push edx
push eax
push 0
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x48], esp
push 9
mov ecx, str.Q_p0lswU
lea edi, [esp + 0x5c]
call fcn.00404720
lea esi, [esp + 0x178]
call fcn.00401900
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1f8], 0x1d
call fcn.00401a70
mov ecx, eax
mov byte [esp + 0x1f8], 0x1e
call fcn.004030b0
push eax
lea ecx, [esp + 0x80]
push ecx
call fcn.0040f810
push eax
lea edx, [esp + 0xb4]
push edx
mov byte [esp + 0x1fc], 0x1f
call fcn.0042f3b0
movzx edi, al
add esp, 0x1c
lea eax, [esp + 0x64]
push eax
mov byte [esp + 0x1e4], 0x1e
call fcn.0040f900
lea ecx, [esp + 0x24]
call fcn.00402c70
mov byte [esp + 0x1e0], 0x1c
call fcn.00429050
test edi, edi
je 0x428adf
call fcn.00406870
test eax, eax
je 0x428926
call fcn.00419ee0
mov edi, 1
lea esi, [esp + 0x9c]
call fcn.0040f7a0
lea ecx, [esp + 0x24]
call fcn.0040f7f0
push 0
lea ecx, [esp + 0x28]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x1a4]
mov byte [esp + 0x1e8], 0x20
call fcn.004031f0
lea ecx, [esp + 0x24]
call fcn.00402c70
sub esp, 0x1c
mov edx, esi
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov dword [esp + 0x200], 0x1c
call fcn.00402c40
call fcn.0041c740
test eax, eax
jge 0x4289b4
push 0
mov ecx, esi
call fcn.004030b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, esi
test eax, eax
je 0x428af8
push 6
call fcn.004030b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x9c]
call fcn.0042a5e0
mov edi, eax
lea eax, [esp + 0x9c]
call fcn.0042a560
add edi, eax
lea esi, [esp + 0x5c]
call fcn.00403b40
push 0
call fcn.0043cb47
add esp, 4
lea esi, [esp + 0x9c]
mov byte [esp + 0x1e0], 0x1b
call fcn.0040f5a0
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x1e
jb 0x42884e
mov esi, dword [esp + 0x20]
push esi
mov eax, ebp
call fcn.00429b80
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00402c40
call fcn.0041c740
mov edi, eax
call fcn.00417ad0
mov dword [esp + 0x1e0], 0x1b
test edi, edi
jge 0x428b7b
push esi
mov eax, ebp
call fcn.00429b80
mov ecx, eax
add ecx, 0x38
call fcn.004030b0
push eax
lea edx, [esp + 0x28]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x27
mov ecx, 0x45cc40
call fcn.00404720
lea esi, [esp + 0x168]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e8], 0x27
call fcn.00401b50
mov ecx, eax
mov byte [esp + 0x1e4], 0x28
call fcn.004030b0
push eax
mov eax, dword [esp + 0x20]
push 1
push eax
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00402c70
call fcn.00429050
call fcn.00403c90
test eax, eax
je 0x428ace
call fcn.004399b0
call fcn.00418740
lea ecx, [esp + 0x19c]
call fcn.00402c70
jmp 0x42875f
lea esi, [esp + 0x9c]
mov byte [esp + 0x1e0], 0x1b
call fcn.0040f5a0
jmp 0x428a09
call fcn.004030b0
push eax
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x25
mov ecx, 0x45cc18
call fcn.00404720
lea esi, [esp + 0x168]
call fcn.00401900
mov byte [esp + 0x1e8], 0x23
call fcn.004019c0
mov ecx, eax
mov byte [esp + 0x1e4], 0x24
call fcn.004030b0
mov ecx, dword [esp + 0x1c]
push eax
push 1
push ecx
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00402c70
call fcn.00429050
lea esi, [esp + 0x9c]
call fcn.0040f5a0
lea ecx, [esp + 0x19c]
call fcn.00402c70
jmp 0x42875f
mov edi, dword [esp + 0x20]
xor ebx, ebx
push edi
mov eax, ebp
call fcn.00429b80
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00402c40
mov ecx, dword [esp + 0x34]
add ecx, 0x18
call fcn.00434210
cmp eax, ebx
mov eax, ebp
jge 0x428cb8
push edi
call fcn.00429b80
inc dword [eax + 0x54]
add eax, 0x54
push edi
mov eax, ebp
call fcn.00429b80
mov ecx, eax
add ecx, 0x1c
call fcn.004030b0
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0x1d
mov ecx, 0x45cc68
call fcn.00404720
lea esi, [esp + 0x168]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e8], 0x29
call fcn.00401db0
mov ecx, eax
mov byte [esp + 0x1e4], 0x2a
call fcn.004030b0
mov ebx, dword [esp + 0x1c]
push eax
push 1
push ebx
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00402c70
mov byte [esp + 0x1e0], 0x1b
call fcn.00429050
push edi
mov eax, ebp
call fcn.00429b80
mov ecx, eax
call fcn.004030b0
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 2
mov ecx, 0x45cc88
lea edi, [esp + 0x48]
call fcn.00404720
lea esi, [esp + 0x164]
call fcn.00401900
mov edx, edi
mov ecx, eax
mov byte [esp + 0x1e4], 0x2b
call fcn.00401a70
mov ecx, eax
mov byte [esp + 0x1e4], 0x2c
call fcn.004030b0
push eax
push 2
push ebx
call fcn.0041c440
add esp, 0x10
mov ecx, edi
call fcn.00402c70
call fcn.00429050
lea ecx, [esp + 0x19c]
call fcn.00402c70
jmp 0x42875f
push 6
push ecx
push edi
call fcn.00429b80
mov ecx, eax
add esp, 4
add ecx, 0x1c
call fcn.004030b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call fcn.0043cb47
add esp, 4
call fcn.00417b10
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1e0], 0x1b
call fcn.00402c70
lea esi, [esp + 0x7c]
mov byte [esp + 0x1e0], 3
call fcn.00429780
mov ebx, dword [esp + 0x20]
xor esi, esi
push 0x40
xor eax, eax
lea edx, [esp + 0x104]
push esi
push edx
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x108], esi
call fcn.00444d20
add esp, 0xc
call fcn.00403c90
test eax, eax
je 0x428d56
call fcn.00419f50
call fcn.00419f50
xor eax, eax
mov word [esp + 0x12c], ax
push ebx
mov eax, ebp
mov dword [esp + 0x12c], 1
call fcn.00429b80
add eax, 0x1c
push eax
mov edi, 0x45c9a4
lea esi, [esp + 0x28]
call fcn.00405a10
add esp, 4
lea ecx, [esp + 0x23c]
push ecx
push eax
lea edi, [esp + 0x1c0]
mov byte [esp + 0x1e8], 0x2f
call fcn.00405ac0
add esp, 8
mov byte [esp + 0x1e0], 0x31
cmp dword [esp + 0x3c], 0x10
jb 0x428dc4
mov edx, dword [esp + 0x28]
push edx
call fcn.0043c853
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00403c90
test eax, eax
je 0x428de7
call fcn.00418ac0
push ebx
mov eax, ebp
call fcn.00429b80
add eax, 0x38
mov ecx, pe_nt_image_headers32
cmp dword [eax + 0x18], ecx
jb 0x428e01
mov eax, dword [eax + 4]
jmp 0x428e04
add eax, 4
cmp dword [esp + 0x1d0], ecx
mov ecx, dword [esp + 0x1bc]
jae 0x428e1b
lea ecx, [esp + 0x1bc]
lea edx, [esp + 0x6c]
push edx
lea edx, [esp + 0x100]
push edx
push eax
push 0
push 0xc000000
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call fcn.00417b10
sub eax, 1
jne 0x428e55
call fcn.00419cc0
call fcn.00438a50
mov eax, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x70]
push ecx
call edi
test esi, esi
jne 0x428fe7
mov eax, dword [esp + 0x1bc]
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x1d0], edi
jae 0x428e8d
lea eax, [esp + 0x1bc]
push eax
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x1f
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push str.6WRUH
mov byte [ecx + 4], 0
call fcn.004033f0
lea esi, [esp + 0x168]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x1e8], 0x32
call fcn.00401db0
mov byte [esp + 0x1e4], 0x33
cmp dword [eax + 0x18], edi
jb 0x428ee7
mov eax, dword [eax + 4]
jmp 0x428eea
add eax, 4
push eax
mov eax, dword [esp + 0x20]
push 1
push eax
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.00402c70
lea esi, [esp + 0x144]
call fcn.00429050
call fcn.00417b10
test eax, eax
je 0x428f1d
call fcn.00418ac0
call fcn.00417b10
push ebx
mov eax, ebp
mov dword [esp + 0x1e4], 0x31
call fcn.00429b80
cmp dword [eax + 0x18], edi
jb 0x428f3f
mov eax, dword [eax + 4]
jmp 0x428f42
add eax, 4
push eax
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x45ccac
mov byte [ecx + 4], 0
call fcn.004033f0
lea esi, [esp + 0x168]
call fcn.00401900
mov byte [esp + 0x1e8], 0x36
call fcn.004019c0
mov byte [esp + 0x1e4], 0x37
cmp dword [eax + 0x18], edi
jb 0x428f9a
mov eax, dword [eax + 4]
jmp 0x428f9d
add eax, 4
mov edx, dword [esp + 0x1c]
push eax
push 2
push edx
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.00402c70
lea esi, [esp + 0x144]
call fcn.00429050
call fcn.00417ad0
sub eax, 1
jne 0x428fd6
call fcn.00419fa0
call fcn.00418740
lea ecx, [esp + 0x1b8]
call fcn.00402c70
jmp 0x428768
lea ecx, [esp + 0x1b8]
call fcn.00402c70
lea ecx, [esp + 0x1e8]
call fcn.00402c70
lea ecx, [esp + 0x204]
call fcn.00402c70
lea ecx, [esp + 0x220]
call fcn.00402c70
lea ecx, [esp + 0x23c]
call fcn.00402c70
xor eax, eax
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x1d0
ret 0x70