Function at 0x41e9d0
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create process on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e618
mov eax, dword fs:[0]
push eax
sub esp, 0xf70
mov eax, dword [0x496d50]
xor eax, esp
mov dword [esp + 0xf68], eax
push ebx
push esi
push edi
mov eax, dword [0x496d50]
xor eax, esp
push eax
lea eax, [esp + 0xf80]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
xor ebx, ebx
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ebx
call fcn.00421390
mov dword [esp + 0xf88], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x2f0], ebx
mov word [esp + 0x2e0], cx
xor edx, edx
mov dword [esp + 0x310], eax
mov dword [esp + 0x30c], ebx
mov word [esp + 0x2fc], dx
mov dword [esp + 0x348], eax
mov dword [esp + 0x344], ebx
mov word [esp + 0x334], cx
mov dword [esp + 0x364], eax
mov dword [esp + 0x360], ebx
mov word [esp + 0x350], dx
mov dword [esp + 0x32c], eax
xor eax, eax
mov dword [esp + 0x328], ebx
mov word [esp + 0x318], ax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0xf88], 6
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x798], ebx
mov dword [esp + 0x79c], ebx
mov dword [esp + 0x7a0], ebx
mov dword [esp + 0x7a4], ebx
mov dword [esp + 0x7a8], ecx
mov dword [esp + 0x7ac], eax
mov dword [esp + 0x7b0], ebx
mov dword [esp + 0x7b4], ebx
mov dword [esp + 0x7b8], ebx
mov dword [esp + 0x7bc], ebx
mov dword [esp + 0x7c0], ebx
mov dword [esp + 0x7c4], ebx
mov dword [esp + 0x7c8], ebx
mov dword [esp + 0x10], ebx
cmp dword [ebp + 8], ebx
jle 0x41f094
jmp 0x41eb40
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edx, dword [ecx + edx*4]
xor eax, eax
mov word [esp + 0x2c4], ax
mov eax, edx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41eb70
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov esi, dword [esp + 0x2d4]
mov edx, esi
cmp esi, 2
jb 0x41eba0
mov edx, 2
mov edi, dword [esp + 0x2d8]
mov ecx, dword [esp + 0x2c4]
cmp edi, 8
jae 0x41ebba
lea ecx, [esp + 0x2c4]
mov eax, 0x48463c
test edx, edx
je 0x41ebe4
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x41ebd6
add ecx, 2
add eax, 2
dec edx
jne 0x41ebc3
jmp 0x41ebe4
mov cx, word [ecx]
cmp cx, word [eax]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x41ebf6
cmp esi, 2
jae 0x41ebee
or eax, 0xffffffff
jmp 0x41ebf6
xor eax, eax
cmp esi, 2
setne al
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp edi, 8
jb 0x41ec18
mov edx, dword [esp + 0x2c4]
push edx
call fcn.0044e60d
add esp, 4
test bl, bl
je 0x41ec30
mov esi, dword [esp + 0x10]
mov dword [esp + 0x7bc], 1
jmp 0x41f084
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx*4]
xor eax, eax
mov word [esp + 0x2c4], ax
mov eax, edx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ec60
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov esi, dword [esp + 0x2d4]
mov edx, esi
cmp esi, 2
jb 0x41ec90
mov edx, 2
mov edi, dword [esp + 0x2d8]
mov ecx, dword [esp + 0x2c4]
cmp edi, 8
jae 0x41ecaa
lea ecx, [esp + 0x2c4]
mov eax, 0x484644
test edx, edx
je 0x41ecd4
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x41ecc6
add ecx, 2
add eax, 2
dec edx
jne 0x41ecb3
jmp 0x41ecd4
mov cx, word [ecx]
cmp cx, word [eax]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x41ece6
cmp esi, 2
jae 0x41ecde
or eax, 0xffffffff
jmp 0x41ece6
xor eax, eax
cmp esi, 2
setne al
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp edi, 8
jb 0x41ed08
mov edx, dword [esp + 0x2c4]
push edx
call fcn.0044e60d
add esp, 4
test bl, bl
je 0x41ed20
mov esi, dword [esp + 0x10]
mov dword [esp + 0x7c0], 1
jmp 0x41f084
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [eax + ecx*4]
xor edx, edx
mov eax, ecx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
mov word [esp + 0x2c4], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41ed50
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov byte [esp + 0xf88], 9
mov eax, dword [esp + 0x2d4]
push 0x48464c
mov edi, 2
lea ecx, [esp + 0x2c8]
call fcn.00410890
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x2d8], 8
jb 0x41edb9
mov eax, dword [esp + 0x2c4]
push eax
call fcn.0044e60d
add esp, 4
xor eax, eax
test bl, bl
jne 0x41f306
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx + edx*4]
mov word [esp + 0x2c4], ax
mov eax, ecx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41edf1
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov byte [esp + 0xf88], 0xa
mov eax, dword [esp + 0x2d4]
push 0x484654
mov edi, 2
lea ecx, [esp + 0x2c8]
call fcn.00410890
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x2d8], 8
jb 0x41ee5a
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.0044e60d
add esp, 4
test bl, bl
jne 0x41f431
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + eax*4]
xor edx, edx
mov eax, ecx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
mov word [esp + 0x2c4], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41ee92
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov byte [esp + 0xf88], 0xb
mov eax, dword [esp + 0x2d4]
push 0x48465c
mov edi, 3
lea ecx, [esp + 0x2c8]
call fcn.00410890
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x2d8], 8
jb 0x41eefb
mov eax, dword [esp + 0x2c4]
push eax
call fcn.0044e60d
add esp, 4
test bl, bl
je 0x41ef10
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], 1
jmp 0x41f084
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx + edx*4]
xor eax, eax
mov word [esp + 0x2c4], ax
mov eax, ecx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41ef40
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
mov byte [esp + 0xf88], 0xc
mov eax, dword [esp + 0x2d4]
push 0x484664
mov edi, 2
lea ecx, [esp + 0x2c8]
call fcn.00410890
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x2d8], 8
jb 0x41efa9
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.0044e60d
add esp, 4
mov esi, dword [esp + 0x10]
test bl, bl
je 0x41efdf
inc esi
mov dword [esp + 0x7c8], 1
cmp esi, dword [ebp + 8]
jge 0x41f58b
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x318]
push edx
mov edx, dword [eax + esi*4]
call fcn.00401530
jmp 0x41f084
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + esi*4]
push edx
lea ecx, [esp + 0x38c]
call fcn.0040ead0
mov ecx, eax
mov byte [esp + 0xf88], 0xd
mov eax, dword [ecx + 0x10]
push 0x4846c0
mov edi, 2
call fcn.00410890
test eax, eax
sete bl
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x39c], 8
jb 0x41f036
mov eax, dword [esp + 0x388]
push eax
call fcn.0044e60d
add esp, 4
test bl, bl
je 0x41f05a
inc esi
cmp esi, dword [ebp + 8]
jge 0x41f5f0
mov edx, dword [esp + 0x14]
mov edx, dword [edx + esi*4]
lea ecx, [esp + 0x350]
push ecx
call fcn.00401530
jmp 0x41f084
test esi, esi
jle 0x41f084
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x334]
push eax
mov eax, dword [ecx + esi*4]
call fcn.0040eb50
lea edx, [esp + 0x2fc]
push edx
mov eax, 0x484708
call fcn.0040eb50
inc esi
mov dword [esp + 0x10], esi
cmp esi, dword [ebp + 8]
jl 0x41eb40
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 8], ebx
jle 0x41f0de
jmp 0x41f0a0
cmp edi, ebx
jle 0x41f0d8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + edi*4]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x41f0b0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x300]
call fcn.00412040
push 1
mov eax, 0x484708
call fcn.00412040
inc edi
cmp edi, dword [ebp + 8]
jl 0x41f0a0
call fcn.0043a1b1
mov dword [esp + 0x10], eax
call fcn.0043a06b
push ebx
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x41f104
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x18]
call fcn.00439fc8
sub esp, 8
mov byte [esp + 0xf90], 0xe
lea ecx, [esp + 0x18]
mov edi, esp
mov dword [esp + 0x2c], esp
call fcn.0041e990
lea ecx, [esp + 0x304]
call fcn.00432ac0
mov byte [esp + 0xf90], 6
mov esi, dword [esp + 0x18]
add esp, 8
cmp esi, ebx
je 0x41f186
push ebx
lea ecx, [esp + 0x1c]
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, ebx
jbe 0x41f160
cmp eax, 0xffffffff
jae 0x41f160
dec eax
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, eax
call fcn.00439fc8
cmp esi, ebx
je 0x41f186
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
call fcn.0043a1b1
mov esi, eax
mov dword [esp + 0x10], esi
call fcn.0043a06b
push ebx
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x41f1ae
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 0x18]
call fcn.00439fc8
sub esp, 8
mov byte [esp + 0xf90], 0xf
lea ecx, [esp + 0x18]
mov edi, esp
mov dword [esp + 0x2c], esp
call fcn.0041e990
lea ecx, [esp + 0x33c]
call fcn.00432ac0
add esp, 8
mov byte [esp + 0xf88], 6
cmp esi, ebx
je 0x41f230
push ebx
lea ecx, [esp + 0x1c]
call fcn.00439fa0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, ebx
jbe 0x41f20a
cmp eax, 0xffffffff
jae 0x41f20a
dec eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, eax
call fcn.00439fc8
cmp esi, ebx
je 0x41f230
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0xa64]
push ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x42132b
lea eax, [esp + 0xa64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41f254
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xa68]
push edx
lea ecx, [esp + 0x570]
call fcn.00401740
lea eax, [esp + 0x46c]
push 1
push eax
mov edx, str.WinDir
lea ecx, [esp + 0x390]
call fcn.0042bd90
add esp, 8
mov esi, eax
lea ecx, [esp + 0x2e0]
cmp ecx, esi
je 0x41f62a
cmp dword [esp + 0x2f4], 8
jb 0x41f2c1
mov edx, dword [esp + 0x2e0]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov edi, 7
mov dword [esp + 0x2f4], edi
mov dword [esp + 0x2f0], ebx
mov word [esp + 0x2e0], ax
cmp dword [esi + 0x14], 8
jae 0x41f600
mov eax, dword [esi + 0x10]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x2e4]
push esi
push edx
call fcn.0044e620
add esp, 0xc
jmp 0x41f60b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
xor esi, esi
push esi
mov edi, 7
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], esi
push 0x473064
mov word [ecx], ax
call fcn.00401740
call fcn.00421b40
mov ebx, 8
add esp, 0x1c
cmp dword [esp + 0x32c], ebx
jb 0x41f350
mov ecx, dword [esp + 0x318]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x32c], edi
mov dword [esp + 0x328], esi
mov word [esp + 0x318], dx
cmp dword [esp + 0x364], ebx
jb 0x41f381
mov eax, dword [esp + 0x350]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x364], edi
mov dword [esp + 0x360], esi
mov word [esp + 0x350], cx
cmp dword [esp + 0x348], ebx
jb 0x41f3b2
mov edx, dword [esp + 0x334]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x348], edi
mov dword [esp + 0x344], esi
mov word [esp + 0x334], ax
cmp dword [esp + 0x310], ebx
jb 0x41f3e3
mov ecx, dword [esp + 0x2fc]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x310], edi
mov dword [esp + 0x30c], esi
mov word [esp + 0x2fc], dx
cmp dword [esp + 0x2f4], ebx
jb 0x41f414
mov eax, dword [esp + 0x2e0]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2f4], edi
mov dword [esp + 0x2f0], esi
mov word [esp + 0x2e0], cx
jmp 0x41f559
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
xor edi, edi
push edi
mov esi, 7
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push 0x473064
mov word [ecx], dx
call fcn.00401740
call fcn.00421b40
mov ebx, 8
add esp, 0x1c
cmp dword [esp + 0x32c], ebx
jb 0x41f47d
mov eax, dword [esp + 0x318]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x32c], esi
mov dword [esp + 0x328], edi
mov word [esp + 0x318], cx
cmp dword [esp + 0x364], ebx
jb 0x41f4ae
mov edx, dword [esp + 0x350]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x364], esi
mov dword [esp + 0x360], edi
mov word [esp + 0x350], ax
cmp dword [esp + 0x348], ebx
jb 0x41f4df
mov ecx, dword [esp + 0x334]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x348], esi
mov dword [esp + 0x344], edi
mov word [esp + 0x334], dx
cmp dword [esp + 0x310], ebx
jb 0x41f510
mov eax, dword [esp + 0x2fc]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x310], esi
mov dword [esp + 0x30c], edi
mov word [esp + 0x2fc], cx
cmp dword [esp + 0x2f4], ebx
jb 0x41f541
mov edx, dword [esp + 0x2e0]
push edx
call fcn.0044e60d
add esp, 4
mov dword [esp + 0x2f4], esi
xor eax, eax
mov dword [esp + 0x2f0], edi
mov word [esp + 0x2e0], ax
lea esi, [esp + 0x46c]
call fcn.004215a0
xor eax, eax
mov ecx, dword [esp + 0xf80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf68]
xor ecx, esp
call fcn.0044e488
mov esp, ebp
pop ebp
ret
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.You_did_not_specify_a_White_List_file.
call fcn.0040ead0
call fcn.00421b40
add esp, 0x1c
lea esi, [esp + 0x44]
call fcn.0040ec90
lea ecx, [esp + 0x318]
call fcn.00401500
lea ecx, [esp + 0x350]
call fcn.00401500
lea ecx, [esp + 0x334]
call fcn.00401500
lea ecx, [esp + 0x2fc]
call fcn.00401500
lea ecx, [esp + 0x2e0]
call fcn.00401500
jmp 0x41f559
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.You_did_not_specify_a_logfile.
jmp 0x41f599
mov eax, dword [esi]
mov dword [esp + 0x2e0], eax
mov dword [esi], ebx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x2f0], ecx
mov edx, dword [esi + 0x14]
mov dword [esp + 0x2f4], edx
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov byte [esp + 0xf88], 6
cmp dword [esp + 0x39c], 8
jb 0x41f64c
mov ecx, dword [esp + 0x388]
push ecx
call fcn.0044e60d
add esp, 4
push 0x15
mov eax, str.System32Notepad.exe
lea esi, [esp + 0x2e4]
call fcn.00412040
push 0x20000
call fcn.0045069e
add eax, 0x20
push eax
call fcn.004518e1
add esp, 4
push eax
call fcn.004517f6
add esp, 8
cmp dword [esp + 0x360], ebx
jne 0x41f789
push 0x4743e0
lea edx, [esp + 0x56c]
push edx
lea eax, [esp + 0x390]
push eax
call fcn.00414c90
add esp, 0xc
push eax
mov eax, 0x4847dc
lea edi, [esp + 0x2c8]
mov byte [esp + 0xf8c], 0x11
call fcn.00414ee0
add esp, 4
push eax
mov eax, str..txt
lea edi, [esp + 0x370]
mov byte [esp + 0xf8c], 0x12
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x590]
mov byte [esp + 0xf94], 0x13
call fcn.00411f30
mov esi, 8
cmp dword [esp + 0x380], esi
jb 0x41f718
mov ecx, dword [esp + 0x36c]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov edi, 7
mov dword [esp + 0x380], edi
mov dword [esp + 0x37c], ebx
mov word [esp + 0x36c], dx
cmp dword [esp + 0x2d8], esi
jb 0x41f74e
mov eax, dword [esp + 0x2c4]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [esp + 0xf88], 6
mov dword [esp + 0x2d8], edi
mov dword [esp + 0x2d4], ebx
mov word [esp + 0x2c4], cx
cmp dword [esp + 0x39c], esi
jb 0x41f7a5
mov edx, dword [esp + 0x388]
push edx
call fcn.0044e60d
add esp, 4
jmp 0x41f7a5
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x358]
push eax
lea ecx, [esp + 0x590]
call fcn.004015e0
mov esi, 8
lea ecx, [esp + 0x54]
call fcn.00411dd0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x64], ecx
lea edx, [esp + 0x60]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x70]
mov dword [esp + 0x68], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov ecx, dword [0x49becc]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x80]
mov dword [esp + 0x54], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [esp + 0xa4], 0
mov byte [esp + 0x9e], 0
mov dword [esp + 0x84], edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x98], ebx
mov byte [esp + 0xf88], 0x14
mov ecx, dword [esp + 0x584]
cmp dword [esp + 0x598], esi
jae 0x41f854
lea ecx, [esp + 0x584]
push 0x32
lea esi, [esp + 0x58]
call fcn.00410c30
cmp dword [esp + 0xa8], ebx
je 0x42114b
mov edx, dword [esp + 0x54]
mov eax, dword [edx + 0x24]
push ebx
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], 0xfe00ff
call eax
mov ecx, esi
call fcn.00410d40
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x5a8]
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push eax
mov word [ecx], dx
call fcn.004015e0
call fcn.0042d520
add esp, 0x1c
lea ecx, [esp + 0x584]
push ecx
lea edx, [esp + 0x190]
push edx
call fcn.0042f5c0
push ebx
mov byte [esp + 0xf8c], 0x17
mov edx, dword [esp + 0x194]
push 0x80
lea eax, [esp + 0xc74]
push eax
mov eax, dword [edx + 0x30]
lea ecx, [esp + 0x19c]
call eax
mov ecx, dword [0x49ae58]
mov edx, dword [ecx + 4]
mov edi, dword [edx + 0x49ae90]
lea ecx, [esp + 0xe4]
call fcn.00411dd0
mov byte [esp + 0xf88], 0x18
lea eax, [esp + 0x190]
push 0x1000
mov dword [esp + 0xe8], vtable.basic_teebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], edi
call fcn.0043db03
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x12c], eax
mov dword [edx], eax
mov edx, dword [esp + 0x10c]
lea ecx, [eax + 0x1000]
sub ecx, eax
mov dword [edx], eax
mov eax, dword [esp + 0x11c]
sar ecx, 1
add esp, 4
mov dword [eax], ecx
mov dword [esp + 0x13c], 0x478c90
mov byte [esp + 0xf88], 0x1a
lea ecx, [esp + 0x144]
mov dword [esp + 0x18], 1
mov dword [esp + method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00402ef0
lea ecx, [esp + 0xe4]
mov dword [esp + 0x17c], ecx
push 0x20
lea ecx, [esp + 0x148]
mov dword [esp + 0x184], ebx
call fcn.004135b0
mov word [esp + 0x184], ax
cmp dword [esp + 0x17c], ebx
jne 0x41f9f6
mov eax, dword [esp + 0x150]
or eax, 4
push ebx
push eax
lea ecx, [esp + 0x14c]
call fcn.00402d10
mov dword [esp + 0xf88], 0x1b
cmp dword [esp + 0x7c0], ebx
je 0x41fa17
lea esi, [esp + 0x18c]
mov dword [esp + 0x10], esi
jmp 0x41fa24
lea edx, [esp + 0x13c]
mov dword [esp + 0x10], edx
mov esi, edx
lea edi, [esp + 0x46c]
call fcn.00401060
cmp eax, 1
jne 0x41fb17
push str.2.9.1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x35c]
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push edx
mov word [ecx], ax
call fcn.004015e0
mov edx, edi
mov ecx, esi
call fcn.00423730
push str._r_nYour_processor_type_could_not_be_determined._Program_terminating._r_n
push esi
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41faa4
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41faa4
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41fac3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41fabc
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [esp + 0xe4]
mov eax, dword [edx + 0x34]
lea ecx, [esp + 0xe4]
call eax
lea ecx, [esp + 0x190]
call fcn.00410d40
test eax, eax
jne 0x41fb10
mov ecx, dword [esp + 0x18c]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x198]
lea ecx, [esp + ecx + 0x18c]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x41fb09
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
call fcn.004516a6
mov ecx, 1
mov edi, str.SeDebugPrivilege
call fcn.0042d590
test eax, eax
jne 0x41fb3e
push str._r_nCould_not_gain_required_privileges._Program_may_run_with_reduced_functionality._r_n
push esi
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [esp + 0x7b8], ebx
je 0x420289
mov esi, 7
xor edx, edx
mov dword [esp + 0x2d8], esi
mov dword [esp + 0x2d4], ebx
mov word [esp + 0x2c4], dx
xor eax, eax
mov dword [esp + 0x428], esi
mov dword [esp + 0x424], ebx
mov word [esp + 0x414], ax
xor ecx, ecx
mov dword [esp + 0x39c], esi
mov dword [esp + 0x398], ebx
mov word [esp + 0x388], cx
push 0x44
lea edx, [esp + 0x238]
push ebx
push edx
mov byte [esp + 0xf94], 0x1e
call fcn.00454850
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
add esp, 0xc
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x36c], ax
mov eax, ecx
mov dword [esp + 0x380], esi
mov dword [esp + 0x234], 0x44
mov dword [esp + 0x37c], ebx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x41fbf1
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x374]
call fcn.00401740
lea eax, [esp + 0x36c]
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xf88], 0x1f
call fcn.0042cbd0
mov esi, eax
mov byte [esp + 0xf88], 0x20
mov ecx, dword [edi]
lea edx, [esp + 0x3a4]
call fcn.0042ca00
push eax
mov eax, 0x484a30
lea edi, [esp + 0x3fc]
mov byte [esp + 0xf8c], 0x21
call fcn.00414ee0
add esp, 4
mov ecx, eax
mov eax, esi
lea edi, [esp + 0x3dc]
mov byte [esp + 0xf88], 0x22
call fcn.00431f90
push eax
lea ecx, [esp + 0x2c8]
mov byte [esp + 0xf8c], 0x23
call fcn.00401560
mov esi, 8
cmp dword [esp + 0x3f0], esi
jb 0x41fca9
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov edi, 7
mov dword [esp + 0x3f0], edi
mov dword [esp + 0x3ec], ebx
mov word [esp + 0x3dc], dx
cmp dword [esp + 0x40c], esi
jb 0x41fcdf
mov eax, dword [esp + 0x3f8]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x40c], edi
mov dword [esp + 0x408], ebx
mov word [esp + 0x3f8], cx
cmp dword [esp + 0x3b8], esi
jb 0x41fd10
mov edx, dword [esp + 0x3a4]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x3b8], edi
mov dword [esp + 0x3b4], ebx
mov word [esp + 0x3a4], ax
cmp dword [esp + 0x3d4], esi
jb 0x41fd41
mov ecx, dword [esp + 0x3c0]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov byte [esp + 0xf88], 0x1e
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov word [esp + 0x3c0], dx
cmp dword [esp + 0x380], esi
jb 0x41fd7a
mov eax, dword [esp + 0x36c]
push eax
call fcn.0044e60d
add esp, 4
push 6
push str.BINRES
lea ecx, [esp + 0x390]
call fcn.00401740
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x2d8], 8
mov eax, dword [esp + 0x2c4]
jae 0x41fda9
lea eax, [esp + 0x2c4]
xor edi, edi
push edi
push eax
call fcn.004501ef
add esp, 8
test eax, eax
jne 0x420044
push edi
call fcn.004512d6
add esp, 4
push eax
call fcn.00451907
add esp, 4
call fcn.00451919
push 0xa
push 0x2a
lea ecx, [esp + 0x7f8]
push ecx
push eax
call fcn.00451a19
mov ecx, dword [ebx]
add esp, 0x10
xor edx, edx
mov eax, ecx
mov word [esp + 0x36c], dx
mov dword [esp + 0x380], 7
mov dword [esp + 0x37c], edi
lea edx, [eax + 2]
lea esp, [esp]
mov si, word [eax]
add eax, 2
cmp si, di
jne 0x41fe10
sub eax, edx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x374]
call fcn.00401740
lea eax, [esp + 0x36c]
lea ecx, [esp + 0x434]
mov byte [esp + 0xf88], 0x24
call fcn.0042cbd0
mov esi, eax
mov byte [esp + 0xf88], 0x25
mov ecx, dword [ebx]
lea edx, [esp + 0x450]
call fcn.0042ca00
push eax
mov eax, 0x484a48
lea edi, [esp + 0x3e0]
mov byte [esp + 0xf8c], 0x26
call fcn.00414ee0
add esp, 4
push eax
lea eax, [esp + 0x7f4]
lea edi, [esp + 0x3fc]
mov byte [esp + 0xf8c], 0x27
call fcn.00414ee0
add esp, 4
push eax
mov eax, 0x4746a0
lea edi, [esp + 0x3a8]
mov byte [esp + 0xf8c], 0x28
call fcn.00414ee0
add esp, 4
mov ecx, eax
mov eax, esi
lea edi, [esp + 0x3c0]
mov byte [esp + 0xf88], 0x29
call fcn.00431f90
push eax
lea ecx, [esp + 0x2c8]
mov byte [esp + 0xf8c], 0x2a
call fcn.00401560
cmp dword [esp + 0x3d4], 8
jb 0x41ff00
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0044e60d
add esp, 4
xor esi, esi
xor ecx, ecx
cmp dword [esp + 0x3b8], 8
mov edi, 7
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], esi
mov word [esp + 0x3c0], cx
jb 0x41ff39
mov edx, dword [esp + 0x3a4]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
cmp dword [esp + 0x40c], 8
mov dword [esp + 0x3b8], edi
mov dword [esp + 0x3b4], esi
mov word [esp + 0x3a4], ax
jb 0x41ff6b
mov ecx, dword [esp + 0x3f8]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
cmp dword [esp + 0x3f0], 8
mov dword [esp + 0x40c], edi
mov dword [esp + 0x408], esi
mov word [esp + 0x3f8], dx
jb 0x41ff9d
mov eax, dword [esp + 0x3dc]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x464], 8
mov dword [esp + 0x3f0], edi
mov dword [esp + 0x3ec], esi
mov word [esp + 0x3dc], cx
jb 0x41ffcf
mov edx, dword [esp + 0x450]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
cmp dword [esp + 0x448], 8
mov dword [esp + 0x464], edi
mov dword [esp + 0x460], esi
mov word [esp + 0x450], ax
jb 0x420001
mov ecx, dword [esp + 0x434]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov byte [esp + 0xf88], 0x1e
cmp dword [esp + 0x380], 8
mov dword [esp + 0x448], edi
mov dword [esp + 0x444], esi
mov word [esp + 0x434], dx
jb 0x41fd91
mov eax, dword [esp + 0x36c]
push eax
call fcn.0044e60d
add esp, 4
jmp 0x41fd91
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x3ac]
mov esi, 7
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xfc0], 0x2b
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x304]
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
mov byte [esp + 0xfc0], 0x1e
call fcn.0042c8d0
add esp, 0x38
cmp al, 1
jne 0x42024b
mov edx, dword [esp + 0xe4]
mov eax, dword [edx + 0x34]
lea ecx, [esp + 0xe4]
call eax
lea esi, [esp + 0x18c]
call fcn.0042f770
cmp dword [esp + 0x30c], edi
je 0x4201d1
sub esp, 0x1c
lea edx, [esp + 0x2e0]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.0040eaa0
lea esi, [esp + 0x450]
call fcn.0042cae0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x42010a
mov eax, dword [eax]
push eax
lea eax, [esp + 0x860]
push 0x104
push eax
call fcn.0045063b
add esp, 0xc
lea ecx, [esp + 0x434]
call fcn.00401500
push 1
push 0x484708
lea ecx, [esp + 0x864]
push 0x104
push ecx
call fcn.00451a43
mov edx, dword [esp + 0x320]
mov ebx, dword [esp + 0x30c]
add esp, 0x10
mov eax, ebx
cmp edx, 8
jae 0x420164
lea eax, [esp + 0x2fc]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420167
sub eax, esi
sar eax, 1
mov ecx, ebx
cmp edx, 8
jae 0x420184
lea ecx, [esp + 0x2fc]
push eax
push ecx
lea edx, [esp + 0x864]
push 0x104
push edx
call fcn.00451a43
mov eax, dword [esp + 0x2d4]
add esp, 0x10
cmp dword [esp + 0x2d8], 8
jae 0x4201b3
lea eax, [esp + 0x2c4]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x238]
push edx
push edi
push edi
push 0x20
push edi
push edi
push edi
lea ecx, [esp + 0x87c]
push ecx
jmp 0x420200
cmp dword [esp + 0x2d8], 8
mov eax, dword [esp + 0x2c4]
jae 0x4201e9
lea eax, [esp + 0x2c4]
lea edx, [esp + 0x34]
push edx
mov edx, dword [ebx]
lea ecx, [esp + 0x238]
push ecx
push edi
push edi
push 0x20
push edi
push edi
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x38]
push edx
call esi
cmp dword [esp + 0x2d8], 8
mov eax, dword [esp + 0x2c4]
jae 0x420240
lea eax, [esp + 0x2c4]
push eax
call fcn.00451b49
add esp, 4
jmp 0x420282
mov eax, dword [esp + 0x10]
push str.There_was_a_problem_extracting_the_64_bit_version_of_the_program._r_n
push eax
call fcn.00415080
push eax
call fcn.00403070
mov edx, dword [esp + 0xf0]
mov eax, dword [edx + 0x34]
add esp, 0xc
lea ecx, [esp + 0xe4]
call eax
lea esi, [esp + 0x18c]
call fcn.0042f770
push 1
call fcn.004516a6
lea ebx, [esp + 0x46c]
call fcn.0042c200
cmp dword [esp + 0x20], 1
jne 0x420453
call fcn.004224e0
mov byte [esp + 0xf88], 0x19
mov ecx, dword [esp + 0x13c]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x144]
mov dword [esp + edx + method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov esi, vtable.std::ios_base.0
push eax
mov dword [esp + 0x148], esi
call fcn.0043dec4
add esp, 4
mov dword [esp + 0xe4], vtable.basic_teebuf_wchar_t__struct_std::char_traits_wchar_t__.0
lea ecx, [esp + 0xe4]
mov byte [esp + 0xf88], 0x2c
call dword [0x48d410]
mov ecx, dword [esp + 0x128]
push ecx
call fcn.0044eb47
add esp, 4
lea ecx, [esp + 0xe4]
mov byte [esp + 0xf88], 0x17
call fcn.0040e6f0
lea ecx, [esp + 0x1ec]
mov byte [esp + 0xf88], 0x14
call fcn.0042f6c0
lea edx, [esp + 0x1ec]
push edx
mov dword [esp + 0x1f0], esi
call fcn.0043dec4
add esp, 4
lea ecx, [esp + 0x54]
mov byte [esp + 0xf88], 6
call fcn.0040f700
mov esi, 8
cmp dword [esp + 0x32c], esi
jb 0x42037c
mov eax, dword [esp + 0x318]
push eax
call fcn.0044e60d
add esp, 4
xor edi, edi
xor ecx, ecx
mov ebx, 7
mov dword [esp + 0x32c], ebx
mov dword [esp + 0x328], edi
mov word [esp + 0x318], cx
cmp dword [esp + 0x364], esi
jb 0x4203b4
mov edx, dword [esp + 0x350]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x364], ebx
mov dword [esp + 0x360], edi
mov word [esp + 0x350], ax
cmp dword [esp + 0x348], esi
jb 0x4203e5
mov ecx, dword [esp + 0x334]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x348], ebx
mov dword [esp + 0x344], edi
mov word [esp + 0x334], dx
cmp dword [esp + 0x310], esi
jb 0x420416
mov eax, dword [esp + 0x2fc]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x310], ebx
mov dword [esp + 0x30c], edi
mov word [esp + 0x2fc], cx
cmp dword [esp + 0x2f4], esi
jb 0x420447
mov edx, dword [esp + 0x2e0]
push edx
call fcn.0044e60d
add esp, 4
mov dword [esp + 0x2f4], ebx
jmp 0x41f548
push str.2.9.1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [esp + 0x35c]
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
lea edx, [esp + 0x48c]
mov ecx, esi
call fcn.00423730
add esp, 0x20
cmp dword [esp + 0x7b0], edi
jne 0x420557
lea ecx, [esp + 0x744]
push ecx
push ecx
push str.__is_not_supported._r_n
push ecx
lea edx, [esp + 0x47c]
push edx
push ecx
push str._r_nYour_operating_system_
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
push eax
call fcn.00403070
add esp, 0xc
cmp dword [esp + 0x7c0], edi
jne 0x420503
push 0x40
push str.Rkill_Error
push str.Your_operating_system_is_not_supported._r_n
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0xe4]
mov edx, dword [eax + 0x34]
lea ecx, [esp + 0xe4]
call edx
lea ecx, [esp + 0x190]
call fcn.00410d40
test eax, eax
jne 0x420550
mov eax, dword [esp + 0x18c]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x198]
lea ecx, [esp + ecx + 0x18c]
or eax, 2
cmp dword [ecx + 0x38], edi
jne 0x420549
or eax, 4
push edi
push eax
call fcn.00402d10
push 1
call fcn.004516a6
push 0x484b64
push ecx
lea ecx, [esp + 0x784]
push ecx
push ecx
push 0x484708
push ecx
lea edx, [esp + 0x4a0]
push edx
push ecx
push str.Windows_Version:
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
push eax
call fcn.00403070
add esp, 0xc
cmp dword [esp + 0x7c8], edi
je 0x420641
lea eax, [esp + 0x46c]
push eax
lea edx, [esp + 0x31c]
lea ecx, [esp + 0x48]
call fcn.0042d840
add esp, 4
sub eax, edi
je 0x420605
dec eax
je 0x4205ef
dec eax
jne 0x420641
push str._is_not_properly_encoded._r_nWhiteList_file_should_be_saved_as_Ansi_or_UTF_8._r_n_r_n
push ecx
lea ecx, [esp + 0x320]
push ecx
jmp 0x420613
push str._r_n_r_n
push ecx
lea edx, [esp + 0x320]
push edx
push ecx
push str.Whitelist_Mode:
jmp 0x420620
push str._not_found._r_nOperating_without_a_whitelist._r_n_r_n
push ecx
lea eax, [esp + 0x320]
push eax
push ecx
push str.Whitelist_file:
mov dword [esp + 0x7dc], edi
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
lea esi, [esp + 0xac]
call fcn.0042f910
lea esi, [esp + 0xbc]
mov byte [esp + 0xf88], 0x2d
call fcn.0042f910
lea esi, [esp + 0xcc]
mov byte [esp + 0xf88], 0x2e
call fcn.0042f910
mov ebx, 0x498450
mov dword [esp + 0x14], 0x19
xor ecx, ecx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], edi
mov word [esp + 0x2c4], cx
mov byte [esp + 0xf88], 0x30
mov ecx, dword [ebx + 4]
mov eax, ecx
lea esi, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x4206b0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
call fcn.0043a1b1
mov dword [esp + 0x20], eax
call fcn.0043a06b
push edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x4206f3
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x18]
call fcn.00439fc8
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c8]
push 0x474ab0
push eax
lea eax, [esp + 0x654]
mov byte [esp + 0xf94], 0x31
call fcn.00414fc0
add esp, 0xc
lea ecx, [esp + 0x20]
mov byte [esp + 0xf88], 0x30
call fcn.00401f70
call fcn.0043a1b1
mov dword [esp + 0x20], eax
call fcn.0043a06b
push edi
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x42075c
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x28]
call fcn.00439fc8
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c8]
push 0x478380
push edx
lea eax, [esp + 0x638]
mov byte [esp + 0xf94], 0x32
call fcn.00414fc0
add esp, 0xc
lea ecx, [esp + 0x20]
mov byte [esp + 0xf88], 0x30
call fcn.00401f70
lea eax, [esp + 0x2c4]
push eax
mov ecx, ebx
lea esi, [esp + 0x418]
call fcn.00432020
add esp, 4
mov ecx, eax
lea edx, [esp + 0xac]
mov byte [esp + 0xf88], 0x33
call fcn.00432bd0
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.00432570
mov esi, 8
cmp dword [esp + 0x42c], esi
jb 0x4207ff
mov eax, dword [esp + 0x418]
push eax
call fcn.0044e60d
add esp, 4
cmp dword [esp + 0x2d8], esi
jb 0x420818
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.0044e60d
add esp, 4
add ebx, esi
dec dword [esp + 0x14]
jne 0x420682
xor edi, edi
jmp 0x420830
xor edx, edx
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], 0
mov word [esp + 0x2c4], dx
mov byte [esp + 0xf88], 0x34
mov ecx, dword [edi + 0x498518]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x420863
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x2cc]
call fcn.00401740
call fcn.0043a1b1
mov ebx, eax
mov dword [esp + 0x18], ebx
call fcn.0043a06b
push 0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x4208a9
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x28]
call fcn.00439fc8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c8]
push 0x474ab0
push ecx
lea eax, [esp + 0x654]
mov byte [esp + 0xf94], 0x35
call fcn.00414fc0
add esp, 0xc
mov byte [esp + 0xf88], 0x34
test ebx, ebx
je 0x420922
push 0
lea ecx, [esp + 0x24]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x420902
cmp eax, 0xffffffff
jae 0x420902
dec eax
mov dword [ebx + 4], eax
mov esi, dword [ebx + 4]
neg esi
sbb esi, esi
lea ecx, [esp + 0x20]
not esi
call fcn.00439fc8
and esi, ebx
je 0x420922
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [esp + 0x18], ebx
call fcn.0043a06b
push 0
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x42094b
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x14]
call fcn.00439fc8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c8]
push 0x478380
push edx
lea eax, [esp + 0x638]
mov byte [esp + 0xf94], 0x36
call fcn.00414fc0
add esp, 0xc
mov byte [esp + 0xf88], 0x34
test ebx, ebx
je 0x4209c4
push 0
lea ecx, [esp + 0x28]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4209a4
cmp eax, 0xffffffff
jae 0x4209a4
dec eax
mov dword [ebx + 4], eax
mov esi, dword [ebx + 4]
neg esi
sbb esi, esi
lea ecx, [esp + 0x24]
not esi
call fcn.00439fc8
and esi, ebx
je 0x4209c4
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov ecx, dword [edi + 0x49851c]
mov eax, dword [edi + 0x498518]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xbc]
mov dword [esp + 0x2c], eax
call fcn.00432ca0
push eax
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0xc4]
push eax
call fcn.00432570
mov byte [esp + 0xf88], 0x2f
cmp dword [esp + 0x2d8], 8
jb 0x420a1d
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.0044e60d
add esp, 4
add edi, 8
cmp edi, 0xf40
jb 0x420830
xor esi, esi
mov edi, edi
mov edx, dword [esi + 0x499458]
mov eax, dword [esi + 0x49945c]
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xcc]
mov dword [esp + 0x30], eax
call fcn.00432ca0
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0xd4]
push edx
call fcn.00432570
add esi, 8
cmp esi, 0x12a8
jb 0x420a30
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0xcc]
push eax
push ebx
call fcn.0042d240
add esp, 8
cmp eax, 1
jne 0x420afe
push str._service_stopped__r_n_r_n
push ecx
push eax
push ecx
push 0x47325c
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x420adb
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x420adb
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x420b37
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x420af4
or eax, 4
push 0
push eax
call fcn.00402d10
jmp 0x420b37
jbe 0x420b22
push str._services_stopped__r_n_r_n
push ecx
push eax
push ecx
push 0x47325c
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
jmp 0x420b28
push str.__No_malware_services_found_to_stop._r_n_r_n
push ebx
call fcn.00414730
add esp, 8
mov esi, eax
call fcn.0040e5a0
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x470]
push ebx
push eax
lea edx, [esp + 0xc8]
lea ecx, [esp + 0xb8]
call fcn.00423970
lea ecx, [esp + 0x478]
add esp, 0xc
push ecx
mov ecx, ebx
call fcn.00426bc0
lea edx, [esp + 0x470]
add esp, 4
push edx
call fcn.00419ba0
lea eax, [esp + 0x470]
add esp, 4
push eax
call fcn.00403b60
add esp, 4
xor edi, edi
push edi
call fcn.004512d6
add esp, 4
lea ecx, [esp + 0xdc]
mov dword [esp + 0xe0], edx
push ecx
lea edx, [esp + 0x7d0]
push edx
mov dword [esp + 0xe4], eax
call fcn.0045104e
lea eax, [esp + 0x7d4]
push eax
push str._m__d__Y__I:_M:_S__p
lea ecx, [esp + 0x82c]
push 0x3f
push ecx
call fcn.004525b9
add esp, 0x18
push 0x484dc8
push ecx
lea edx, [esp + 0x824]
push edx
push ecx
push str._r_nProgram_finished_at:
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00415080
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0x1c]
mov eax, 0x95217cb1
mul ecx
mov esi, edx
shr esi, 0x15
mov eax, esi
imul eax, eax, 0x36ee80
sub ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 0xea60
div ecx
push str._seconds_s__r_n
mov ecx, eax
mov eax, 0x10624dd3
mul edx
push ecx
shr edx, 6
push edx
push ecx
push str._minute_s___and
push ecx
push ecx
push ecx
push str._hours_s__
push ecx
push esi
push ecx
push str.Execution_time:
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x420cc5
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x420cc5
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x420ce4
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x420cdd
or eax, 4
push edi
push eax
call fcn.00402d10
mov edx, dword [esp + 0xe4]
mov eax, dword [edx + 0x34]
lea ecx, [esp + 0xe4]
call eax
lea ecx, [esp + 0x190]
call fcn.00410d40
test eax, eax
jne 0x420d31
mov ecx, dword [esp + 0x18c]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x198]
lea ecx, [esp + ecx + 0x18c]
or eax, 2
cmp dword [ecx + 0x38], edi
jne 0x420d2a
or eax, 4
push edi
push eax
call fcn.00402d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x5a8]
mov esi, 7
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
call fcn.0042d520
add esp, 0x1c
cmp dword [esp + 0x7c0], edi
jne 0x420ed7
push 0x40
push str.Rkill_Finished
push str.You_should_now_be_able_to_run_your_normal_security_programs_so_that_you_can_scan_for_computer_infections._r_n_r_nA_log_file_called_Rkill.txt_has_been_created_on_your_desktop_and_will_be_shown_automatically.__This_file_contains_information_on_what_actions_were_performed_on_your_computer_by_Rkill.
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x44
lea ecx, [esp + 0x280]
push edi
push ecx
call fcn.00454850
sub esp, 0x10
mov ecx, esp
xor eax, eax
mov dword [esp + 0x38], esp
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
push 0xffffffffffffffff
mov dword [esp + 0x29c], 0x44
push edi
lea eax, [esp + 0x304]
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
lea esi, [esp + 0x430]
call fcn.0042cae0
mov esi, 8
add esp, 0x1c
cmp dword [eax + 0x14], esi
jb 0x420dfa
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x860]
push 0x104
push ecx
call fcn.0045063b
add esp, 0xc
cmp dword [esp + 0x428], esi
jb 0x420e29
mov edx, dword [esp + 0x414]
push edx
call fcn.0044e60d
add esp, 4
push 1
push 0x484708
lea eax, [esp + 0x864]
push 0x104
push eax
call fcn.00451a43
mov eax, dword [esp + 0x594]
add esp, 0x10
cmp dword [esp + 0x598], esi
jae 0x420e5c
lea eax, [esp + 0x584]
mov ecx, dword [esp + 0x594]
push ecx
push eax
lea edx, [esp + 0x864]
push 0x104
push edx
call fcn.00451a43
mov eax, dword [esp + 0x2f0]
add esp, 0x10
cmp dword [esp + 0x2f4], esi
jae 0x420e91
lea eax, [esp + 0x2e0]
push eax
lea eax, [esp + 0xd70]
push 0x104
push eax
call fcn.0045063b
add esp, 0xc
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x280]
push edx
push edi
push edi
push 0x200
push edi
push edi
push edi
lea eax, [esp + 0x87c]
push eax
lea ecx, [esp + 0xd90]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov byte [esp + 0xf88], 0x37
mov eax, dword [esp + 0xd0]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [esp + 0x24]
lea esi, [esp + 0xd4]
call fcn.00412280
mov edx, dword [esp + 0xd0]
push edx
call fcn.0044e60d
add esp, 4
mov byte [esp + 0xf88], 0x38
mov eax, dword [esp + 0xc0]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [esp + 0x24]
lea esi, [esp + 0xc4]
call fcn.00412280
mov eax, dword [esp + 0xc0]
push eax
call fcn.0044e60d
add esp, 4
mov byte [esp + 0xf88], 0x39
mov eax, dword [esp + 0xb0]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [esp + 0x24]
lea esi, [esp + 0xb4]
call fcn.00412280
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.0044e60d
mov byte [esp + 0xf8c], 0x19
mov edx, dword [esp + 0x140]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x148]
add esp, 4
mov dword [esp + eax + method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov esi, vtable.std::ios_base.0
push ecx
mov dword [esp + 0x148], esi
call fcn.0043dec4
add esp, 4
mov dword [esp + 0xe4], vtable.basic_teebuf_wchar_t__struct_std::char_traits_wchar_t__.0
lea ecx, [esp + 0xe4]
mov byte [esp + 0xf88], 0x3a
call dword [0x48d410]
mov edx, dword [esp + 0x128]
push edx
call fcn.0044eb47
add esp, 4
lea ecx, [esp + 0xe4]
mov byte [esp + 0xf88], 0x17
call fcn.0040e6f0
lea ecx, [esp + 0x1ec]
mov byte [esp + 0xf88], 0x14
call fcn.0042f6c0
lea eax, [esp + 0x1ec]
push eax
mov dword [esp + 0x1f0], esi
call fcn.0043dec4
add esp, 4
lea ecx, [esp + 0x54]
mov byte [esp + 0xf88], 6
call fcn.0040f700
mov esi, dword [esp + 0x44]
xor ebx, ebx
cmp esi, ebx
je 0x421047
mov edi, dword [esp + 0x48]
mov eax, esi
call fcn.00410910
push esi
call fcn.0044e60d
add esp, 4
mov edi, 8
cmp dword [esp + 0x32c], edi
jb 0x421065
mov ecx, dword [esp + 0x318]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov esi, 7
mov dword [esp + 0x32c], esi
mov dword [esp + 0x328], ebx
mov word [esp + 0x318], dx
cmp dword [esp + 0x364], edi
jb 0x42109b
mov eax, dword [esp + 0x350]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x364], esi
mov dword [esp + 0x360], ebx
mov word [esp + 0x350], cx
cmp dword [esp + 0x348], edi
jb 0x4210cc
mov edx, dword [esp + 0x334]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x348], esi
mov dword [esp + 0x344], ebx
mov word [esp + 0x334], ax
cmp dword [esp + 0x310], edi
jb 0x4210fd
mov ecx, dword [esp + 0x2fc]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x310], esi
mov dword [esp + 0x30c], ebx
mov word [esp + 0x2fc], dx
cmp dword [esp + 0x2f4], edi
jb 0x42112e
mov eax, dword [esp + 0x2e0]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2f4], esi
mov dword [esp + 0x2f0], ebx
mov word [esp + 0x2e0], cx
jmp 0x41f559
lea edx, [esp + 0x414]
push str.You_did_not_specify_a_valid_logfile:
push edx
lea ebx, [esp + 0x358]
call fcn.00414e00
sub esp, 0x14
mov byte [esp + 0xfa4], 0x15
mov edi, esp
mov dword [esp + 0x38], esp
push eax
mov eax, str.._r_n_______Please_check_if_the_location_exists_or_if_you_have_permissions.
call fcn.00414ee0
add esp, 4
call fcn.00421b40
mov edi, 8
add esp, 0x1c
mov byte [esp + 0xf88], 0x14
cmp dword [esp + 0x428], edi
jb 0x4211b1
mov eax, dword [esp + 0x414]
push eax
call fcn.0044e60d
add esp, 4
lea ecx, [esp + 0x54]
call fcn.00410d40
mov dword [esp + 0x54], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
xor ebx, ebx
mov byte [esp + 0xf88], 0x16
cmp dword [esp + 0xa8], ebx
je 0x421209
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x9c]
cmp dword [edx], ecx
jne 0x421209
mov eax, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
mov ecx, eax
mov dword [edx], esi
mov edx, dword [esp + 0x74]
sub eax, ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x84]
sar eax, 1
mov dword [ecx], eax
cmp byte [esp + 0xa4], bl
je 0x42121b
lea ecx, [esp + 0x54]
call fcn.00410d40
lea ecx, [esp + 0x54]
mov byte [esp + 0xf88], 6
call fcn.0040e6f0
cmp dword [esp + 0x32c], edi
jb 0x421245
mov edx, dword [esp + 0x318]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov esi, 7
mov dword [esp + 0x32c], esi
mov dword [esp + 0x328], ebx
mov word [esp + 0x318], ax
cmp dword [esp + 0x364], edi
jb 0x42127b
mov ecx, dword [esp + 0x350]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x364], esi
mov dword [esp + 0x360], ebx
mov word [esp + 0x350], dx
cmp dword [esp + 0x348], edi
jb 0x4212ac
mov eax, dword [esp + 0x334]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x348], esi
mov dword [esp + 0x344], ebx
mov word [esp + 0x334], cx
cmp dword [esp + 0x310], edi
jb 0x4212dd
mov edx, dword [esp + 0x2fc]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [esp + 0x310], esi
mov dword [esp + 0x30c], ebx
mov word [esp + 0x2fc], ax
cmp dword [esp + 0x2f4], edi
jb 0x42130e
mov ecx, dword [esp + 0x2e0]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [esp + 0x2f4], esi
mov dword [esp + 0x2f0], ebx
mov word [esp + 0x2e0], dx
jmp 0x41f559
push str._r_nCould_not_retrieve_the_path_to_the_Desktop._Program_aborting._r_n
push 0x49ae58
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x421364
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x421364
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x421383
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x42137c
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
call fcn.004516a6
int3