Function at 0x40de80
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows
Delete file
Get common file path
Get graphical window text
Get memory capacity
Query or enumerate registry value
Read data from internet
Receive data
Resolve function by parsing pe exports
Set registry value
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x448ae9
mov eax, dword fs:[0]
push eax
mov eax, 0x49ac
call fcn.00431e40
mov eax, dword [0x45e5e0]
xor eax, esp
mov dword [esp + 0x49a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e5e0]
xor eax, esp
push eax
lea eax, [esp + 0x49c0]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
push 0x450da0
lea ecx, [esp + 0x2a4]
mov dword [esp + 0x2bc], 7
mov dword [esp + 0x2b8], ebx
mov word [esp + 0x2a8], bx
call fcn.004044c0
lea eax, [esp + 0x29c]
push eax
mov dword [esp + 0x49cc], ebx
call fcn.0040dd90
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0x450da4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40df92
push 0x450dc0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x40df92
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp eax, ebx
je 0x40df92
cmp dword [esp + 0x18], ebx
je 0x40df92
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0xf013f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.AsyncRunOnce
mov ebp, 1
push edx
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x18]
push eax
jmp 0x40dfd7
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.AsyncRunOnce
mov ebp, 1
push eax
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esi + 0xbc]
push ebx
push 0xa
push 0x402
push edx
mov dword [esi + 0x90], 0xa
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0x80], ebx
jne 0x40e07b
lea eax, [esp + 0x494]
push eax
call fcn.00410e70
mov byte [esp + 0x49c8], 1
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x508], ecx
lea ecx, [esp + 0x494]
call fcn.0041d1d7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.C:Program_FilesSolusseum
call fcn.0040b810
mov ecx, esi
call fcn.0040d460
lea ecx, [esp + 0x494]
mov byte [esp + 0x49c8], bl
call fcn.00410f00
cmp dword [esp + 0x2b4], 8
jb 0x40e074
mov edx, dword [esp + 0x2a0]
push edx
call fcn.00411d3b
add esp, 4
xor al, al
jmp 0x410ae0
call fcn.0040d730
test eax, eax
mov dword [esp + 0x20], ebp
je 0x40e403
push 0x100
lea eax, [esp + 0x398]
push ebx
push eax
call fcn.00430450
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x20119
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x100
call edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x49b
push str.xxxx
push str.__s__d___RegOpenKeyEx_lResult_:__d___GetLastError_:__d
call fcn.00443b10
add esp, 0x14
cmp edi, ebx
jne 0x40e109
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x398]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.TempFile
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], 7
mov dword [esp + 0x1bc], ebx
mov word [esp + 0x1ac], bx
call fcn.004044c0
lea eax, [esp + 0x394]
push eax
lea ecx, [esp + 0x16c]
push 0x4512f0
push ecx
mov byte [esp + 0x49d4], 2
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x49d4], 3
call fcn.004043d0
mov edi, 8
mov byte [esp + 0x49c8], 2
cmp dword [esp + 0x180], edi
jb 0x40e198
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x1b8], edi
mov eax, dword [esp + 0x1a4]
jae 0x40e1af
lea eax, [esp + 0x1a4]
push eax
push 0x4a3
push str.xxxx
push str.__s__d___T_Data_:__s
call fcn.00443b10
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x10
cmp dword [esp + 0x1b4], ebx
jne 0x40e1e0
mov eax, dword [esp + 0x18]
push eax
jmp 0x40e3d4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 4
mov eax, dword [esp + 0x1c0]
mov edi, 8
cmp dword [esp + 0x1d4], edi
jae 0x40e217
lea eax, [esp + 0x1c0]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 2
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40e3b8
push 0x4ac
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x498]
push ebx
push ecx
call fcn.00430450
add esp, 0xc
push ebx
push 0x1c
lea edx, [esp + 0x49c]
push edx
push ebx
call ebp
push 0x450da0
lea ecx, [esp + 0x188]
call fcn.00403b70
lea eax, [esp + 0x494]
push eax
lea ecx, [esp + 0x16c]
push str._sMicrosoftWindowsTemporary_Internet_Files
push ecx
mov byte [esp + 0x49d4], 5
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 6
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 5
call fcn.00403bb0
cmp dword [esp + 0x19c], edi
mov eax, dword [esp + 0x188]
mov dword [esi + 0x7c], ebx
jae 0x40e2f5
lea eax, [esp + 0x188]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040da00
mov edx, dword [esi + 0xbc]
push ebx
push 0x1c
push 0x402
push edx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x90], 0x1c
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x184]
call fcn.00403c10
lea eax, [esp + 0x494]
push eax
lea ecx, [esp + 0x16c]
push str._sGoogleChromeUser_DataDefaultCache
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 7
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 5
call fcn.00403bb0
cmp dword [esp + 0x19c], edi
mov eax, dword [esp + 0x188]
jae 0x40e395
lea eax, [esp + 0x188]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x184]
call fcn.00403bb0
jmp 0x40e3cf
push 0x4ca
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x1b8], edi
jb 0x40e708
mov eax, dword [esp + 0x1a4]
push eax
call fcn.00411d3b
add esp, 4
jmp 0x40e708
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x80
call edi
cmp eax, ebx
jne 0x40e449
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x398]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.TempFile
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], 7
mov dword [esp + 0x1bc], ebx
mov word [esp + 0x1ac], bx
call fcn.004044c0
lea eax, [esp + 0x394]
push eax
lea ecx, [esp + 0x16c]
push 0x4512f0
push ecx
mov byte [esp + 0x49d4], 8
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x49d4], 9
call fcn.004043d0
mov edi, 8
mov byte [esp + 0x49c8], 8
cmp dword [esp + 0x180], edi
jb 0x40e4d8
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x1b4], ebx
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jne 0x40e4f1
mov eax, dword [esp + 0x18]
push eax
jmp 0x40e6dd
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 0xa
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40e523
lea eax, [esp + 0x1c0]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 8
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40e6c1
push 0x4eb
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x498]
push ebx
push ecx
call fcn.00430450
add esp, 0xc
push ebx
push 0x1c
lea edx, [esp + 0x49c]
push edx
push ebx
call ebp
push 0x450da0
lea ecx, [esp + 0x188]
call fcn.00403b70
lea eax, [esp + 0x494]
push eax
lea ecx, [esp + 0x16c]
push str._sMicrosoftWindowsTemporary_Internet_Files
push ecx
mov byte [esp + 0x49d4], 0xb
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 0xc
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0xb
call fcn.00403bb0
cmp dword [esp + 0x19c], edi
mov eax, dword [esp + 0x188]
jae 0x40e5fe
lea eax, [esp + 0x188]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040da00
mov edx, dword [esi + 0xbc]
push ebx
push 0x1c
push 0x402
push edx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x90], 0x1c
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x184]
call fcn.00403c10
lea eax, [esp + 0x494]
push eax
lea ecx, [esp + 0x16c]
push str._sGoogleChromeUser_DataDefaultCache
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 0xd
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0xb
call fcn.00403bb0
cmp dword [esp + 0x19c], edi
mov eax, dword [esp + 0x188]
jae 0x40e69e
lea eax, [esp + 0x188]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x184]
call fcn.00403bb0
jmp 0x40e6d8
push 0x506
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x1b8], edi
jb 0x40e703
mov eax, dword [esp + 0x1a4]
push eax
call fcn.00411d3b
add esp, 4
mov edi, 8
mov ecx, dword [esi + 0xbc]
push ebx
push 0x1e
push 0x402
push ecx
mov dword [esi + 0x90], 0x1e
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0040d730
test eax, eax
lea edx, [esp + 0x18]
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x80
push edx
je 0x40e9ea
push 0x20119
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x525
push str.xxxx
push str.__s__d___RegOpenKeyEx_lResult_:__d___GetLastError_:__d
call fcn.00443b10
add esp, 0x14
cmp edi, ebx
jne 0x40e7a7
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x398]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push str.HistoryFile
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], 7
mov dword [esp + 0x1bc], ebx
mov word [esp + 0x1ac], bx
call fcn.004044c0
lea ecx, [esp + 0x394]
push ecx
lea edx, [esp + 0x16c]
push 0x4512f0
push edx
mov byte [esp + 0x49d4], 0xe
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x49d4], 0xf
call fcn.004043d0
mov edi, 8
mov byte [esp + 0x49c8], 0xe
cmp dword [esp + 0x180], edi
jb 0x40e836
mov eax, dword [esp + 0x16c]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x1b8], edi
mov eax, dword [esp + 0x1a4]
jae 0x40e84d
lea eax, [esp + 0x1a4]
push eax
push 0x52d
push str.xxxx
push str.__s__d___T_Data_:__s
call fcn.00443b10
add esp, 0x10
cmp dword [esp + 0x1b4], ebx
jne 0x40e878
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x40e9c4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 0x10
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40e8aa
lea eax, [esp + 0x1c0]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 0xe
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40e9a8
push 0x536
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x104
lea edx, [esp + 0x498]
push ebx
push edx
call fcn.00430450
add esp, 0xc
push ebx
push 0x1c
lea eax, [esp + 0x49c]
push eax
push ebx
call ebp
push 0x450da0
lea ecx, [esp + 0x1c0]
call fcn.00403b70
lea ecx, [esp + 0x494]
push ecx
lea edx, [esp + 0x16c]
push str._sMicrosoftWindowsHistory
push edx
mov byte [esp + 0x49d4], 0x11
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x49d4], 0x12
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x11
call fcn.00403bb0
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40e985
lea eax, [esp + 0x1c0]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x1bc]
call fcn.00403bb0
jmp 0x40e9bf
push 0x546
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x1b8], edi
jb 0x40ec36
mov ecx, dword [esp + 0x1a4]
jmp 0x40ec2d
push 0x20019
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40ea27
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x398]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push str.HistoryFile
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x18c]
mov dword [esp + 0x1a4], 7
mov dword [esp + 0x1a0], ebx
mov word [esp + 0x190], bx
call fcn.004044c0
lea ecx, [esp + 0x394]
push ecx
lea edx, [esp + 0x16c]
push 0x4512f0
push edx
mov byte [esp + 0x49d4], 0x13
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 0x14
call fcn.004043d0
mov byte [esp + 0x49c8], 0x13
cmp dword [esp + 0x180], edi
jb 0x40eab1
mov eax, dword [esp + 0x16c]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x198], ebx
jne 0x40eac4
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x40ec10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 0x15
cmp dword [esp + 0x1b8], edi
mov eax, dword [esp + 0x1a4]
jae 0x40eaf6
lea eax, [esp + 0x1a4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 0x13
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40ebf4
push 0x567
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x104
lea edx, [esp + 0x498]
push ebx
push edx
call fcn.00430450
add esp, 0xc
push ebx
push 0x1c
lea eax, [esp + 0x49c]
push eax
push ebx
call ebp
push 0x450da0
lea ecx, [esp + 0x1c0]
call fcn.00403b70
lea ecx, [esp + 0x494]
push ecx
lea edx, [esp + 0x16c]
push str._sMicrosoftWindowsHistory
push edx
mov byte [esp + 0x49d4], 0x16
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x49d4], 0x17
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x16
call fcn.00403bb0
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40ebd1
lea eax, [esp + 0x1c0]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x1bc]
call fcn.00403bb0
jmp 0x40ec0b
push 0x577
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x19c], edi
jb 0x40ec36
mov ecx, dword [esp + 0x188]
push ecx
call fcn.00411d3b
add esp, 4
mov edx, dword [esi + 0xbc]
push ebx
push 0x23
push 0x402
push edx
mov dword [esi + 0x90], 0x23
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0040d730
test eax, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x80
push eax
je 0x40eeec
push 0x20119
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x596
push str.xxxx
push str.__s__d___RegOpenKeyEx_lResult_:__d___GetLastError_:__d
call fcn.00443b10
add esp, 0x14
cmp edi, ebx
jne 0x40ecd5
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x398]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.XEntryFile
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], 7
mov dword [esp + 0x1bc], ebx
mov word [esp + 0x1ac], bx
call fcn.004044c0
lea edx, [esp + 0x394]
push edx
lea eax, [esp + 0x16c]
push 0x4512f0
push eax
mov byte [esp + 0x49d4], 0x18
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x49d4], 0x19
call fcn.004043d0
mov edi, 8
mov byte [esp + 0x49c8], 0x18
cmp dword [esp + 0x180], edi
jb 0x40ed64
mov ecx, dword [esp + 0x16c]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x1b8], edi
mov eax, dword [esp + 0x1a4]
jae 0x40ed7b
lea eax, [esp + 0x1a4]
push eax
push 0x59e
push str.xxxx
push str.__s__d___T_Data_:__s
call fcn.00443b10
add esp, 0x10
cmp dword [esp + 0x1b4], ebx
jne 0x40eda6
mov edx, dword [esp + 0x18]
push edx
jmp 0x40eec6
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 0x1a
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40edd8
lea eax, [esp + 0x1c0]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 0x18
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40eeaa
push 0x5a7
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x450da0
lea ecx, [esp + 0x1c0]
call fcn.00403b70
lea eax, [esp + 0x168]
push str.C:WindowsDownloaded_Program_Files
push eax
mov byte [esp + 0x49d0], 0x1b
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x49d4], 0x1c
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x1b
call fcn.00403bb0
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40ee87
lea eax, [esp + 0x1c0]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x1bc]
call fcn.00403bb0
jmp 0x40eec1
push 0x5b4
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x1b8], edi
jb 0x40f111
mov edx, dword [esp + 0x1a4]
jmp 0x40f108
push 0x20019
push ebx
push str.SOFTWARESOLUSSEUMWiseCapSetting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40ef29
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x398]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.XEntryFile
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 0x450da0
lea ecx, [esp + 0x18c]
mov dword [esp + 0x1a4], 7
mov dword [esp + 0x1a0], ebx
mov word [esp + 0x190], bx
call fcn.004044c0
lea edx, [esp + 0x394]
push edx
lea eax, [esp + 0x16c]
push 0x4512f0
push eax
mov byte [esp + 0x49d4], 0x1d
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x190]
mov byte [esp + 0x49d4], 0x1e
call fcn.004043d0
mov edi, 8
mov byte [esp + 0x49c8], 0x1d
cmp dword [esp + 0x180], edi
jb 0x40efb8
mov ecx, dword [esp + 0x16c]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x198], ebx
jne 0x40efcb
mov edx, dword [esp + 0x18]
push edx
jmp 0x40f0eb
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4528d0
call fcn.00403b70
mov byte [esp + 0x49e4], 0x1f
cmp dword [esp + 0x1b8], edi
mov eax, dword [esp + 0x1a4]
jae 0x40effd
lea eax, [esp + 0x1a4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00403b70
mov byte [esp + 0x4a00], 0x1d
call fcn.00443d60
add esp, 0x38
cmp al, bl
je 0x40f0cf
push 0x5d5
push str.xxxx
push str.__s__d___Y
call fcn.00443b10
add esp, 0xc
push 0x450da0
lea ecx, [esp + 0x1c0]
call fcn.00403b70
lea eax, [esp + 0x168]
push str.C:WindowsDownloaded_Program_Files
push eax
mov byte [esp + 0x49d0], 0x20
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x49d4], 0x21
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x20
call fcn.00403bb0
cmp dword [esp + 0x1d4], edi
mov eax, dword [esp + 0x1c0]
jae 0x40f0ac
lea eax, [esp + 0x1c0]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040b810
call fcn.0040d780
add esp, 4
lea ecx, [esp + 0x1bc]
call fcn.00403bb0
jmp 0x40f0e6
push 0x5e1
push str.xxxx
push str.__s__d___N
call fcn.00443b10
add esp, 0xc
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x49c8], bl
cmp dword [esp + 0x19c], edi
jb 0x40f111
mov edx, dword [esp + 0x188]
push edx
call fcn.00411d3b
add esp, 4
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [esi + 0xbc]
push ebx
push 0x28
push 0x402
push ecx
mov dword [esi + 0x90], 0x28
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x450da0
lea ecx, [esp + 0x1fc]
mov dword [esp + 0x214], 7
mov dword [esp + 0x210], ebx
mov word [esp + 0x200], bx
call fcn.004044c0
lea edx, [esp + 0x1f4]
push edx
mov byte [esp + 0x49cc], 0x22
call fcn.0040bd50
cmp al, bl
jne 0x40f1cf
lea eax, [esp + 0x168]
push str.OS_Not_Find
push eax
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x200]
mov byte [esp + 0x49d4], 0x23
call fcn.004043d0
mov byte [esp + 0x49c8], 0x22
cmp dword [esp + 0x180], 8
jb 0x40f1cf
mov ecx, dword [esp + 0x16c]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x20c], 8
mov eax, dword [esp + 0x1f8]
jae 0x40f1e7
lea eax, [esp + 0x1f8]
push eax
push 0x60a
push str.xxxx
push str.__s__d___WindowVersion_:__s
call fcn.00443b10
mov edx, dword [esi + 0xbc]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
push ebx
push 0x2b
push 0x402
push edx
mov dword [esi + 0x90], 0x2b
call ebp
push 0x450dc0
push 0x451ae4
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x40f24f
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov ecx, dword [esp + 0x3c]
push ecx
push 0x61f
push str.xxxx
push str.__s__d___bIs64BitOS_:__d
call fcn.00443b10
add esp, 0x10
push ebx
push 0x450da0
lea ecx, [esp + 0x234]
mov dword [esp + 0x24c], 7
mov dword [esp + 0x248], ebx
mov word [esp + 0x238], bx
call fcn.004044c0
mov byte [esp + 0x49c8], 0x24
cmp dword [esp + 0x3c], 1
jl 0x40f2ef
lea edx, [esp + 0x168]
push str.64Bit
push edx
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x238]
mov byte [esp + 0x49d4], 0x25
call fcn.004043d0
mov byte [esp + 0x49c8], 0x24
cmp dword [esp + 0x180], 8
jb 0x40f33e
mov eax, dword [esp + 0x16c]
push eax
jmp 0x40f336
lea ecx, [esp + 0x168]
push str.32Bit
push ecx
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x238]
mov byte [esp + 0x49d4], 0x26
call fcn.004043d0
mov byte [esp + 0x49c8], 0x24
cmp dword [esp + 0x180], 8
jb 0x40f33e
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
mov eax, dword [esi + 0xbc]
push ebx
push 0x2e
push 0x402
push eax
mov dword [esi + 0x90], 0x2e
call ebp
push ebx
push 0x450da0
lea ecx, [esp + 0x218]
mov dword [esp + 0x230], 7
mov dword [esp + 0x22c], ebx
mov word [esp + 0x21c], bx
call fcn.004044c0
push esi
lea edi, [esp + 0x214]
mov byte [esp + 0x49cc], 0x27
call fcn.0040c160
test al, al
mov edi, 8
jne 0x40f409
cmp dword [esp + 0x228], edi
mov eax, dword [esp + 0x214]
jae 0x40f3ba
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x16c]
push str._sNo_Backup_Drive
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x21c]
mov byte [esp + 0x49d4], 0x28
call fcn.004043d0
mov byte [esp + 0x49c8], 0x27
cmp dword [esp + 0x180], edi
jb 0x40f409
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
mov eax, dword [esi + 0xbc]
push ebx
push 0x32
push 0x402
push eax
mov dword [esi + 0x90], 0x32
call ebp
push ebx
push 0x450da0
lea ecx, [esp + 0x26c]
mov dword [esp + 0x284], 7
mov dword [esp + 0x280], ebx
mov word [esp + 0x270], bx
call fcn.004044c0
lea ecx, [esp + 0x264]
push ecx
mov ecx, esi
mov byte [esp + 0x49cc], 0x29
call fcn.0040c3d0
test al, al
jne 0x40f4b9
lea edx, [esp + 0x168]
push str.DiskFreeSpaceCheck_Err
push edx
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x270]
mov byte [esp + 0x49d4], 0x2a
call fcn.004043d0
mov byte [esp + 0x49c8], 0x29
cmp dword [esp + 0x180], edi
jb 0x40f4b9
mov eax, dword [esp + 0x16c]
push eax
call fcn.00411d3b
add esp, 4
mov ecx, dword [esi + 0xbc]
push ebx
push 0x37
push 0x402
push ecx
mov dword [esi + 0x90], 0x37
call ebp
push 0x450da0
lea ecx, [esp + 0x2d8]
call fcn.00403b70
push ebx
lea edx, [esp + 0x68]
push 0x40
push edx
mov byte [esp + 0x49d4], 0x2b
call fcn.00430450
add esp, 0xc
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x68], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
push ecx
push edx
push 0x662
push str.xxxx
push str.__s__d___memoryInfo___12u
call fcn.00443b10
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
add esp, 0x14
push ebx
push 0xf4240
push eax
push ecx
call fcn.00444ef0
push edx
push eax
lea edx, [esp + 0x170]
push str._d_MByte
push edx
call fcn.00443fd0
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x2e0]
mov byte [esp + 0x49d4], 0x2c
call fcn.004043d0
mov byte [esp + 0x49c8], 0x2b
cmp dword [esp + 0x180], edi
jb 0x40f59c
mov eax, dword [esp + 0x16c]
push eax
call fcn.00411d3b
add esp, 4
mov ecx, dword [esi + 0xbc]
push ebx
push 0x3c
push 0x402
push ecx
mov dword [esi + 0x90], 0x3c
call ebp
push 0x450da0
lea ecx, [esp + 0x1dc]
call fcn.00403b70
lea edx, [esp + 0x1d8]
push edx
mov byte [esp + 0x49cc], 0x2d
call fcn.0040ce30
cmp eax, ebx
je 0x40f6cb
cmp eax, 0xe8
jne 0x40f656
cmp dword [esp + 0x1f0], edi
mov eax, dword [esp + 0x1dc]
jae 0x40f603
lea eax, [esp + 0x1dc]
push eax
lea eax, [esp + 0x16c]
push str.No_adapter_:__s
push eax
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x49d4], 0x2e
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x2d
call fcn.00403bb0
push 0x677
push str.xxxx
push str.__s__d___No_adapter_information_exists_for_the_local_computer
jmp 0x40f6c3
cmp eax, 0x32
jne 0x40f6cb
cmp dword [esp + 0x1f0], edi
mov eax, dword [esp + 0x1dc]
jae 0x40f672
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0x16c]
push str.GetAdaptersInfo_is_not_:__s
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x49d4], 0x2f
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x2d
call fcn.00403bb0
push 0x67c
push str.xxxx
push str.__s__d___GetAdaptersInfo_is_not_supported_by_the_operating_system_running_on_the_local_computer
call fcn.00443b10
add esp, 0xc
mov edx, dword [esi + 0xbc]
push ebx
push 0x41
push 0x402
push edx
mov dword [esi + 0x90], 0x41
call ebp
push 0x450da0
lea ecx, [esp + 0x24c]
call fcn.00403b70
lea eax, [esp + 0x248]
push eax
mov byte [esp + 0x49cc], 0x30
call fcn.0040d010
test eax, eax
jne 0x40f776
cmp dword [esp + 0x260], edi
mov eax, dword [esp + 0x24c]
jae 0x40f727
lea eax, [esp + 0x24c]
push eax
lea ecx, [esp + 0x16c]
push str.DiskSerialNumber_fail_:__s
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x254]
mov byte [esp + 0x49d4], 0x31
call fcn.004043d0
mov byte [esp + 0x49c8], 0x30
cmp dword [esp + 0x180], edi
jb 0x40f776
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
mov eax, dword [esi + 0xbc]
push ebx
push 0x46
push 0x402
push eax
mov dword [esi + 0x90], 0x46
call ebp
push str.C:Program_FilesSolusseumWiseCapSetup_WiseCap_korean.exe
lea ecx, [esp + 0x2bc]
call fcn.00403b70
mov byte [esp + 0x49c8], 0x32
cmp dword [esp + 0x2d0], edi
mov eax, dword [esp + 0x2bc]
jae 0x40f7c1
lea eax, [esp + 0x2bc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00403b70
call fcn.0040d610
add esp, 0x1c
push 0x450da0
lea ecx, [esp + 0x284]
call fcn.00403b70
mov byte [esp + 0x49c8], 0x33
push 0x450da0
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x2f], 1
mov byte [esp + 0x2e], 1
mov dword [esp + 0x34], ebx
call fcn.00403b70
push 0x450da0
lea ecx, [esp + 0x310]
mov byte [esp + 0x49cc], 0x34
call fcn.00403b70
push 0x7fe
lea ecx, [esp + 0x9c2]
push ebx
mov byte [esp + 0x49d0], 0x35
push ecx
mov word [esp + 0x9c8], bx
call fcn.00430450
add esp, 0xc
push 0x7fe
lea edx, [esp + 0x21c2]
push ebx
push edx
mov word [esp + 0x21c8], bx
call fcn.00430450
add esp, 0xc
lea eax, [esp + 0x21bc]
push 0x400
push eax
call fcn.004442f0
push 0x800
lea ecx, [esp + 0x9c8]
push ebx
push ecx
call fcn.00430450
add esp, 0x14
lea ecx, [esp + 0x30c]
call fcn.00403c10
lea edx, [esp + 0x168]
push str.MNM:FALSE:TRUE
push edx
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x318]
mov byte [esp + 0x49d4], 0x36
call fcn.004043d0
mov byte [esp + 0x49c8], 0x35
cmp dword [esp + 0x180], edi
jb 0x40f8ef
mov eax, dword [esp + 0x16c]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x324], edi
mov eax, dword [esp + 0x310]
jae 0x40f906
lea eax, [esp + 0x310]
push eax
push 0x4512f0
lea edx, [esp + 0x9c4]
call fcn.00405830
lea ecx, [esp + 0x170]
push str.C:Program_FilesSolusseumWiseCapSetup_WiseCap_korean.exe
push ecx
call fcn.00443fd0
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x49d4], 0x37
call fcn.004043d0
mov byte [esp + 0x49c8], 0x35
cmp dword [esp + 0x180], edi
jb 0x40f966
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
push 0x44
lea eax, [esp + 0x120]
push ebx
push eax
call fcn.00430450
add esp, 0xc
push 0x7fe
lea ecx, [esp + 0x19c2]
push ebx
push ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x128], 0x44
mov word [esp + 0x19c8], bx
call fcn.00430450
mov eax, dword [esp + 0x1cc]
add esp, 0xc
cmp dword [esp + 0x1d4], edi
jae 0x40f9c9
lea eax, [esp + 0x1c0]
lea edx, [esp + 0x9bc]
push edx
push eax
push str.__s___s
lea eax, [esp + 0x19c8]
push 0x400
push eax
call fcn.0042e9bf
add esp, 0x14
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x120]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x19dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40fa6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x16c]
push str.rec_cp__ld
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x28c]
mov byte [esp + 0x49d4], 0x38
call fcn.004043d0
mov byte [esp + 0x49c8], 0x35
cmp dword [esp + 0x180], edi
jb 0x40fa67
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
mov byte [esp + 0x2b], bl
mov eax, dword [esi + 0xbc]
push ebx
push 0x4b
push 0x402
push eax
mov dword [esi + 0x90], 0x4b
call ebp
cmp byte [esp + 0x2b], bl
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x410078
mov ecx, dword [esp + 0x40]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push ecx
call ebp
cmp eax, 0xffffffff
je 0x40fac9
lea ebx, [ebx]
cmp eax, ebx
je 0x40fac9
cmp eax, 0x80
je 0x40fac9
mov edx, dword [esp + 0x40]
push 0x64
push edx
call ebp
cmp eax, 0xffffffff
jne 0x40fab0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x16c]
push str.rec_wfs__ld
push eax
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x28c]
mov byte [esp + 0x49d4], 0x39
call fcn.004043d0
lea ecx, [esp + 0x168]
mov byte [esp + 0x49c8], 0x35
call fcn.00403bb0
mov ecx, dword [esp + 0x44]
push ecx
call edi
mov edx, dword [esp + 0x40]
push edx
call edi
mov eax, dword [esi + 0xbc]
push ebx
push 0x50
push 0x402
push eax
mov dword [esi + 0x90], 0x50
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x30]
push ecx
push str.Recovery_Install_Exit_Code_:__ld
call fcn.00443b10
add esp, 8
cmp dword [esp + 0x30], ebx
jge 0x40fbc1
lea edx, [esp + 0x494]
push edx
call fcn.00410e70
mov byte [esp + 0x49c8], 0x3a
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x494]
mov dword [esp + 0x508], eax
call fcn.0041d1d7
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.C:Program_FilesSolusseum
call fcn.0040b810
mov ecx, esi
call fcn.0040d460
lea ecx, [esp + 0x494]
mov byte [esp + 0x49c8], 0x35
call fcn.00410f00
jmp 0x410078
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call fcn.0040d730
test eax, eax
je 0x40fc19
lea edx, [esp + 0x18]
push edx
push 0xf013f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x18]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.AUOptions
push ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x18]
push edx
jmp 0x40fc5b
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.AUOptions
push edx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov edx, dword [esi + 0xbc]
push ebx
push 0x55
push 0x402
push edx
mov dword [esi + 0x90], 0x55
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x450da0
lea ecx, [esp + 0x16c]
call fcn.00403b70
push 0x450da0
lea ecx, [esp + 0x348]
mov byte [esp + 0x49cc], 0x3b
call fcn.00403b70
push 0x7fe
lea eax, [esp + 0x11c2]
push ebx
mov byte [esp + 0x49d0], 0x3c
push eax
mov word [esp + 0x11c8], bx
call fcn.00430450
add esp, 0xc
push 0x7fe
lea ecx, [esp + 0x29c2]
push ebx
push ecx
mov word [esp + 0x29c8], bx
call fcn.00430450
add esp, 0xc
lea edx, [esp + 0x29bc]
push 0x400
push edx
call fcn.004442f0
push 0x800
lea eax, [esp + 0x11c8]
push ebx
push eax
call fcn.00430450
add esp, 0x14
lea ecx, [esp + 0x344]
call fcn.00403c10
lea ecx, [esp + 0x184]
push str._iWISECAPLOVE12_
push ecx
call fcn.00443fd0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x350]
mov byte [esp + 0x49d4], 0x3d
call fcn.004043d0
lea ecx, [esp + 0x184]
mov byte [esp + 0x49c8], 0x3c
call fcn.00403bb0
mov eax, dword [esp + 0x348]
mov edi, 8
cmp dword [esp + 0x35c], edi
jae 0x40fd8a
lea eax, [esp + 0x348]
push eax
push 0x4512f0
lea edx, [esp + 0x11c4]
call fcn.00405830
lea edx, [esp + 0x18c]
push str.C:Program_FilesSolusseumWiseCapWiseCapService.exe
push edx
call fcn.00443fd0
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x174]
mov byte [esp + 0x49d4], 0x3e
call fcn.004043d0
lea ecx, [esp + 0x184]
mov byte [esp + 0x49c8], 0x3c
call fcn.00403bb0
push 0x44
lea eax, [esp + 0xd8]
push ebx
push eax
call fcn.00430450
add esp, 0xc
push 0x7fe
lea ecx, [esp + 0x31c2]
push ebx
push ecx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0xe0], 0x44
mov word [esp + 0x31c8], bx
call fcn.00430450
mov eax, dword [esp + 0x178]
add esp, 0xc
cmp dword [esp + 0x180], edi
jae 0x40fe4c
lea eax, [esp + 0x16c]
lea edx, [esp + 0x11bc]
push edx
push eax
push str.__s___s
lea eax, [esp + 0x31c8]
push 0x400
push eax
call fcn.0042e9bf
add esp, 0x14
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0xd8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x31dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40fee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x188]
push str.svr_cp__ld
push ecx
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x28c]
mov byte [esp + 0x49d4], 0x3f
call fcn.004043d0
lea ecx, [esp + 0x184]
mov byte [esp + 0x49c8], 0x3c
call fcn.00403bb0
mov byte [esp + 0x2a], bl
mov edx, dword [esi + 0xbc]
push ebx
push 0x5a
push 0x402
push edx
mov dword [esi + 0x90], 0x5a
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [esp + 0x2a], bl
je 0x410060
mov eax, dword [esp + 0x1a0]
push 0x64
push eax
mov dword [esp + 0x24], 0xffffffff
call ebp
cmp eax, 0xffffffff
je 0x40fff3
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebx
je 0x40fff3
cmp eax, 0x80
je 0x40fff3
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x194]
push ecx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
call edi
test eax, eax
je 0x40ffda
lea ecx, [ecx]
cmp dword [esp + 0x188], 0x12
je 0x40ffda
push ebx
push ebx
push ebx
lea edx, [esp + 0x190]
push edx
call ebp
test eax, eax
je 0x40ffc7
lea eax, [esp + 0x184]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x184]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0x194]
push edx
call edi
test eax, eax
jne 0x40ff90
mov eax, dword [esp + 0x1a0]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x40ff36
mov edx, dword [esp + 0x1a0]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x188]
push str.svr_wfs__ld
push eax
call fcn.00443fd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x28c]
mov byte [esp + 0x49d4], 0x40
call fcn.004043d0
lea ecx, [esp + 0x184]
call fcn.00403bb0
mov ecx, dword [esp + 0x1a4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x1a0]
push edx
call edi
lea ecx, [esp + 0x344]
call fcn.00403bb0
lea ecx, [esp + 0x168]
call fcn.00403bb0
mov edi, 8
cmp dword [esp + 0x324], edi
jb 0x410096
mov eax, dword [esp + 0x310]
push eax
call fcn.00411d3b
add esp, 4
mov byte [esp + 0x49c8], 0x33
cmp dword [esp + 0x1d4], edi
mov dword [esp + 0x324], 7
mov dword [esp + 0x320], ebx
mov word [esp + 0x310], bx
jb 0x4100d1
mov ecx, dword [esp + 0x1c0]
push ecx
call fcn.00411d3b
add esp, 4
mov edx, dword [esi + 0xbc]
push ebx
push 0x5f
push 0x402
push edx
mov dword [esi + 0x90], 0x5f
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 0x57
mov cl, 0x48
mov dl, 0x4a
mov byte [esp + 0x36f], cl
mov byte [esp + 0x37d], cl
mov byte [esp + 0x386], cl
mov cl, 0x53
mov byte [esp + 0x363], al
mov byte [esp + 0x370], al
mov byte [esp + 0x376], al
mov byte [esp + 0x37e], al
mov byte [esp + 0x391], al
mov byte [esp + 0x360], 0x4f
mov byte [esp + 0x361], 0x5b
mov byte [esp + 0x362], 0x5b
mov byte [esp + 0x364], 0x21
mov byte [esp + 0x365], 0x16
mov byte [esp + 0x366], 0x16
mov byte [esp + 0x367], 0x4b
mov byte [esp + 0x368], 0x49
mov byte [esp + 0x369], 0x15
mov byte [esp + 0x36a], 0x5e
mov byte [esp + 0x36b], 0x50
mov byte [esp + 0x36c], 0x5a
mov byte [esp + 0x36d], 0x4c
mov byte [esp + 0x36e], dl
mov byte [esp + 0x371], 0x15
mov byte [esp + 0x372], 0x52
mov byte [esp + 0x373], 0x59
mov byte [esp + 0x374], 0x16
mov byte [esp + 0x375], 0x5e
mov byte [esp + 0x377], 0x46
mov byte [esp + 0x378], 0x5e
mov byte [esp + 0x379], 0x50
mov byte [esp + 0x37a], 0x5a
mov byte [esp + 0x37b], 0x4c
mov byte [esp + 0x37c], dl
mov byte [esp + 0x37f], 0x17
mov byte [esp + 0x380], 0x19
mov byte [esp + 0x381], 0x16
mov byte [esp + 0x382], 0x30
mov byte [esp + 0x383], 0x55
mov byte [esp + 0x384], 0x5a
mov byte [esp + 0x385], 0x5b
mov byte [esp + 0x387], cl
mov byte [esp + 0x388], cl
mov byte [esp + 0x389], 0x2a
mov byte [esp + 0x38a], 0x4f
mov byte [esp + 0x38b], 0x4c
mov byte [esp + 0x38c], dl
mov byte [esp + 0x38d], 0x52
mov byte [esp + 0x38e], 0x15
mov byte [esp + 0x38f], 0x51
mov byte [esp + 0x390], 0x5a
mov byte [esp + 0x392], 0x26
mov byte [esp + 0x393], bl
lea eax, [esp + 0x360]
add byte [eax], 0x19
add eax, 1
cmp byte [eax], bl
jne 0x410291
push 0x206
lea eax, [esp + 0x7ba]
push ebx
push eax
mov word [esp + 0x7c0], bx
call fcn.00430450
add esp, 0xc
push 0x104
lea ecx, [esp + 0x7b8]
push ecx
lea edx, [esp + 0x368]
push edx
call fcn.00443cb0
add esp, 0xc
push 0x450da0
lea ecx, [esp + 0x2f4]
call fcn.00403b70
mov byte [esp + 0x49c8], 0x41
cmp dword [esp + 0x298], edi
mov ebp, dword [esp + 0x284]
jae 0x410306
lea ebp, [esp + 0x284]
mov eax, 8
cmp dword [esp + 0x2b4], eax
jb 0x410321
mov ecx, dword [esp + 0x2a0]
mov dword [esp + 0x18], ecx
jmp 0x41032c
lea edx, [esp + 0x2a0]
mov dword [esp + 0x18], edx
cmp dword [esp + 0x260], eax
jb 0x410342
mov ecx, dword [esp + 0x24c]
mov dword [esp + 0x2c], ecx
jmp 0x41034d
lea edx, [esp + 0x24c]
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x1f0], eax
jb 0x410363
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x20], ecx
jmp 0x41036e
lea edx, [esp + 0x1dc]
mov dword [esp + 0x20], edx
cmp dword [esp + 0x2ec], eax
jb 0x410384
mov ecx, dword [esp + 0x2d8]
mov dword [esp + 0x1c], ecx
jmp 0x41038f
lea edx, [esp + 0x2d8]
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x27c], eax
mov edi, dword [esp + 0x268]
jae 0x4103a6
lea edi, [esp + 0x268]
cmp dword [esp + 0x228], eax
mov edx, dword [esp + 0x214]
jae 0x4103bd
lea edx, [esp + 0x214]
cmp dword [esp + 0x244], eax
mov ecx, dword [esp + 0x230]
jae 0x4103d4
lea ecx, [esp + 0x230]
cmp dword [esp + 0x20c], eax
mov eax, dword [esp + 0x1f8]
jae 0x4103eb
lea eax, [esp + 0x1f8]
push ebp
mov ebp, dword [esp + 0x1c]
push str.ErrCode
push ebp
mov ebp, dword [esp + 0x38]
push str.BootTime
push ebp
mov ebp, dword [esp + 0x34]
push str.DiskSerial
push ebp
mov ebp, dword [esp + 0x38]
push str.Mac
push ebp
push str.Memory
push edi
push str.FreeSize
push edx
push str.Drive
push ecx
push str.Bit
push eax
push 0x452b0c
lea eax, [esp + 0x7fc]
push eax
lea ecx, [esp + 0x1b4]
push str._s_s_s
push ecx
call fcn.00443fd0
add esp, 0x54
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x2fc]
mov byte [esp + 0x49d4], 0x42
call fcn.004043d0
mov byte [esp + 0x49c8], 0x41
cmp dword [esp + 0x180], 8
jb 0x410488
mov edx, dword [esp + 0x16c]
push edx
call fcn.00411d3b
add esp, 4
push 0xfff
lea eax, [esp + 0x39c1]
push ebx
push eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x39c8], bl
call fcn.00430450
add esp, 0xc
push 0x45258c
lea ecx, [esp + 0x32c]
call fcn.00405720
push ebx
push ebx
push ebx
push 1
push 0x451ec0
mov byte [esp + 0x49dc], 0x43
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebp, eax
cmp ebp, ebx
jne 0x4104f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7e8
push str.xxxx
push str.__s__d___hInternet_Error___ld_
call fcn.00443b10
add esp, 0x10
cmp dword [esp + 0x308], 8
mov eax, dword [esp + 0x2f4]
jae 0x41050e
lea eax, [esp + 0x2f4]
push ebx
push SysReAllocString
push ebx
push ebx
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
cmp edi, ebx
jne 0x410549
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7fa
push str.xxxx
push str.__s__d___InternetOpenUrl_Error___ld_
call fcn.00443b10
add esp, 0x10
push 0x1000
lea ecx, [esp + 0x39c0]
push ebx
push ecx
call fcn.00430450
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea edx, [esp + 0x34]
push edx
push 0x1000
lea eax, [esp + 0x39c4]
push eax
push edi
call ebp
cmp dword [esp + 0x34], ebx
je 0x4105e1
lea eax, [esp + 0x39bc]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410590
sub eax, edx
push eax
lea ecx, [esp + 0x39c0]
push ecx
lea ecx, [esp + 0x330]
call fcn.0040b0c0
push 0x1000
lea edx, [esp + 0x39c0]
push ebx
push edx
call fcn.00430450
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push 0x1000
lea ecx, [esp + 0x39c4]
push ecx
push edi
call ebp
cmp dword [esp + 0x34], ebx
jne 0x410580
mov ebp, 1
cmp eax, ebp
je 0x410601
push 0x80d
push str.xxxx
push str.__s__d___Error_:_400
call fcn.00443b10
add esp, 0xc
cmp dword [esp + 0x33c], ebp
jge 0x410621
push 0x815
push str.xxxx
push str.__s__d___Error_:_412
call fcn.00443b10
add esp, 0xc
mov eax, dword [esp + 0x2bc]
mov edi, 8
cmp dword [esp + 0x2d0], edi
jae 0x41063d
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 0xbc]
push ebx
push 0x64
push 0x402
push edx
mov dword [esi + 0x90], 0x64
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0xa8]
push eax
call fcn.00405850
lea ecx, [esp + 0x38]
push ecx
push 0x28
mov byte [esp + 0x49d0], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4106a7
push 0x834
push str.xxxx
push str.__s__d___OpenProcessToken_failed.
call fcn.00443b10
add esp, 0xc
lea edx, [esp + 0x58]
push edx
push 0x450e24
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebx
lea eax, [esp + 0x60]
push eax
push ebx
mov dword [esp + 0x68], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ecx
mov dword [esp + 0x78], 2
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4106fd
push 0x83c
push str.xxxx
push str.__s__d___AdjustTokenPrivileges_enable_failed.
call fcn.00443b10
add esp, 0xc
push 1
push 1
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
jne 0x410964
call esi
push eax
push 0x844
push str.xxxx
push str.__s__d___Abort_System_Shutdown___ErrorCode_d_
call fcn.00443b10
add esp, 0x10
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea edx, [esp + 0xa8]
push edx
mov byte [esp + 0x49cc], 0x43
call fcn.0040a610
cmp dword [esp + 0x340], 0x10
jb 0x410764
mov eax, dword [esp + 0x32c]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x308], edi
mov dword [esp + 0x340], 0xf
mov dword [esp + 0x33c], ebx
mov byte [esp + 0x32c], bl
jb 0x410796
mov ecx, dword [esp + 0x2f4]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x298], edi
mov esi, 7
mov dword [esp + 0x308], esi
mov dword [esp + 0x304], ebx
mov word [esp + 0x2f4], bx
jb 0x4107ca
mov edx, dword [esp + 0x284]
push edx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x2d0], edi
mov dword [esp + 0x298], esi
mov dword [esp + 0x294], ebx
mov word [esp + 0x284], bx
jb 0x4107f9
mov eax, dword [esp + 0x2bc]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x260], edi
mov dword [esp + 0x2d0], esi
mov dword [esp + 0x2cc], ebx
mov word [esp + 0x2bc], bx
jb 0x410828
mov ecx, dword [esp + 0x24c]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x1f0], edi
mov dword [esp + 0x260], esi
mov dword [esp + 0x25c], ebx
mov word [esp + 0x24c], bx
jb 0x410857
mov edx, dword [esp + 0x1dc]
push edx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x2ec], edi
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
mov word [esp + 0x1dc], bx
jb 0x410886
mov eax, dword [esp + 0x2d8]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x27c], edi
mov dword [esp + 0x2ec], esi
mov dword [esp + 0x2e8], ebx
mov word [esp + 0x2d8], bx
jb 0x4108b5
mov ecx, dword [esp + 0x268]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x228], edi
mov dword [esp + 0x27c], esi
mov dword [esp + 0x278], ebx
mov word [esp + 0x268], bx
jb 0x4108e4
mov edx, dword [esp + 0x214]
push edx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x244], edi
mov dword [esp + 0x228], esi
mov dword [esp + 0x224], ebx
mov word [esp + 0x214], bx
jb 0x410913
mov eax, dword [esp + 0x230]
push eax
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x20c], edi
mov dword [esp + 0x244], esi
mov dword [esp + 0x240], ebx
mov word [esp + 0x230], bx
jb 0x410942
mov ecx, dword [esp + 0x1f8]
push ecx
call fcn.00411d3b
add esp, 4
cmp dword [esp + 0x2b4], edi
mov dword [esp + 0x20c], esi
mov dword [esp + 0x208], ebx
mov word [esp + 0x1f8], bx
jmp 0x40e062
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebx
lea eax, [esp + 0x60]
push eax
push ebx
push ecx
mov dword [esp + 0x78], ebx
call ebp
call esi
test eax, eax
je 0x410a2e
lea edx, [esp + 0xa8]
push edx
mov byte [esp + 0x49cc], 0x43
call fcn.0040a610
lea ecx, [esp + 0x328]
call fcn.004056f0
lea ecx, [esp + 0x2f0]
call fcn.00403bb0
lea ecx, [esp + 0x280]
call fcn.00403bb0
lea ecx, [esp + 0x2b8]
call fcn.00403bb0
lea ecx, [esp + 0x248]
call fcn.00403bb0
lea ecx, [esp + 0x1d8]
call fcn.00403bb0
lea ecx, [esp + 0x2d4]
call fcn.00403bb0
lea ecx, [esp + 0x264]
call fcn.00403bb0
lea ecx, [esp + 0x210]
call fcn.00403bb0
lea ecx, [esp + 0x22c]
call fcn.00403bb0
lea ecx, [esp + 0x1f4]
call fcn.00403bb0
lea ecx, [esp + 0x29c]
call fcn.00403bb0
xor al, al
jmp 0x410ae0
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa8]
push ecx
mov byte [esp + 0x49cc], 0x43
call fcn.0040a610
lea ecx, [esp + 0x328]
call fcn.004056f0
lea ecx, [esp + 0x2f0]
call fcn.00403bb0
lea ecx, [esp + 0x280]
call fcn.00403bb0
lea ecx, [esp + 0x2b8]
call fcn.00403bb0
lea ecx, [esp + 0x248]
call fcn.00403bb0
lea ecx, [esp + 0x1d8]
call fcn.00403bb0
lea ecx, [esp + 0x2d4]
call fcn.00403bb0
lea ecx, [esp + 0x264]
call fcn.00403bb0
lea ecx, [esp + 0x210]
call fcn.00403bb0
lea ecx, [esp + 0x22c]
call fcn.00403bb0
lea ecx, [esp + 0x1f4]
call fcn.00403bb0
lea ecx, [esp + 0x29c]
call fcn.00403bb0
mov al, 1
mov ecx, dword [esp + 0x49c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x49a8]
xor ecx, esp
call fcn.0042e014
add esp, 0x49b8
ret