Function at 0x41e94a
Capabilities:
Create thread
Get disk information
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x137c
call fcn.00452960
push ebx
push esi
push edi
mov eax, dword [0x704c20]
mov dword [ebp - 0x7bc], eax
mov eax, dword [0x481894]
mov dword [ebp - 0x5b4], eax
mov eax, dword [0x48188c]
mov dword [ebp - 0x80], eax
mov eax, dword [0x481888]
mov dword [ebp - 0x160], eax
mov eax, dword [0x481890]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x99e954]
mov dword [ebp - 0x7b8], eax
mov eax, dword [0x506e00]
mov dword [ebp - 0x15c], eax
mov eax, dword [0x5f93c8]
mov dword [ebp - 0x7e0], eax
mov eax, dword [0x5ad3c0]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x840], 0x506e20
mov dword [ebp - 0x7dc], 0x507740
mov dword [ebp - 0x7b0], 0x505e60
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x790], 0
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x7d0], 0
mov dword [ebp - 0x7b4], 0
mov dword [ebp - 0x804], 0
mov dword [ebp - 0x7c4], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x7a4], 0
mov eax, dword [0x4817ec]
mov dword [ebp - 0x788], eax
mov dword [ebp - 0x7c0], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7b0]
mov byte [eax], 0
mov eax, dword [ebp - 0x7dc]
mov byte [eax], 0
mov byte [ebp - 0x7c], 0
push 0
call fcn.00452990
add esp, 4
add eax, 0x3c
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x800], 0
jne 0x41eb8f
cmp dword [0x462064], 0
je 0x41eb8f
mov dword [ebp - 0x800], 1
cmp dword [0x45e03c], 0
je 0x41eb53
mov eax, dword [0x462064]
push eax
mov eax, dword [ebp - 0x800]
push eax
push str._r_nS64_SCAN_EXPLORER___d._d_
call fcn.00452380
add esp, 0xc
call fcn.00451d30
cmp dword [0x45e03c], 0
je 0x41eb78
mov eax, dword [0x464f98]
push eax
push str._r_nS64_SCAN_ECOMPLETE._d
call fcn.00452380
add esp, 8
cmp dword [0x464f98], 0
je 0x41eb8f
mov dword [ebp - 0x800], 0
cmp dword [0x4622c8], 0
je 0x41ebab
mov dword [0x4621c8], 1
jmp 0x424d31
mov dword [ebp - 0x790], 0
mov dword [ebp - 0x7c4], 0
mov dword [ebp - 0x14c], 0
mov edi, dword [ebp - 0x5b4]
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 1
mov edi, dword [ebp - 0x80]
xor eax, eax
mov ecx, 0x1b
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x80]
mov dword [eax + 0x330], 0
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x794], 0
cmp dword [0x45e03c], 0
je 0x41ec7e
cmp dword [0x4621d0], 0x400
je 0x41ec57
push str._n_rTB_not_x0fff_
call fcn.00452380
add esp, 4
mov dword [0x4621d0], 0x400
cmp dword [0x4621d4], 0x1000
je 0x41ec7e
push str._n_rTR_not_0x11ff_
call fcn.00452380
add esp, 4
mov dword [0x4621d4], 0x1000
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
call fcn.0043f09a
cmp dword [0x4622c8], 0
je 0x41ecd0
mov dword [0x4621c8], 1
jmp 0x424d31
mov byte [ebp - 0x5ac], 0
cmp dword [0x462314], 0
jne 0x41ecf1
cmp dword [0x46211c], 0
je 0x41ef4d
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41ef4d
mov eax, dword [ebp - 0x80]
add eax, 0x44
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x80]
add eax, 0x44
lea ecx, [ebp - 0x784]
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
cmp dword [0x46211c], 0
je 0x41ede2
mov dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x80]
add eax, 0x64
mov dword [0x462e94], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
mov dword [0x462e98], eax
lea eax, [ebp - 0x844]
push eax
push 0
push 0
push 0x436e2e
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41edce
mov dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x462e98]
cmp dword [eax + 0xc], ecx
jne 0x41edc9
inc dword [ebp - 0x84c]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x84c], 0xde
jle 0x41edc4
jmp 0x41edc9
jmp 0x41ed8f
jmp 0x41ede2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nDALA_CTW_FAIL_d
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xdc]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x41ee92
cmp dword [0x46211c], 0
jne 0x41ee92
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push str._n_rSkipping___S___excluded
call fcn.00452380
add esp, 8
cmp dword [0x45e03c], 0
je 0x41ef0c
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rEXC_Driver_non_44_hookup_now__x__signal___x__220_x__x__PID_4___X__d_
call fcn.00452380
add esp, 0x1c
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x46]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x44]
push ecx
push str._r_n68___x._x_
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x80]
mov byte [eax], 0
cmp dword [0x462114], 0
jne 0x41ef67
cmp dword [0x4622bc], 0
je 0x41f072
mov eax, dword [ebp - 0x80]
add eax, 0x44
lea ecx, [ebp - 0x784]
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x7ac], 0
cmp dword [0x45e03c], 0
je 0x41f031
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push str._n_rSkipping___S___ZERO_METER_in_progress
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x46]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x44]
push ecx
push str._r_n68.0___x._x_
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x80]
mov byte [eax], 0
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
call fcn.00453060
add esp, 4
test eax, eax
jne 0x41f08f
mov eax, dword [ebp - 0x80]
mov byte [eax], 0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x4244df
mov eax, dword [ebp - 0x80]
add eax, 0x44
lea ecx, [ebp - 0x784]
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov dword [ebp - 0x164], 0
cmp dword [0x46224c], 0
je 0x41f0df
cmp dword [0x4622f4], 0
jne 0x41f0df
call fcn.00434201
mov dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x41f143
mov eax, dword [ebp - 0x850]
movsx eax, byte [eax + 2]
cmp eax, 0x3d
jne 0x41f143
mov eax, dword [ebp - 0x850]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x41f143
mov dword [ebp - 0x688], 1
mov eax, dword [ebp - 0x850]
mov byte [eax + 2], 0x5e
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax + 0x334]
cmp ecx, 0x23
jne 0x41f176
cmp dword [0x45e03c], 0
je 0x41f171
push str._n_rX_R_I3264
call fcn.00452380
add esp, 4
jmp 0x41fb7f
mov dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push 0x471fec
mov eax, dword [ebp - 0x7e0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [0x462214], 0
je 0x41f1cf
push str.msedgewebview
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f1cf
mov dword [ebp - 0x854], 0x61
push str.Bentley.
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f232
push str.shared
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41f223
push str.Bentley.lic
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f22d
mov dword [ebp - 0x794], 0
jmp 0x41f312
push str.ustation.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f28f
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0044ec75
add esp, 4
cmp eax, 0x18
jne 0x41f28a
cmp dword [0x45e03c], 0
je 0x41f280
push str._r_nV8_ustn_located_070622
call fcn.00452380
add esp, 4
mov dword [ebp - 0x794], 0x18
jmp 0x41f312
push str.powerInRoads.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f2ec
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0044ec75
add esp, 4
cmp eax, 0x18
jne 0x41f2e7
cmp dword [0x45e03c], 0
je 0x41f2dd
push str._r_nV8_pwrinrd_located_092022__041123
call fcn.00452380
add esp, 4
mov dword [ebp - 0x794], 0x18
jmp 0x41f312
push str.Bentley
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f312
mov dword [ebp - 0x794], 1
push str.Program_Filesgit_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f359
cmp dword [0x45e03c], 0
je 0x41f34f
mov eax, dword [ebp - 0x7e0]
push eax
push str._n_rX.Do_not_track:__s
call fcn.00452380
add esp, 8
jmp 0x41ede2
push str.Solibri_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f384
mov dword [ebp - 0x854], 0x25
jmp 0x41f5b6
push str.Microsoft
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f3e2
push str.office16
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f3dd
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0044fa2e
add esp, 4
test eax, eax
je 0x41f3dd
mov dword [ebp - 0x854], 0x7d
jmp 0x41f5b6
push str.SphericalViewer
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f40d
mov dword [ebp - 0x854], 0x24
jmp 0x41f5b6
push str.iGeoNetz_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f438
mov dword [ebp - 0x854], 0xa1
jmp 0x41f5b6
push str._technetVermEsn
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f463
mov dword [ebp - 0x854], 0xa1
jmp 0x41f5b6
push str.Windows_Defender_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f48e
mov dword [ebp - 0x854], 0x10
jmp 0x41f5b6
push str.N_Able
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f4b9
mov dword [ebp - 0x854], 0xf
jmp 0x41f5b6
push str.Sophos
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f4e4
mov dword [ebp - 0x854], 0xe
jmp 0x41f5b6
push str.ESETESET
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f50f
mov dword [ebp - 0x854], 0xc
jmp 0x41f5b6
push str.Citrix_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f53a
mov dword [ebp - 0x854], 0x11
jmp 0x41f5b6
push str.XenDesktop
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f565
mov dword [ebp - 0x854], 0x12
jmp 0x41f5b6
push str.Centurion_Technologies_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f590
mov dword [ebp - 0x854], 0xd
jmp 0x41f5b6
push str.MEDITECHBLMMT.Universe_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f5b6
mov dword [ebp - 0x854], 0xd
push str.jogamp_exe_tst
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f5e1
mov dword [ebp - 0x854], 0xd
jmp 0x41f80f
push str._sonicwall_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f60c
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.microsoft_teams_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f637
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.Trend_Micro_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f662
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.Arctic_Wolf_Networks_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f68d
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.EMpower_tune
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f6b8
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.program_filesmicrosoft_intellipoint_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f6e3
mov dword [ebp - 0x854], 0x47
jmp 0x41f80f
push str.InvinceaEnterprise_
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f718
mov dword [ebp - 0x854], 1
mov dword [0x462eb0], 1
jmp 0x41f80f
push str.Symantec
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f743
mov dword [ebp - 0x854], 2
jmp 0x41f80f
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jbe 0x41f80f
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
dec eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0
jle 0x41f80f
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x7e0]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x41f7bc
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x7e0]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x41f804
inc dword [ebp - 0x7a8]
mov eax, dword [ebp - 0x7a8]
add eax, dword [ebp - 0x7e0]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x7e0]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x7a8], 0
jmp 0x41f80a
dec dword [ebp - 0x7a8]
jmp 0x41f77b
cmp dword [0x462eb0], 0
je 0x41f96a
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x804], 0
mov byte [ebp - 0x750], 0
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.0043e02d
add esp, 8
movsx eax, byte [ebp - 0x750]
test eax, eax
je 0x41f8c9
lea eax, [ebp - 0x750]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x41f8c9
mov dword [ebp - 0x854], 9
cmp dword [0x45e03c], 0
je 0x41f8c9
lea eax, [ebp - 0x750]
push eax
push str._nPPID_Name.sbx.__s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x7e0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41f912
movsx eax, byte [ebp - 0x750]
test eax, eax
je 0x41f912
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41f912
mov dword [ebp - 0x854], 0xa
push 0x472254
lea eax, [ebp - 0x750]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41f938
mov dword [ebp - 0x854], 0xb
cmp dword [ebp - 0x854], 0
jne 0x41f96a
push 0
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call fcn.0043f908
add esp, 0x10
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x7e8], 0
push str.javaw.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41f9d8
mov eax, dword [ebp - 0x80]
add eax, 0x334
push eax
push 0x472270
push 0xfa0
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.00452660
add esp, 0x10
push str._bentley
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41f9d8
mov dword [ebp - 0x7e8], 1
cmp dword [ebp - 0x854], 0
je 0x41fa0b
cmp dword [0x45e03c], 0
je 0x41fa06
mov eax, dword [ebp - 0x854]
push eax
push str._r_nAltISkip.sbx._02d
call fcn.00452380
add esp, 8
jmp 0x41fb7f
mov eax, dword [ebp - 0x7e0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41fa53
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x41fa53
cmp dword [0x45e03c], 0
je 0x41fa4e
push str._n_rAltISkip
call fcn.00452380
add esp, 4
jmp 0x41fb7f
cmp dword [ebp - 0x7e8], 0
jne 0x41faa8
mov eax, dword [ebp - 0x7e0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41faa8
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.00444765
add esp, 4
test eax, eax
je 0x41faa8
cmp dword [0x45e03c], 0
je 0x41faa3
push str._n_rAltISkipITE
call fcn.00452380
add esp, 4
jmp 0x41fb7f
mov eax, dword [ebp - 0x7e0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41faf5
push 0x4722b0
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41faf5
cmp dword [0x45e03c], 0
je 0x41faf0
push str._n_rAltISkipDLL
call fcn.00452380
add esp, 4
jmp 0x41fb7f
push str.chrome
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41fb3a
mov dword [0x462208], 1
cmp dword [0x45e03c], 0
je 0x41fb35
push str._r_nAltChomeSuper.skip
call fcn.00452380
add esp, 4
jmp 0x41fb44
mov dword [0x462208], 0
cmp dword [0x462208], 0
jne 0x41fb7f
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x794]
push eax
call fcn.0044ee61
add esp, 0x10
mov dword [ebp - 0x794], 0
cmp dword [0x45e03c], 0
je 0x41fbb5
mov eax, dword [ebp - 0x688]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push str._nCan_I_Lock___S___loc__x____parent__x_A120_d
call fcn.00452380
add esp, 0x14
cmp dword [0x45e03c], 0
je 0x41fbf5
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax + 0x334]
test ecx, ecx
je 0x41fbf5
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x330]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x334
push eax
push str._nCMDL___S___x_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x330]
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0
je 0x41fc45
mov eax, dword [ebp - 0x7c4]
and al, 0xf
cmp al, 8
jne 0x41fc2b
mov dword [ebp - 0x14c], 1
mov eax, dword [ebp - 0x7c4]
and al, 0xf
cmp al, 2
jne 0x41fc45
mov dword [ebp - 0x14c], 1
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x858], eax
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x804], 0
mov byte [ebp - 0x750], 0
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.0043e02d
add esp, 8
push 0
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x7b0]
mov byte [eax], 0
cmp dword [0x46206c], 0
je 0x41fd8c
mov eax, dword [ebp - 0x80]
add eax, 0x334
push eax
push 0x472328
push 0xfa0
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.00452660
add esp, 0x10
push 0x47232c
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41fd6b
push 0x472330
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41fd6b
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x7b0]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x334
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
call fcn.0042c245
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x41fd8c
mov eax, dword [ebp - 0x7b0]
push eax
push str._r_nCBML_APP_s
call fcn.00452380
add esp, 8
cmp dword [0x462298], 0
je 0x41fdee
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x85c]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x41fdee
mov eax, dword [ebp - 0x85c]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x41fdee
mov eax, dword [ebp - 0x85c]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x41fdee
mov eax, dword [ebp - 0x7b0]
push eax
call fcn.0042dec7
add esp, 4
cmp dword [0x4620f8], 0
je 0x41fe9c
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x41fe9c
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x41fe9c
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x41fe9c
mov eax, dword [ebp - 0x858]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x868], al
mov eax, dword [ebp - 0x858]
mov al, byte [eax + 0xe]
mov byte [ebp - 0x867], al
mov eax, dword [ebp - 0x858]
mov al, byte [eax + 0x10]
mov byte [ebp - 0x866], al
mov eax, dword [ebp - 0x858]
mov al, byte [eax + 0x12]
mov byte [ebp - 0x865], al
mov byte [ebp - 0x864], 0
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x868]
push eax
call fcn.004536a0
add esp, 4
push eax
mov eax, dword [ebp - 0x7b0]
push eax
call fcn.0042ca9c
add esp, 0xc
mov dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push 0x472344
mov eax, dword [ebp - 0x7e0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.Bentley.Microstran.License.Configuration.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41ff2b
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x41ff2b
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x41ff2b
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x41ff2b
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043fb13
add esp, 4
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7c4], 0
je 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 2]
cmp eax, 0x2b
jne 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x41ffbc
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x31
jne 0x41ffbc
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x31
jne 0x41ffbc
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2e]
cmp eax, 0x23
je 0x42002e
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x41fff5
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x33
jne 0x41fff5
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x23
je 0x42002e
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x31
jne 0x420060
mov eax, dword [ebp - 0x858]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x23
jne 0x420060
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push 0x472378
mov eax, dword [ebp - 0x7e0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x7b0]
push eax
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042e1ad
add esp, 8
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x86c], eax
mov byte [ebp - 0x7c], 0
mov eax, dword [ebp - 0x86c]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x42042b
mov eax, dword [ebp - 0x86c]
movsx eax, byte [eax + 2]
cmp eax, 0x40
jne 0x42042b
mov eax, dword [ebp - 0x86c]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x42042b
mov eax, dword [ebp - 0x86c]
movsx eax, byte [eax + 6]
cmp eax, 0x37
jne 0x42042b
mov eax, dword [ebp - 0x86c]
movsx eax, byte [eax + 8]
cmp eax, 0x34
jne 0x42042b
lea eax, [ebp - 0xc20]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x86c]
mov al, byte [eax + 0xc]
mov byte [ebp - 0xc20], al
mov eax, dword [ebp - 0x86c]
mov al, byte [eax + 0xe]
mov byte [ebp - 0xc1f], al
mov eax, dword [ebp - 0x86c]
mov al, byte [eax + 0x10]
mov byte [ebp - 0xc1e], al
mov eax, dword [ebp - 0x86c]
mov al, byte [eax + 0x12]
mov byte [ebp - 0xc1d], al
mov eax, dword [ebp - 0x86c]
mov al, byte [eax + 0x14]
mov byte [ebp - 0xc1c], al
push str.88888
lea eax, [ebp - 0xc20]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x420300
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x86c]
add eax, 0x18
push eax
push 0x472384
push 0x138
lea eax, [ebp - 0xc14]
push eax
call fcn.00452660
add esp, 0x10
push 0x472388
lea eax, [ebp - 0xc14]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0xc28]
mov byte [ebp + eax - 0xc14], 0
inc dword [ebp - 0xc28]
lea eax, [ebp - 0xc14]
push eax
push 0x47238c
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0xc28]
lea eax, [ebp + eax - 0xc14]
push eax
push 0x472394
mov eax, dword [ebp - 0x86c]
add eax, 0x18
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
mov eax, dword [ebp - 0x86c]
add eax, 0x18
push eax
call fcn.00453080
add esp, 8
mov eax, dword [ebp - 0x86c]
mov byte [eax + 6], 0x36
mov eax, dword [ebp - 0x86c]
mov byte [eax + 8], 0x36
lea eax, [ebp - 0xc24]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0041054b
add esp, 0xc
cmp dword [ebp - 0x7c], 0x2d303030
jne 0x42024f
mov byte [ebp - 0x7c], 0
movsx eax, byte [ebp - 0x7c]
test eax, eax
je 0x42028f
lea eax, [ebp - 0x7c]
push eax
push 0x47239c
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
jmp 0x4202fb
cmp dword [ebp - 0xc24], 0
je 0x4202c7
push 0x4723a4
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
mov esi, str.NAMED_USER_STANDALONE_
lea edi, [ebp - 0x7c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4202fb
push 0x4723ec
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
mov eax, str.NAMED_USER
lea ecx, [ebp - 0x7c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dx, word [eax + 8]
mov word [ecx + 8], dx
mov al, byte [eax + 0xa]
mov byte [ecx + 0xa], al
jmp 0x42042b
mov dword [ebp - 0xc2c], 0
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
call fcn.00410c7a
add esp, 8
mov eax, dword [ebp - 0x86c]
mov byte [eax + 6], 0x36
mov eax, dword [ebp - 0x86c]
mov byte [eax + 8], 0x36
movsx eax, byte [ebp - 0xc14]
test eax, eax
je 0x420375
lea eax, [ebp - 0xc14]
push eax
push 0x472410
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004102ad
add esp, 8
movsx eax, byte [ebp - 0x7c]
test eax, eax
je 0x42042b
cmp dword [ebp - 0x7c], 0x2d303030
jne 0x4203bb
lea eax, [ebp - 0xc2c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0041054b
add esp, 0xc
cmp dword [ebp - 0xc2c], 0
je 0x4203fc
lea eax, [ebp - 0x7c]
push eax
push str._S_STANDALONE_
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
jmp 0x42042b
lea eax, [ebp - 0x7c]
push eax
push 0x472438
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
mov eax, dword [ebp - 0x86c]
push eax
call fcn.00453080
add esp, 8
mov eax, dword [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.0043e02d
add esp, 8
cmp dword [0x45e03c], 0
je 0x420462
lea eax, [ebp - 0x750]
push eax
push str._nPPID_Name___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x80]
add eax, 0x64
push eax
push 0x472450
mov eax, dword [ebp - 0x7e0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x80]
add eax, 0x334
push eax
push 0x472454
push 0xfa0
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.00452660
add esp, 0x10
push 0x472458
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4204c6
mov dword [ebp - 0x164], 1
push str.netsh_interface_ipv6_delete
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4204f6
push 0
call fcn.00452990
add esp, 4
mov dword [0x4621a0], eax
jmp 0x420521
push str.netsh_interface_ipv4_delete
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x420521
push 0
call fcn.00452990
add esp, 4
mov dword [0x4621a0], eax
movsx eax, byte [ebp - 0x750]
test eax, eax
je 0x42058a
mov edi, dword [ebp - 0x7dc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x472494]
mov dword [edi - 1], eax
lea edi, [ebp - 0x750]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp - 0x7dc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x750], 0
jmp 0x4205a1
mov edi, dword [ebp - 0x7dc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x472498]
mov dword [edi - 1], eax
push str.Revu.exe
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4205d3
mov eax, dword [ebp - 0x7b0]
push eax
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.004487e4
add esp, 8
mov eax, dword [ebp - 0x7b0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x420646
mov edi, dword [ebp - 0x7b0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp - 0x7dc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x42063d
mov eax, dword [ebp - 0x7b0]
push eax
push str._r_nBMLA_Code___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x7b0]
mov byte [eax], 0
push str.Autodesk
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x420671
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.004485d6
add esp, 4
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov dword [ebp - 0x78c], 1
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
mov dword [ebp - 0x7ac], eax
mov dword [ebp - 0x7a4], 0
cmp dword [0x462078], 0
je 0x42075b
mov dword [ebp - 0xc30], 0xffffffff
lea eax, [ebp - 0xc30]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call dword [0x462078]
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0x3c], 0xffffffff
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call dword [0x462078]
mov dword [ebp - 0xc34], eax
cmp dword [0x45e03c], 0
je 0x420735
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xc34]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0xc30]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push str._n_rVista_Parent_PID___x__Session___d__child_Session_d___Rc___d__GLE___d_
call fcn.00452380
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call dword [0x462078]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0xdc], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x7d4], 0
cmp dword [0x462eb4], 0
je 0x4207d1
push 0
call fcn.00452990
add esp, 4
cmp eax, dword [0x462eb4]
jae 0x4207ad
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x168], 0
jmp 0x4207d1
mov dword [0x462eb4], 0
cmp dword [0x45e03c], 0
je 0x4207d1
push str._n_nWait_53_reset_n_n
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x78c], 0
je 0x42407d
push 0x47253c
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x7a8], eax
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x7a8]
je 0x420993
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x7e0]
mov ax, word [eax + ecx - 1]
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x7a8]
dec eax
add eax, dword [ebp - 0x7e0]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x7e0]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x826], 0
lea edi, [ebp - 0x828]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x472540]
mov word [edi - 1], ax
cmp dword [0x45e03c], 0
je 0x4208a5
lea eax, [ebp - 0x828]
push eax
push str._nFIRST_Test_Drive___s_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x7a8], eax
cmp dword [0x45e03c], 0
je 0x4208e4
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x7a8]
push eax
push str._nDrive_Type___d____X_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x1378], eax
jmp 0x420958
mov dword [ebp - 0x7d8], 1
jmp 0x42098e
cmp dword [0x4622e4], 0
je 0x42093f
mov dword [ebp - 0x7d8], 1
cmp dword [0x45e03c], 0
je 0x42093f
push str._n_r____SANNAS_access_guarded
call fcn.00452380
add esp, 4
jmp 0x42098e
mov dword [ebp - 0x7d8], 0
jmp 0x42098e
cmp dword [ebp - 0x1378], 6
ja case.default.0x42096b
mov eax, dword [ebp - 0x1378]
jmp dword [eax*4 + 0x420972]
jmp 0x42099d
mov dword [ebp - 0x7d8], 1
cmp dword [0x462180], 0
jne 0x4209b7
cmp dword [0x462184], 0
je 0x420c7a
push 0x472594
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x7e0]
mov ax, word [eax + ecx - 1]
mov word [ebp - 0x828], ax
mov byte [ebp - 0x826], 0
lea edi, [ebp - 0x828]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x472598]
mov word [edi - 1], ax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x137c], eax
jmp 0x420b0d
cmp dword [0x462180], 0
je 0x420a6f
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x7a4], 1
cmp dword [0x45e03c], 0
je 0x420a6f
mov eax, dword [ebp - 0x7a8]
push eax
push str._n_rHALTING_R_EXE___d_
call fcn.00452380
add esp, 8
jmp 0x420b46
push str.appdatalocal_temp
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x420ac8
push str.temporary_directory
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x420ac8
push str.temporary_internet
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x420b03
cmp dword [0x462184], 0
je 0x420b03
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x7a4], 1
cmp dword [0x45e03c], 0
je 0x420b03
push str._n_rHALTING_EXE_run_from_Temporary_Directory___could_be_from_ZIP_or_from_Internet
call fcn.00452380
add esp, 4
jmp 0x420b46
cmp dword [ebp - 0x137c], 6
ja case.0x420b28.3
mov eax, dword [ebp - 0x137c]
xor ecx, ecx
mov cl, byte [eax + 0x420b3f]
jmp dword [ecx*4 + 0x420b2f]
cmp dword [ebp - 0x7a4], 0
je 0x420c7a
cmp dword [ebp - 0x688], 0
jne 0x420b9d
cmp dword [ebp - 0x164], 0
je 0x420b7f
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e60f
add esp, 8
jmp 0x420c7a
lea edi, [ebp - 0xc58]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0x164], 0
je 0x420bdc
mov byte [ebp - 0xc44], 1
mov dword [ebp - 0x758], 0
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0xc58]
push eax
push 0x41e88b
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x420c66
mov dword [ebp - 0xc5c], 0
cmp dword [ebp - 0xc58], 0
je 0x420c61
cmp dword [0x4622c8], 0
je 0x420c39
jmp 0x420c61
inc dword [ebp - 0xc5c]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xc5c], 0x26e
jle 0x420c5c
jmp 0x420c61
jmp 0x420c1a
jmp 0x420c7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nTHD_VXW_CTW_FAIL_d
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x7d8], 0
je 0x424024
mov edx, dword [0x4621e4]
mov edi, dword [ebp - 0x15c]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x45
cmp dword [0x462254], 0
je 0x420d08
cmp dword [0x46225c], 0
jne 0x420d08
mov dword [0x46225c], 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x44
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
jmp 0x420d76
cmp dword [0x462254], 0
jne 0x420d76
cmp dword [0x46225c], 0
jne 0x420d76
cmp dword [0x46224c], 0
jne 0x420d76
mov dword [0x46225c], 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0xa4
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 0x44
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
cmp dword [0x45e03c], 0
je 0x420da2
mov eax, dword [ebp - 0x7e0]
push eax
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rPRE_SCAN_FN_ONLY___x___s__n_n
call fcn.00452380
add esp, 0xc
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jbe 0x421182
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
dec eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0
jle 0x42117d
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x7e0]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x420e1b
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x7e0]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x421172
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0x200], 0x77
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0x201], 0xbb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0x202], 0x11
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0x203], 0xaa
mov eax, dword [ebp - 0x7e0]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x3a
jne 0x420ea5
mov eax, dword [ebp - 0x7a8]
mov esi, dword [ebp - 0x7e0]
mov edi, dword [ebp - 0x15c]
add edi, 0x208
add esi, 2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x15c]
mov byte [eax + ecx + 0x207], 0
jmp 0x420edf
mov eax, dword [ebp - 0x7a8]
mov edi, dword [ebp - 0x15c]
add edi, 0x208
mov esi, dword [ebp - 0x7e0]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x15c]
mov byte [eax + ecx + 0x209], 0
mov edi, dword [ebp - 0x15c]
add edi, 0x208
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 0
je 0x420f49
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [ebp - 0x15c]
xor edx, edx
mov dl, byte [eax + ecx + 0x207]
cmp edx, 0x5c
je 0x420f49
mov edi, dword [ebp - 0x15c]
add edi, 0x208
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x472678]
mov word [edi - 1], ax
cmp dword [0x45e03c], 0
je 0x420f6f
mov eax, dword [ebp - 0x15c]
add eax, 0x208
push eax
push str._n_rFPATH01vv____s__n
call fcn.00452380
add esp, 8
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x804], 0
mov byte [ebp - 0x750], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.0043e02d
add esp, 8
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x14], 0
je 0x4210af
push 0x472690
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421089
push 0x472698
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421089
push 0x4726a8
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421089
mov eax, dword [ebp - 0x7bc]
push eax
push 0x4726b8
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x421089
mov eax, dword [ebp - 0x7bc]
push eax
push 0x4726c0
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x421089
push 0x4726c8
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x4210af
cmp dword [0x45e03c], 0
je 0x4210aa
mov eax, dword [ebp - 0x7bc]
push eax
push str._r_nUXNA___s___skip
call fcn.00452380
add esp, 8
jmp 0x41ede2
mov eax, dword [ebp - 0x7a8]
inc eax
add eax, dword [ebp - 0x7e0]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x24]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x4210fe
mov eax, dword [ebp - 0x24]
push eax
push str._nFN_ONLY_SEND___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x44
je 0x421127
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xa4
jne 0x42112c
jmp 0x421163
mov eax, dword [ebp - 0x24]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x421145
jmp 0x41ede2
push 0x472700
mov eax, dword [ebp - 0x24]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x421163
jmp 0x41ede2
mov dword [ebp - 0x7a8], 0
jmp 0x421178
dec dword [ebp - 0x7a8]
jmp 0x420dda
jmp 0x4211aa
mov edi, dword [ebp - 0x7e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x24]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0x5d
jle 0x421209
sub dword [ebp - 0x7a8], 0x5d
mov eax, dword [ebp - 0x7a8]
add eax, dword [ebp - 0x24]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x24]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x5d], 0
mov edi, dword [ebp - 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 2
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x9854e0
mov edi, dword [ebp - 0x15c]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xbe], eax
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
cmp dword [ebp - 0x7a4], 0
jne 0x423ea8
cmp dword [0x46224c], 0
je 0x4219e4
mov dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x7b4]
push eax
mov eax, dword [ebp - 0x80]
mov al, byte [eax + 0x14]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xbd], 0
cmp dword [0x462254], 0
je 0x421396
mov dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7b4]
mov dword [eax + 0x7c], ecx
mov eax, dword [ebp - 0x7bc]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x7bc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xbd], 0x8a
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
cmp dword [0x4622e4], 0
je 0x4213b5
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xbc], 0x9f
jmp 0x4213c2
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xbc], 0
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x25
mov dword [ebp - 0x814], 0x100
mov dword [ebp - 0x810], 0x320
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x80c], eax
mov edi, dword [ebp - 0x788]
mov esi, dword [ebp - 0x15c]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x814]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x7a0], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x578
jne 0x421491
cmp dword [0x45e03c], 0
je 0x42146e
push str._n_nNWLWA32_Process_Missing_
call fcn.00452380
add esp, 4
push 0x10
push str.ILLEGAL_EXIT
push str.SofTrack_Process_NWLWA32_has_been_illegally_terminated__n_n_nBlocking_All_Application_Executions.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x7a0], 2
jmp 0x421491
cmp dword [0x4622b0], 0
je 0x42156f
push str.iexplore.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x421546
push str.firefox.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x421546
push str.chrome.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x421546
push str.safari.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x421546
push str.mozilla.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x421546
push str.opera.exe
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x42156f
push 1
call fcn.004359b5
add esp, 4
cmp dword [0x45e03c], 0
je 0x42156f
push 0x5086e0
push str._n_rNDS_Name_for_Browser_Audit___s_
call fcn.00452380
add esp, 8
cmp dword [0x45e03c], 0
je 0x421597
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x7a0]
push eax
push str._nNW_WORKED___x__lsid___5____gle__d_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x5b4]
add eax, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x5b4]
add eax, 0x125
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [ebp - 0x7a0], 5
jbe 0x4218ee
cmp dword [ebp - 0x7c4], 0
jne 0x4218ee
mov dword [ebp - 0x814], 0x155
mov dword [ebp - 0x810], 0x190
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x75c], eax
cmp dword [0x45e03c], 0
je 0x42164a
mov eax, dword [ebp - 0x75c]
push eax
push str._n_rGet_Stop_Mux_returned___x_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x75c], 0x55
jne 0x4218ee
cmp dword [0x45e03c], 0
je 0x421671
push str._n_rStop_Mux_returned
call fcn.00452380
add esp, 4
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x93
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7a0]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xc], eax
cmp dword [0x45e03c], 0
je 0x4216e9
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 4]
push eax
push str._nMuxNWCheck_LSID___x__PID___x__TSEID___d_
call fcn.00452380
add esp, 0x10
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x15c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x15c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x421742
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rDIO___x_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x4218e4
cmp dword [0x45e03c], 0
je 0x42176e
push 0x472908
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x5b4]
add eax, 8
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [ebp - 0x680], 0
cmp dword [ebp - 0x164], 0
je 0x4217b4
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e60f
add esp, 8
mov dword [ebp - 0x7a0], 2
cmp dword [0x4622f4], 0
jne 0x4217e9
call fcn.00434201
mov edi, 0x4818a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4fa0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x42183b
push 0x40010
push 0x472928
push 0x5f4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4218df
mov dword [ebp - 8], 0
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x684]
mov dword [0x462e9c], eax
mov dword [0x462ea0], 0x10
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x818]
push eax
push 0x430702
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4218cb
mov dword [ebp - 8], 0
cmp dword [ebp - 0x818], 0
je 0x4218c6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jle 0x4218c1
mov dword [ebp - 0x818], 0
jmp 0x421892
jmp 0x4218df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nNW_ISM_CTW_FAIL_d
call fcn.00452380
add esp, 8
jmp 0x4218ee
mov dword [ebp - 0x75c], 0
cmp dword [ebp - 0x7a0], 5
jbe 0x42195c
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 1
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x7a0]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
cmp dword [0x462254], 0
je 0x421947
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0xe8], ecx
jmp 0x421957
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 0xe8], 0
jmp 0x421978
mov al, byte [ebp - 0x7a0]
mov ecx, dword [ebp - 0x5b4]
mov byte [ecx + 1], al
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
cmp dword [0x462254], 0
je 0x4219cf
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0xe8], ecx
jmp 0x4219df
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 0xe8], 0
jmp 0x423ea3
mov dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x7b4]
push eax
mov eax, dword [ebp - 0x80]
mov al, byte [eax + 0x14]
push eax
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x154], eax
cmp dword [0x462254], 0
je 0x42249b
mov dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7b4]
mov dword [eax + 0x7c], ecx
mov eax, dword [ebp - 0x7bc]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x7bc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x421afd
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
push str.TSE_ID__n____d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xdb], 0x77
cmp dword [0x462278], 0
je 0x421b6b
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xdb], 0
mov eax, dword [ebp - 0x15c]
add eax, 0xe6
push eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0043d6ab
add esp, 8
cmp dword [0x45e03c], 0
je 0x421b6b
mov eax, dword [ebp - 0x15c]
add eax, 0xe6
push eax
push str.True_TSE_Remote_PC___s_
call fcn.00452380
add esp, 8
cmp dword [0x4622e4], 0
je 0x421b8a
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xda], 0x9f
jmp 0x421b97
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xda], 0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax + 0x18]
test ecx, ecx
je 0x421bb9
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xd9], 0x7e
jmp 0x421bc6
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xd9], 0
mov eax, dword [ebp - 0x80]
cmp dword [eax + 4], 0
je 0x421bf2
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x7c8], eax
jmp 0x421bfc
mov dword [ebp - 0x7c8], 0
lea eax, [ebp - 0x838]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x15c]
add eax, 0xc3
push eax
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
call fcn.0044af6c
add esp, 0xc
mov eax, dword [ebp - 0x15c]
cmp dword [eax + 0xc3], 0
jne 0x421dd0
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x14], 0
je 0x421dd0
push 0x472994
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421cff
push 0x47299c
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421cff
push 0x4729ac
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x421cff
mov eax, dword [ebp - 0x7bc]
push eax
push 0x4729bc
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x421cff
mov eax, dword [ebp - 0x7bc]
push eax
push 0x4729c4
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x421cff
push 0x4729cc
mov eax, dword [ebp - 0x7bc]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x421d04
jmp 0x421dd0
cmp dword [0x45e03c], 0
je 0x421d37
mov eax, dword [ebp - 0x7bc]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
push str._n_r_A_NULL_TIME_SESSION__d___x___s_
call fcn.00452380
add esp, 0x10
push 0x46d
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x15c]
add eax, 0xc3
push eax
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
call fcn.0044af6c
add esp, 0xc
mov eax, dword [ebp - 0x15c]
cmp dword [eax + 0xc3], 0
jne 0x421dd0
cmp dword [0x45e03c], 0
je 0x421da3
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
push str._n_r_B_NULL_TIME_SESSION__d___x
call fcn.00452380
add esp, 0xc
push 0x3d5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x15c]
add eax, 0xc3
push eax
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
call fcn.0044af6c
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x421e31
xor eax, eax
mov al, byte [ebp - 0x833]
push eax
xor eax, eax
mov al, byte [ebp - 0x834]
push eax
xor eax, eax
mov al, byte [ebp - 0x835]
push eax
xor eax, eax
mov al, byte [ebp - 0x836]
push eax
xor eax, eax
mov al, byte [ebp - 0x837]
push eax
xor eax, eax
mov al, byte [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc3]
push eax
push str._n_r__X_VUser_Login_Time_sid__d_
call fcn.00452380
add esp, 0x24
lea eax, [ebp - 0x838]
mov ecx, dword [ebp - 0x15c]
add ecx, 0xbc
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c8], 0
je 0x421e8f
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0x5d
jle 0x421eee
sub dword [ebp - 0x7a8], 0x5d
mov eax, dword [ebp - 0x7a8]
add eax, dword [ebp - 0x24]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x24]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x5d], 0
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x462304]
mov dword [eax + 2], ecx
mov edi, dword [ebp - 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 6
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x9854e0
mov ecx, dword [ebp - 0x15c]
add ecx, 0x64
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
cmp dword [0x45e03c], 0
je 0x421f8f
xor eax, eax
mov ax, word [0x462324]
push eax
xor eax, eax
mov ax, word [0x462330]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cx, word [eax]
push ecx
push str._n_rOFSz___x_____X__ogx__d._d_
call fcn.00452380
add esp, 0x14
xor eax, eax
mov ax, word [0x462330]
test eax, eax
jne 0x421faf
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x422018
lea eax, [ebp - 0x115c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x105c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0xe5c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x1224]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
jmp 0x42214f
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x115c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043d4f6
add esp, 0x14
xor eax, eax
mov al, byte [ebp - 0x105c]
test eax, eax
jne 0x42214f
push 0x472aa0
mov eax, dword [ebp - 0x15c]
add eax, 0x80
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x422114
push 0x472aa8
mov eax, dword [ebp - 0x15c]
add eax, 0x80
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x422114
push 0x472ab8
mov eax, dword [ebp - 0x15c]
add eax, 0x80
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x422114
mov eax, dword [ebp - 0x7bc]
push eax
push 0x472ac8
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x422114
mov eax, dword [ebp - 0x15c]
add eax, 0x80
push eax
push 0x472ad0
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x422114
push 0x472ad8
mov eax, dword [ebp - 0x15c]
add eax, 0x80
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x422119
jmp 0x422124
push 0xe7
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x115c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043d4f6
add esp, 0x14
cmp dword [0x45e03c], 0
je 0x422190
push 0
call fcn.00452990
add esp, 4
push eax
lea eax, [ebp - 0x115c]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
push str._n_rPID__d._x____s___s_____X__r_n
call fcn.00452380
add esp, 0x18
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xfa], 0x11
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xfb], 0x88
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xfc], 0xcc
mov eax, dword [ebp - 0x15c]
mov byte [eax + 0xfd], 0xaa
mov eax, dword [ebp - 0x15c]
cmp dword [eax + 0x200], 0xaa11bb77
jne 0x422240
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax + 0x208]
test ecx, ecx
jne 0x422204
mov eax, dword [ebp - 0x15c]
mov cx, word [0x472b08]
mov word [eax + 0x208], cx
mov edi, dword [ebp - 0x15c]
add edi, 0x208
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 0x104
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x422254
mov eax, dword [ebp - 0x15c]
mov cx, word [0x472b0c]
mov word [eax + 0x104], cx
mov edi, dword [ebp - 0x15c]
add edi, 0x104
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x81c], eax
inc dword [ebp - 0x81c]
lea edi, [ebp - 0x105c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jae 0x4222a4
mov ax, word [0x472b10]
mov word [ebp - 0x105c], ax
lea edi, [ebp - 0x105c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x81c]
add ebx, 0x104
add ebx, dword [ebp - 0x15c]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x81c]
add eax, 0x104
add eax, dword [ebp - 0x15c]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x83c], eax
inc dword [ebp - 0x83c]
mov edi, 0x508800
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x83c]
add ebx, dword [ebp - 0x81c]
add ebx, 0x104
add ebx, dword [ebp - 0x15c]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x7c4]
mov dword [eax + 0x394], ecx
mov edi, dword [ebp - 0x7dc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x15c]
add edi, 0x398
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x14c], 0
je 0x4223bc
mov eax, dword [ebp - 0x15c]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043f397
add esp, 0xc
mov dword [ebp - 0x14c], 0
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x15c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
cmp ecx, 0xfe
jne 0x42249b
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x15c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
inc dword [ebp - 0x7c0]
cmp dword [ebp - 0x7c0], 0xe
jle 0x422496
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0xfc
jmp 0x4223f1
cmp dword [ebp - 0x790], 0
je 0x423c5b
push 0x472b14
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4224c9
jmp 0x4225c7
push str.mdlgpk
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x422533
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043eb1a
add esp, 0xc
mov eax, dword [ebp - 0x7e0]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043e4c8
add esp, 0x10
jmp 0x4225c7
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 3], 0
je 0x4225c7
push 0x472b28
mov eax, dword [ebp - 0x7dc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4225c7
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043ec28
add esp, 0x10
test eax, eax
je 0x42259f
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 3], 0
mov eax, dword [ebp - 0x7e0]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043e4c8
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x4225f8
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
push ecx
push str._n_PIPE_WORKED_cc__x__lsid__x_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x4226a5
cmp dword [ebp - 0x7fc], 0
je 0x4226a5
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x1228]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x1234], al
mov eax, dword [ebp - 0x1228]
mov al, byte [eax + 0xe]
mov byte [ebp - 0x1233], al
mov eax, dword [ebp - 0x1228]
mov al, byte [eax + 0x10]
mov byte [ebp - 0x1232], al
mov eax, dword [ebp - 0x1228]
mov al, byte [eax + 0x12]
mov byte [ebp - 0x1231], al
mov byte [ebp - 0x1230], 0
lea eax, [ebp - 0x1234]
push eax
mov eax, dword [ebp - 0x7fc]
push eax
push str._r_n913:Setting_SUBLAUNCH___d____s_
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x1234]
push eax
mov eax, dword [ebp - 0x7fc]
push eax
call fcn.0042f96e
add esp, 8
mov dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x422b24
mov eax, dword [ebp - 0x80]
add eax, 0x334
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 3], 0
je 0x4226f7
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0040f72a
add esp, 0xc
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x422820
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 2]
cmp eax, 0x40
jne 0x422820
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x422820
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 6]
cmp eax, 0x36
jne 0x422820
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 8]
cmp eax, 0x36
jne 0x422820
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x1238]
add eax, 0xc
push eax
call fcn.0042e798
add esp, 0x14
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x300]
push eax
movsx eax, byte [ebp - 0x22f]
push eax
lea edi, [ebp - 0x230]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x1238]
add eax, 0xc
push eax
push str._r_n_n522:ADSK_CIPHER___S__n______________s__n______________s___d___d__n______________s__n______________s__r_n
call fcn.00452380
add esp, 0x20
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
movsx eax, byte [ebp - 0x7c]
cmp eax, 1
lea eax, [ebp - 0x7c]
mov ecx, 0
adc ecx, 0xffffffff
and ecx, eax
push ecx
lea eax, [ebp - 0x300]
push eax
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.0040dc8b
add esp, 0x20
mov byte [ebp - 0x7c], 0
jmp 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 2]
cmp eax, 0x40
jne 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 6]
cmp eax, 0x36
jne 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 8]
cmp eax, 0x35
jne 0x422b24
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 0xa]
cmp eax, 0x23
jne 0x4228bc
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 0xc]
cmp eax, 0x31
jne 0x4228bc
mov eax, dword [ebp - 0x1238]
movsx eax, byte [eax + 0xe]
cmp eax, 0x2e
jne 0x4228bc
jmp 0x422b24
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x1238]
add eax, 0xc
push eax
call fcn.0042e798
add esp, 0x14
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x300]
push eax
movsx eax, byte [ebp - 0x22f]
push eax
lea edi, [ebp - 0x230]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x1238]
add eax, 0xc
push eax
push str._r_n_n625:ADSK_CIPHER___S__n______________s__n______________s___d___d__n______________s__n______________s__r_n
call fcn.00452380
add esp, 0x20
push str.nonlm
lea eax, [ebp - 0x148]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x422994
push str._r_n522:SILO_05
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x300]
push eax
push 0
push 0
push 0
push 0
call fcn.0040dc8b
add esp, 0x20
jmp 0x422b24
lea edi, [ebp - 0x230]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jne 0x422a09
movsx eax, byte [ebp - 0x22f]
cmp eax, 0x2e
jne 0x422a09
push str._r_n625:SILO_01
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x67c]
push eax
push 0
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.0040dc8b
add esp, 0x20
jmp 0x422b24
lea edi, [ebp - 0x230]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jne 0x422a69
push str._r_n625:SILO_02
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040dc8b
add esp, 0x20
jmp 0x422b24
lea edi, [ebp - 0x230]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 9
jne 0x422ae3
movsx eax, byte [ebp - 0x22c]
cmp eax, 0x2e
jne 0x422ae3
push str._r_n625:SILO_03
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x67c]
push eax
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.0040dc8b
add esp, 0x20
jmp 0x422b24
push str._r_n625:SILO_04
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x148]
push eax
push str.Unhandled
call fcn.0040dc8b
add esp, 0x20
cmp dword [0x462190], 0
je 0x422bdd
cmp dword [ebp - 0x7c4], 0
jne 0x422bdd
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x4621b0]
add ecx, 0xf
cmp eax, ecx
jae 0x422b5e
jmp 0x422bd8
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x422bd8
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 3], 0
je 0x422bd8
cmp dword [0x45e03c], 0
je 0x422ba8
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 0x20]
push ecx
push str._r_r_A__1159pm___X_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
mov al, byte [eax + 0x20]
push eax
mov eax, dword [0x462190]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0040d924
add esp, 0x14
jmp 0x422c6a
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 0x20]
test ecx, ecx
je 0x422c6a
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x422c6a
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 3], 0
je 0x422c6a
cmp dword [0x45e03c], 0
je 0x422c3a
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 0x20]
push ecx
push str._r_r_B__1159pm___X_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
mov al, byte [eax + 0x20]
push eax
mov eax, dword [0x462190]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
call fcn.0040d924
add esp, 0x14
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x29
jne 0x422cac
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x67]
push eax
call fcn.004253f4
add esp, 0x10
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
jne 0x422f1f
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 0x15], 0x11223344
jne 0x422ce1
mov dword [ebp - 0x680], 1
jmp 0x422ceb
mov dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 0x1f]
cmp ecx, 0x55
jne 0x422f10
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x93
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 3]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xc], eax
cmp dword [0x45e03c], 0
je 0x422d70
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 4]
push eax
push str._nMuxInUse_Check_LSID___x__PID___x_
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x15c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x15c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x422f0b
cmp dword [0x45e03c], 0
je 0x422dd0
push str._n_rDisallow_Mux__block_this_one_
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x5b4]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [ebp - 0x680], 0
cmp dword [0x4622f4], 0
jne 0x422e09
call fcn.00434201
mov edi, 0x4818a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4fa0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x422e5b
push 0x40010
push 0x472d10
push 0x5f4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x422f0b
mov dword [ebp - 0x123c], 0
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x684]
mov dword [0x462e9c], eax
mov dword [0x462ea0], 0x10
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x818]
push eax
push 0x430702
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x422ef7
mov dword [ebp - 0x123c], 0
cmp dword [ebp - 0x818], 0
je 0x422ef2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x123c]
cmp dword [ebp - 0x123c], 0x1f4
jle 0x422eed
mov dword [ebp - 0x818], 0
jmp 0x422eb8
jmp 0x422f0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nISM28_CTW_FAIL_d
call fcn.00452380
add esp, 8
jmp 0x422f1a
mov dword [ebp - 0x75c], 0
jmp 0x422f33
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x75c], 0
cmp dword [0x45e03c], 0
je 0x422f5b
mov eax, dword [ebp - 0x75c]
push eax
mov eax, dword [ebp - 0x680]
push eax
push str._ntk_reply__d_____Stop_Mux___x_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x21]
mov dword [0x462230], eax
cmp dword [0x45e03c], 0
je 0x422f89
mov eax, dword [0x462230]
push eax
push str._nMyCon___d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
jne 0x422fe9
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 3], 0
je 0x422fdf
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 1
jmp 0x422fe9
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 1
jle 0x423012
push 0xcc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x46222c], 1
mov eax, dword [ebp - 0x5b4]
cmp dword [eax + 9], 0x12345678
jne 0x423159
cmp dword [0x45e03c], 0
je 0x42303f
push str._n_rIdle_Detection_in_Response...
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
push 1
call fcn.00424d36
add esp, 0xc
mov eax, dword [ebp - 0x5b4]
add eax, 9
lea ecx, [ebp - 0x38]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0xc
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
push 0
call fcn.00452990
add esp, 4
mov dword [ebp - 0x82c], eax
sub dword [ebp - 0x82c], 5
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x82c]
mov dword [eax + 0x18], ecx
cmp dword [0x45e03c], 0
je 0x4230f0
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x12]
push ecx
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x10]
push ecx
push str._n_rIdle_Warn___d__Kill___d___gc_X
call fcn.00452380
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x423154
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x12]
push ecx
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x10]
push ecx
push str.iLOCK__Idle_Warn___d__Kill___d_
push pe_nt_image_headers32
lea eax, [ebp - 0x1304]
push eax
call fcn.00452660
add esp, 0x14
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
push eax
lea eax, [ebp - 0x1304]
push eax
call fcn.004099a4
add esp, 0x10
jmp 0x42319a
cmp dword [0x45e03c], 0
je 0x42317d
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 9]
push eax
push str._n_rNo_Idle_Detection___x_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
add eax, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 3]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0x14], eax
cmp dword [0x462254], 0
je 0x423200
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0xe8], ecx
jmp 0x423210
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 0xe8], 0
mov eax, dword [ebp - 0x5b4]
add eax, 0x125
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [ebp - 0x680], 0
je 0x423c56
cmp dword [0x45e03c], 0
je 0x423255
push str._n_r__Timekeeping_in_Response....do_2nd_request_to_retrieve_particulars
call fcn.00452380
add esp, 4
mov dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x25
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 0x43
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov edi, dword [ebp - 0x7b8]
xor eax, eax
mov ecx, 0x66
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x808]
push eax
push 0x19a
mov eax, dword [ebp - 0x7b8]
push eax
push 0x14
mov eax, dword [ebp - 0x15c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 0
je 0x423c56
mov eax, dword [ebp - 0x7b8]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x423c56
mov eax, dword [ebp - 0x7b8]
cmp dword [eax + 4], 0x11223344
jne 0x423c56
cmp dword [0x45e03c], 0
je 0x42335b
mov eax, dword [ebp - 0x7b8]
mov eax, dword [eax + 0x194]
push eax
mov eax, dword [ebp - 0x7b8]
mov eax, dword [eax + 0x190]
push eax
push str._n_rPipe_for_TK_worked_____X__X_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x7b8]
xor ecx, ecx
mov cl, byte [eax + 8]
push ecx
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x7b8]
add eax, 0x10
push eax
push str._n_rTimekeeper_Prompt_is___s___d_f_x
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x7b8]
cmp dword [eax + 0x190], 0x33aa4411
jne 0x42338e
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [0x462348]
cmp dword [eax + 0x194], ecx
je 0x42338e
call fcn.00410dd4
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 1
jne 0x423c56
mov byte [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 8]
mov byte [ebp - 0x5ab], al
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x4233e8
xor eax, eax
mov al, byte [ebp - 0x5ab]
test al, 4
je 0x4233e8
xor eax, eax
mov al, byte [ebp - 0x5ab]
or al, 8
mov byte [ebp - 0x5ab], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 9]
mov byte [ebp - 0x5aa], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 0xa]
mov byte [ebp - 0x5a9], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 0xb]
mov byte [ebp - 0x5a8], al
mov eax, dword [ebp - 0x7b8]
mov byte [eax + 0x7e], 0
mov edi, dword [ebp - 0x7b8]
add edi, 0x10
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x590]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x423505
cmp dword [0x45e03c], 0
je 0x423474
push str._r_nTK_spin_ctw_0501A_TSE
call fcn.00452380
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x5aa]
test al, 4
je 0x4234b1
mov byte [ebp - 0x5ac], 1
mov eax, 0x472ea0
lea ecx, [ebp - 0x50d]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
jmp 0x423500
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x754], eax
mov dword [0x4817e8], 0
lea eax, [ebp - 0x5ac]
push eax
push 0x432b4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x472eb0
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x423720
mov dword [ebp - 8], 0
cmp dword [0x45e03c], 0
je 0x423526
push str._r_nTK_spin_ctw_0501B
call fcn.00452380
add esp, 4
mov edi, dword [ebp - 0x160]
mov esi, dword [ebp - 0x5b4]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x160]
mov byte [eax], 7
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 8]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 0x12], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 9]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 0x13], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 0xa]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 0x14], al
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 0xb]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 0x15], al
lea edi, [ebp - 0x590]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x160]
add edi, 0x1a
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x160]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x4235f1
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0xdc]
push eax
push str._n_rPRE_TKV_7__Sess_d_
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621dc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [0x4621d8]
push eax
mov eax, dword [ebp - 0x160]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x12a]
mov dword [ecx + 0x12a], eax
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x154]
mov dword [eax + 0x12e], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x818]
push eax
push 0x4334e2
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4236bc
cmp dword [0x45e03c], 0
je 0x4236b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nTK_spin_ctw_0501C_FAIL__d
call fcn.00452380
add esp, 8
mov dword [ebp - 0x818], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 0x818], 0
je 0x423719
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jle 0x423714
mov dword [ebp - 0x818], 0
cmp dword [0x45e03c], 0
je 0x423714
push str._r_nTK_spin_ctw_0501D_stop_thd_stop
call fcn.00452380
add esp, 4
jmp 0x4236c3
mov byte [ebp - 0x5ac], 0x44
cmp dword [0x45e03c], 0
je 0x423742
movsx eax, byte [ebp - 0x5ac]
push eax
push str._r_nTK_spin_ctw_0501F_status_d
call fcn.00452380
add esp, 8
movsx eax, byte [ebp - 0x5ac]
cmp eax, 1
jne 0x4237ef
mov eax, dword [ebp - 0x7b8]
mov al, byte [eax + 0xb]
mov ecx, dword [ebp - 0x5b4]
mov byte [ecx + 0x125], al
mov eax, dword [ebp - 0x5b4]
add eax, 0x126
push eax
call fcn.00417c72
add esp, 4
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 0x12a], 0xc2
lea edi, [ebp - 0x50d]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x5b4]
add edi, 0x12b
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x7bc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x5b4]
add edi, 0x15f
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x423c56
movsx eax, byte [ebp - 0x5ac]
cmp eax, 3
jne 0x423c56
cmp dword [0x45e03c], 0
je 0x423819
push str._n_rTK_Cancel___return_without_use
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x15c]
mov byte [eax], 0x94
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0xe8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xc], eax
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x15c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [ebp - 0x164], 0
je 0x4238ab
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e60f
add esp, 8
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x4238f2
cmp dword [0x45e03c], 0
je 0x4238ed
push str._n_rTK_not_already_inuse
call fcn.00452380
add esp, 4
jmp 0x423c15
cmp dword [0x45e03c], 0
je 0x42390c
push str._n_rTK_not_inuse__free_
call fcn.00452380
add esp, 4
mov dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x7b4]
push eax
push 0
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x154]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x7d0], eax
cmp dword [0x462254], 0
je 0x42396a
mov eax, dword [ebp - 0x80]
mov byte [eax], 0x85
jmp 0x423970
mov eax, dword [ebp - 0x80]
mov byte [eax], 0x86
mov eax, dword [ebp - 0x80]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov esi, 0x9854e0
mov edi, dword [ebp - 0x80]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x80]
mov dword [eax + 0x7c], 0
mov eax, dword [ebp - 0x80]
mov byte [eax + 0xd9], 0
cmp dword [0x462254], 0
je 0x423b9e
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0x78], ecx
cmp dword [0x462078], 0
je 0x4239e6
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x7b8]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffffce
add eax, 0xc6
push eax
mov eax, dword [ebp - 0x80]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x790], 0
je 0x423c15
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x5b4]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
jmp 0x423ea3
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 0xe8], 0
cmp dword [0x45e03c], 0
je 0x423d04
cmp dword [0x462f30], 0
je 0x423cf0
push str._nPIPE_FAILED_____POWER_SUSPENDED_vv_
call fcn.00452380
add esp, 4
jmp 0x423d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.v2PIPE_FAILED_GLE___d__n
call fcn.00452380
add esp, 8
cmp dword [0x4622a0], 0
je 0x423d62
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x4622a0]
shl ecx, 2
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
add eax, ecx
mov dword [0x462eb4], eax
cmp dword [0x45e03c], 0
je 0x423d62
mov eax, dword [0x462eb4]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [0x4622a0]
push eax
push str._n_r_n_nWAIT_53_SET___x____x____x__n_r_n_r
call fcn.00452380
add esp, 0x10
cmp dword [0x4622a8], 0
je 0x423ea3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
jne 0x423ea3
cmp dword [0x462eb4], 0
je 0x423daf
mov dword [0x462eb4], 0
cmp dword [0x45e03c], 0
je 0x423daf
push str._n_rWait53_override
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 2
cmp dword [0x462254], 0
je 0x423e8c
mov dword [ebp - 0x1318], 0
mov esi, 0x473050
mov edi, 0x5acc20
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x80]
mov ax, word [eax + 0x14]
mov word [0x462eec], ax
lea eax, [ebp - 0x131c]
push eax
push 0
lea eax, [ebp - 0x1318]
push eax
push 0x4327d3
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x423e73
mov dword [ebp - 0x1320], 0
cmp dword [ebp - 0x1318], 0
jne 0x423e6e
cmp dword [0x4622c8], 0
je 0x423e41
jmp 0x423e6e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x1320]
cmp dword [ebp - 0x1320], 0x142
jle 0x423e69
mov dword [ebp - 0x1318], 1
jmp 0x423e22
jmp 0x423e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nTHD_SPM_FAIL_d
call fcn.00452380
add esp, 8
jmp 0x423ea3
push 0x40010
push str.APPLICATION_BLOCKED
push str.Unable_to_contact_SofTrack_Server_Agent___Usage_Blocked
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x42401f
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x5b4]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
cmp dword [ebp - 0x688], 0
jne 0x423f42
cmp dword [ebp - 0x164], 0
je 0x423f24
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e60f
add esp, 8
jmp 0x42401f
lea edi, [ebp - 0x1344]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1344], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x133c], eax
cmp dword [ebp - 0x164], 0
je 0x423f81
mov byte [ebp - 0x1330], 1
mov dword [ebp - 0x758], 0
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x1344]
push eax
push 0x41e88b
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42400b
mov dword [ebp - 0x1348], 0
cmp dword [ebp - 0x1344], 0
je 0x424006
cmp dword [0x4622c8], 0
je 0x423fde
jmp 0x424006
inc dword [ebp - 0x1348]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1348], 0x26e
jle 0x424001
jmp 0x424006
jmp 0x423fbf
jmp 0x42401f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nVX4_CTW_FAIL_d
call fcn.00452380
add esp, 8
jmp 0x42407d
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 2
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0x5b4]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x5b4]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5b4]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [0x45e03c], 0
je 0x4240a3
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
push str._r_nesri.PTB___x_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
je 0x4240ee
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0xfe
je 0x4240ee
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 1
je 0x4240ee
cmp dword [ebp - 0x7c4], 0
je 0x42410d
cmp dword [ebp - 0x7c4], 0
je 0x424108
cmp dword [ebp - 0x14c], 0
je 0x424108
jmp 0x424351
cmp dword [ebp - 0x688], 0
jne 0x424157
cmp dword [ebp - 0x164], 0
je 0x424139
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
call fcn.0041e60f
add esp, 8
jmp 0x424234
lea edi, [ebp - 0x136c]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x136c], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1364], eax
cmp dword [ebp - 0x164], 0
je 0x424196
mov byte [ebp - 0x1358], 1
mov dword [ebp - 0x758], 0
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x136c]
push eax
push 0x41e88b
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x424220
mov dword [ebp - 0x1370], 0
cmp dword [ebp - 0x136c], 0
je 0x42421b
cmp dword [0x4622c8], 0
je 0x4241f3
jmp 0x42421b
inc dword [ebp - 0x1370]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1370], 0x26e
jle 0x424216
jmp 0x42421b
jmp 0x4241d4
jmp 0x424234
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nVX7_CTW_FAIL_d
call fcn.00452380
add esp, 8
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x4621b0]
add ecx, 0xf
cmp eax, ecx
jae 0x424351
mov edi, 0x5aca80
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4fa0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x4242a1
push 0x40010
push 0x473120
push 0x5f4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x424351
mov dword [ebp - 0x1374], 0
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x684]
mov dword [0x462e9c], eax
mov dword [0x462ea0], 0x10
lea eax, [ebp - 0x758]
push eax
push 0
lea eax, [ebp - 0x818]
push eax
push 0x430702
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42433d
mov dword [ebp - 0x1374], 0
cmp dword [ebp - 0x818], 0
je 0x424338
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x1374]
cmp dword [ebp - 0x1374], 0x1f4
jle 0x424333
mov dword [ebp - 0x818], 0
jmp 0x4242fe
jmp 0x424351
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nISSM_CTW_FAIL_d
call fcn.00452380
add esp, 8
movsx eax, byte [ebp - 0x5ac]
cmp eax, 0x44
je 0x4244c0
push 0
call fcn.00452990
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x4243e8
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0xf0]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rDriver_non_44_hookup_now__x__signal___x__240_x__x__PID_4___X__d_
call fcn.00452380
add esp, 0x1c
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x46]
push eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov cx, word [eax + 0x44]
push ecx
push str._r_n68.1___x._x_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x424421
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
push eax
push str._TSI__d_._d
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x424477
push 0
call fcn.00452990
add esp, 4
push eax
push str._n_rDriver_non_44_hookup_returned_K__x_
call fcn.00452380
add esp, 8
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0x2d
cmp eax, ecx
jbe 0x4244bb
cmp dword [0x462150], 0
je 0x4244bb
cmp dword [0x45e03c], 0
je 0x4244b6
push str._n_rQThread_QExit_QNow_n_nABORT_n_n
call fcn.00452380
add esp, 4
jmp 0x424d31
jmp 0x4244da
cmp dword [0x45e03c], 0
je 0x4244da
push str._n_rDriver_44_skip_nv_
call fcn.00452380
add esp, 4
jmp 0x4244f4
cmp dword [0x462124], 0
je 0x4244f4
push 0x4e
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4622c8], 0
je 0x424510
mov dword [0x4621c8], 1
jmp 0x424d31
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 0xa
mov eax, dword [ebp - 0x80]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
push 0
lea eax, [ebp - 0x808]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x4622c8], 0
je 0x42458a
mov eax, dword [ebp - 0x80]
mov byte [eax], 0
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x424a2a
cmp dword [0x45e03c], 0
je 0x4245dd
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push str._nUNLOCK_LSID___x_
call fcn.00452380
add esp, 8
push 0x473230
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xbe]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push 0x473234
call fcn.004099a4
add esp, 0x10
push 0x47323c
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xbe]
push eax
push 0
call fcn.00424d36
add esp, 0xc
cmp dword [0x46224c], 0
je 0x424683
mov dword [ebp - 0x814], 0x200
mov dword [ebp - 0x810], 0x190
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80]
mov byte [eax], 0x17
mov eax, dword [ebp - 0x80]
mov byte [eax + 1], 0
mov edi, dword [ebp - 0x788]
mov esi, dword [ebp - 0x80]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x814]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x7a0], eax
cmp dword [0x45e03c], 0
je 0x42467e
mov eax, dword [ebp - 0x7a0]
push eax
push str._nNW_WORKED___x_
call fcn.00452380
add esp, 8
jmp 0x424a25
mov dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x7b4]
push eax
push 0
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xbe]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x7d0], eax
cmp dword [0x462254], 0
je 0x4246df
mov eax, dword [ebp - 0x80]
mov byte [eax], 0x47
mov eax, dword [ebp - 0x80]
mov byte [eax + 1], 0
mov esi, 0x9854e0
mov edi, dword [ebp - 0x80]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
cmp dword [0x462254], 0
je 0x4249bb
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7d0]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x7bc]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x7bc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x80]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x80]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x42479f
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xdc]
push eax
push str.__TSE_ID_from_vs___d___PID_X_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
call fcn.0040f8b4
add esp, 8
mov eax, dword [ebp - 0x80]
mov byte [eax + 0xd9], 0
mov eax, dword [ebp - 0x80]
cmp dword [eax + 4], 0
je 0x4247ee
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x7c8], eax
jmp 0x4247f8
mov dword [ebp - 0x7c8], 0
lea eax, [ebp - 0x838]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x80]
add eax, 0xc3
push eax
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0044af6c
add esp, 0xc
lea eax, [ebp - 0x838]
mov ecx, dword [ebp - 0x80]
add ecx, 0xbc
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
cmp dword [0x45e03c], 0
je 0x4248b8
xor eax, eax
mov al, byte [ebp - 0x833]
push eax
xor eax, eax
mov al, byte [ebp - 0x834]
push eax
xor eax, eax
mov al, byte [ebp - 0x835]
push eax
xor eax, eax
mov al, byte [ebp - 0x836]
push eax
xor eax, eax
mov al, byte [ebp - 0x837]
push eax
xor eax, eax
mov al, byte [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc3]
push eax
push str._n_r_X.v.out.User_Login_Time_sid__d_
call fcn.00452380
add esp, 0x24
cmp dword [0x462278], 0
je 0x424932
mov eax, dword [ebp - 0x80]
mov byte [eax + 0xf], 0xa4
mov eax, dword [ebp - 0x80]
add eax, 0x10
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0043d6ab
add esp, 8
mov eax, dword [ebp - 0x80]
add eax, 0x10
push eax
push 0x9854e0
call fcn.00452540
add esp, 8
test eax, eax
jne 0x424908
mov eax, dword [ebp - 0x80]
mov byte [eax + 0xf], 0
cmp dword [0x45e03c], 0
je 0x424932
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov cl, byte [eax + 0xf]
push ecx
mov eax, dword [ebp - 0x80]
add eax, 0x10
push eax
push str.True_TSE_Remote_PC___s_.47._X
call fcn.00452380
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c8], 0
je 0x42496c
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffff9c
add eax, 0xe4
push eax
mov eax, dword [ebp - 0x80]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
jmp 0x424a25
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffffba
add eax, 0xc6
push eax
mov eax, dword [ebp - 0x80]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x424a3f
cmp dword [0x462124], 0
je 0x424a3f
push 0x26
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x5b4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov edi, dword [ebp - 0x840]
xor eax, eax
mov ecx, 0x64
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 9
push 0
lea eax, [ebp - 0x808]
push eax
push 0x91a
mov eax, dword [ebp - 0x840]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x5b4]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x5b4]
mov byte [eax], 0
cmp dword [0x4622c8], 0
je 0x424ad1
mov eax, dword [ebp - 0x840]
mov byte [eax], 0
mov eax, dword [ebp - 0x840]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x424cbb
cmp dword [0x45e03c], 0
je 0x424b11
mov eax, dword [ebp - 0x840]
mov eax, dword [eax + 0x32]
push eax
mov eax, dword [ebp - 0x840]
mov eax, dword [eax + 4]
push eax
push str._nTIMEKEEPER_RECORD_on_LSID___x___this.i_X
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x840]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0x32], ecx
mov eax, dword [ebp - 0x840]
add eax, 0xc
push eax
call fcn.00417c72
add esp, 4
cmp dword [0x46224c], 0
je 0x424c39
mov dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x7bc]
mov byte [eax], 0
lea eax, [ebp - 0x7b4]
push eax
push 0
mov eax, dword [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7cc]
push eax
mov eax, dword [ebp - 0x840]
mov eax, dword [eax + 0xc6]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x840]
mov ecx, dword [ebp - 0x840]
mov eax, dword [eax + 0xc6]
mov dword [ecx + 0xbe], eax
mov dword [ebp - 0x814], 0x200
mov dword [ebp - 0x810], 0x190
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x80c], eax
mov edi, dword [ebp - 0x788]
mov esi, dword [ebp - 0x840]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x814]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x7a0], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45e03c], 0
je 0x424c34
mov eax, dword [ebp - 0x7a0]
push eax
push str._nNW_TIMEKEEPER_WORKED___x_
call fcn.00452380
add esp, 8
jmp 0x424cb6
mov eax, dword [ebp - 0x840]
cmp dword [eax + 4], 0x24112233
jae 0x424c51
jmp 0x424cb6
mov byte [0x9854ef], 0
mov esi, 0x9854e0
mov edi, dword [ebp - 0x840]
add edi, 0x88
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x840]
mov ecx, dword [0x462304]
mov dword [eax + 0x80], ecx
push 1
lea eax, [ebp - 0x808]
push eax
push 0x80
mov eax, dword [ebp - 0x5b4]
push eax
push 0x190
mov eax, dword [ebp - 0x840]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x790], eax
jmp 0x424cd0
cmp dword [0x462124], 0
je 0x424cd0
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4622c8], 0
je 0x424cec
mov dword [0x4621c8], 1
jmp 0x424d31
push 7
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x150]
mov ecx, 0x2710
mov eax, dword [ebp - 0x150]
cdq
idiv ecx
test edx, edx
jne 0x424d2c
cmp dword [0x462f30], 0
jne 0x424d22
call fcn.00428e0f
mov dword [ebp - 0x150], 0
jmp 0x41eb08
pop edi
pop esi
pop ebx
leave
ret