Function at 0x4293f0
Capabilities:
Accept command line arguments
Check mutex on windows
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get comspec environment variable
Get file system object information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.0040af60
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xb10], 0
xor eax, eax
mov word [ebp - 0x698], ax
push 0x45e
push 0
lea ecx, [ebp - 0x696]
push ecx
call fcn.00401b20
add esp, 0xc
xor edx, edx
mov word [ebp - 0xb00], dx
push 0x45e
push 0
lea eax, [ebp - 0xafe]
push eax
call fcn.00401b20
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xd20], cx
push 0x1fe
push 0
lea edx, [ebp - 0xd1e]
push edx
call fcn.00401b20
add esp, 0xc
xor eax, eax
mov word [ebp - 0xf30], ax
push 0x1fe
push 0
lea ecx, [ebp - 0xf2e]
push ecx
call fcn.00401b20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00401b20
add esp, 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0xd26]
call fcn.00401520
lea ecx, [ebp - 0xd25]
call fcn.00401520
mov dword [ebp - 0x220], str.ErrorInfo.log
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0xd24], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
push edx
call fcn.00413de0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp - 0xf31]
call fcn.00401520
lea eax, [ebp - 0xf31]
push eax
call fcn.0040e0a0
lea ecx, [ebp - 0xf31]
call fcn.00401610
mov ecx, dword [ebp + 8]
mov dword [0x4569f8], ecx
push 0x118
push 0x457190
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 5]
call fcn.00401520
lea ecx, [ebp - 0x699]
call fcn.00401520
lea edx, [ebp - 5]
push edx
call fcn.0040bd90
mov dword [ebp - 4], eax
lea eax, [ebp - 0x699]
push eax
call fcn.0040f870
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bd30
lea edx, [ebp - 0xb0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xb0c], 2
jle 0x429764
mov dword [ebp - 0xf38], 0xffffffff
lea eax, [ebp - 0x698]
mov dword [ebp - 0xf40], eax
mov dword [ebp - 0xf3c], 0
lea ecx, [ebp - 0xf41]
call fcn.00401520
mov dword [ebp - 0xb1c], 0x270f
mov dword [ebp - 0xb04], 0
jmp 0x429612
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457190]
test eax, eax
je 0x42965f
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457190]
cmp edx, 0x5c
je 0x42964a
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457190]
cmp ecx, 0x2f
jne 0x42965d
mov edx, dword [ebp - 0xb04]
lea eax, [edx*2 + 0x457190]
mov dword [ebp - 0xf3c], eax
jmp 0x429603
cmp dword [ebp - 0xf3c], 0
je 0x429681
xor ecx, ecx
mov edx, dword [ebp - 0xf3c]
mov word [edx], cx
mov eax, dword [ebp - 0xf3c]
add eax, 2
mov dword [0x43f7ac], eax
mov ecx, dword [ebp - 0xd2c]
mov edx, dword [ecx + 4]
push edx
call fcn.00403b41
add esp, 4
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0xf40]
push eax
mov ecx, dword [ebp - 0xf38]
push ecx
lea edx, [ebp - 0xf41]
push edx
call fcn.0040d720
mov dword [ebp - 4], eax
lea eax, [ebp - 0xf38]
push eax
mov ecx, dword [ebp - 0xf40]
push ecx
lea edx, [ebp - 0xf41]
push edx
call fcn.0040c600
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xf38]
push ecx
push str._____d___d__r_n
mov edx, dword [ebp - 0xf40]
add edx, 0x27
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x4396dc
mov eax, dword [ebp - 0xf40]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x457190
push 0x439704
lea ecx, [ebp - 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xf40]
push edx
mov eax, dword [ebp - 0xf40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb00]
push ecx
call fcn.004012b0
add esp, 0xc
lea ecx, [ebp - 0xf41]
call fcn.00401610
jmp 0x42a97c
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x456158], eax
cmp dword [0x456158], 0
jne 0x42979c
mov dword [ebp - 0xb1c], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
jmp 0x42a97c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
cmp dword [ebp - 0xb18], 0xb7
jne 0x4297cd
mov dword [ebp - 0xb1c], 0x270d
mov dword [ebp - 0xb18], 0
jmp 0x42a97c
push 1
push str.HTTP_Parser_Log.txt
call fcn.0040b580
push 0x43976c
call fcn.0040b400
add esp, 4
push 0x457190
push 0x439770
call fcn.0040b400
add esp, 8
mov edx, dword [ebp - 0x218]
push edx
push str.__tWinMain__________________CodePage_______________________d_
call fcn.0040b400
add esp, 8
mov eax, dword [ebp - 0xb0c]
push eax
push str.__tWinMain__________________Arg_Count______________________d_
call fcn.0040b400
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
push str.__tWinMain__________________ActUserNameInformation_________d_
call fcn.0040b400
add esp, 8
lea edx, [ebp - 5]
push edx
call fcn.0040bee0
push eax
push str.__tWinMain__________________Logon_UserCount________________d_
call fcn.0040b400
add esp, 8
lea eax, [ebp - 5]
push eax
call fcn.0040bef0
push eax
push str.__tWinMain__________________ActiveUserName_________________s_
call fcn.0040b400
add esp, 8
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bd20
push eax
push str.__tWinMain__________________MainGetUserName________________s_
call fcn.0040b400
add esp, 8
push str.__tWinMain__________________Start________
call fcn.0040b400
add esp, 4
lea ecx, [ebp - 0x1168]
call fcn.0040bcd0
push 1
lea ecx, [ebp - 0x1168]
call fcn.0040b9f0
test eax, eax
je 0x4298c0
lea edx, [ebp - 0x1168]
push edx
call fcn.00412b60
push 1
lea ecx, [ebp - 0x1168]
call fcn.0040b910
jmp 0x4299b3
mov dword [ebp - 0xb1c], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457190
push 0x439b70
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
lea ecx, [ebp - 0x1168]
call fcn.0040bc00
push eax
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.004012b0
add esp, 0xc
lea ecx, [ebp - 0x1168]
call fcn.0040bc40
jmp 0x42a97c
lea ecx, [ebp - 0x1168]
call fcn.0040bc40
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0xb04], 0
jmp 0x4299e3
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457190]
test eax, eax
je 0x429a30
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457190]
cmp edx, 0x5c
je 0x429a1b
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457190]
cmp ecx, 0x2f
jne 0x429a2e
mov edx, dword [ebp - 0xb04]
lea eax, [edx*2 + 0x457190]
mov dword [ebp - 0x116c], eax
jmp 0x4299d4
cmp dword [ebp - 0x116c], 0
je 0x429a52
xor ecx, ecx
mov edx, dword [ebp - 0x116c]
mov word [edx], cx
mov eax, dword [ebp - 0x116c]
add eax, 2
mov dword [0x43f7ac], eax
mov ecx, dword [0x43f7ac]
push ecx
push 0x439be0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x429a77
mov dword [ebp - 0xb1c], 0x3df
jmp 0x42a97c
push str.parser_manifest.xml
push 0x457190
push 0x439b7c
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str.regist.txt
push 0x457190
push 0x439c40
lea eax, [ebp - 0xf30]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x210]
push edx
call section..text
add esp, 8
test eax, eax
jge 0x429ade
mov dword [ebp - 0xb1c], 0x3e0
jmp 0x42a97c
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0xf30]
push ecx
call section..text
add esp, 8
test eax, eax
jge 0x429b27
push 9
lea edx, [ebp - 0xf30]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0041eae0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x429b25
mov dword [ebp - 0xb1c], 0x3e9
jmp 0x42a97c
jmp 0x429b54
push 1
lea ecx, [ebp - 0xf30]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0041eae0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x429b54
mov dword [ebp - 0xb1c], 0x3ea
jmp 0x42a97c
push str.parserchk.txt
push 0x457190
push 0x439c68
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x429bda
mov dword [0x456a20], 1
push str.parsernot.txt
push 0x457190
push 0x439c90
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x429bda
mov dword [0x456a20], 2
push 0x457190
push str._sHTTP_Parser.chm
push 0x4573c0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x117c], 0
mov dword [ebp - 0x1170], 0
mov dword [ebp - 0x1174], 0
mov dword [ebp - 0x1178], 0
push str.BINTYPE
push 0x12d
mov eax, dword [0x4569f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 0
je 0x429ce5
push 0x460
push 0
lea ecx, [ebp - 0x698]
push ecx
call fcn.00401b20
add esp, 0xc
cmp dword [ebp - 0x117c], 0
je 0x429c79
mov edx, dword [ebp - 0x117c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x117c], 0
je 0x429c99
mov ecx, dword [ebp - 0x117c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1170], 0
je 0x429cb5
mov eax, dword [ebp - 0x1170]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1178], eax
lea ecx, [ebp - 0x698]
push ecx
push str.logo.gif
mov edx, dword [ebp - 0x1174]
push edx
mov eax, dword [ebp - 0x1178]
push eax
call fcn.004188d0
lea ecx, [ebp - 0x698]
push ecx
call fcn.00412b20
mov dword [0x4569fc], eax
cmp dword [ebp - 0x1170], 0
je 0x429cfb
mov edx, dword [ebp - 0x1170]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x457190
push str._s_themes_b_good.bmp
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457190
push str._s_themes_b_bad.bmp
lea ecx, [ebp - 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457190
push str._s_themes_b_desktop.bmp
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x698]
push eax
call fcn.00412b20
mov dword [0x456a00], eax
lea ecx, [ebp - 0xb00]
push ecx
call fcn.00412b20
mov dword [0x456a04], eax
lea edx, [ebp - 0xd20]
push edx
call fcn.00412b20
mov dword [0x456a08], eax
mov dword [ebp - 0x1180], 0x900000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x456164], eax
cmp dword [0x456164], 0xffffffff
jne 0x429e9e
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
mov dword [0x456164], 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457190
push 0x439da4
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
push str.Mail_Handle_Create_Error
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push 0x439de8
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.004012b0
add esp, 0xc
jmp 0x42a97c
push str.PARSER_SHARED_MAPMEMORY
mov ecx, dword [ebp - 0x1180]
push ecx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x456168], eax
cmp dword [0x456168], 0
jne 0x429fb2
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x220]
push eax
push 0x457190
push 0x439e64
lea ecx, [ebp - 0xd20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xb18]
push edx
push 0x439e70
movzx eax, word [ebp - 0x224]
push eax
movzx ecx, word [ebp - 0x226]
push ecx
movzx edx, word [ebp - 0x228]
push edx
movzx eax, word [ebp - 0x22a]
push eax
movzx ecx, word [ebp - 0x22e]
push ecx
movzx edx, word [ebp - 0x230]
push edx
push 0x439ea0
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xd24]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x698]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xd24]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xd20]
push edx
call fcn.004012b0
add esp, 0xc
jmp 0x42a97c
mov eax, dword [ebp - 0x1180]
push eax
push 0
push 0
push 2
mov ecx, dword [0x456168]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x456170], eax
cmp dword [0x456170], 0
jne 0x42a0c6
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x220]
push eax
push 0x457190
push 0x439eec
lea ecx, [ebp - 0xd20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xb18]
push edx
push str.Map_Handle_Create_Error
movzx eax, word [ebp - 0x224]
push eax
movzx ecx, word [ebp - 0x226]
push ecx
movzx edx, word [ebp - 0x228]
push edx
movzx eax, word [ebp - 0x22a]
push eax
movzx ecx, word [ebp - 0x22e]
push ecx
movzx edx, word [ebp - 0x230]
push edx
push 0x439f28
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xd24]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x698]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xd24]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xd20]
push edx
call fcn.004012b0
add esp, 0xc
jmp 0x42a97c
mov eax, dword [0x456170]
add eax, 0x100000
mov dword [0x4578a8], eax
mov ecx, dword [0x456170]
push ecx
push str.__tWinMain__________________SharedMemory___________________08X_
call fcn.0040b400
add esp, 8
mov dword [ebp - 0x1188], 8
mov dword [ebp - 0x1184], 0x3ff
lea edx, [ebp - 0x1188]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x100
push 0x456d60
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x42a133
push str.cmd.exe
push 0x456d60
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x440d28
call fcn.00401b20
add esp, 0xc
push 0x439f74
push 0x457190
push 0x43a034
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x42a199
push 0x440d28
push 0x5460
lea eax, [ebp - 0x698]
push eax
call fcn.004010e0
add esp, 0xc
mov dword [0x456a0c], 1
lea ecx, [ebp - 0xb08]
push ecx
push 0
push 0
push 0x41a8e0
push 0
push 0
call fcn.00403457
add esp, 0x18
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x42a2ba
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x220]
push eax
push 0x457190
push 0x43a040
lea ecx, [ebp - 0xd20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xb18]
push edx
push str.sessionSearchThread_Call_Error
movzx eax, word [ebp - 0x224]
push eax
movzx ecx, word [ebp - 0x226]
push ecx
movzx edx, word [ebp - 0x228]
push edx
movzx eax, word [ebp - 0x22a]
push eax
movzx ecx, word [ebp - 0x22e]
push ecx
movzx edx, word [ebp - 0x230]
push edx
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xd24]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x698]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xd24]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xd20]
push edx
call fcn.004012b0
add esp, 0xc
jmp 0x42a97c
call fcn.00413960
mov dword [ebp - 0xb04], 0
jmp 0x42a2da
mov eax, dword [ebp - 0xb04]
add eax, 1
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
movzx edx, word [ecx + 0x440aa8]
test edx, edx
je 0x42a30c
mov eax, dword [ebp - 0xb04]
shl eax, 7
add eax, 0x440aa8
push eax
push str.__tWinMain__________________InstBrowser____________________s_
call fcn.0040b400
add esp, 8
jmp 0x42a2cb
push str._test.html
call fcn.00413130
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x42a556
mov dword [ebp - 0xb04], 0
jmp 0x42a344
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0x238]
movzx ecx, word [eax + edx*2]
test ecx, ecx
je 0x42a385
mov edx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0x238]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x42a383
mov edx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0x238]
lea ecx, [eax + edx*2 + 2]
mov dword [ebp - 0x21c], ecx
jmp 0x42a335
cmp dword [ebp - 0x21c], 0
jne 0x42a398
mov dword [ebp - 0x21c], 0x43a190
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42a3d0
mov eax, dword [ebp - 0xb04]
add eax, 1
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
movzx edx, word [ecx + 0x440828]
test edx, edx
je 0x42a41d
mov eax, dword [ebp - 0xb14]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
add edx, 0x440828
push edx
call fcn.004013b0
add esp, 0xc
test eax, eax
jne 0x42a41b
mov eax, dword [ebp - 0xb04]
mov dword [0x456a10], eax
jmp 0x42a41d
jmp 0x42a3c1
cmp dword [0x456a10], 0xffffffff
jne 0x42a4ba
mov dword [ebp - 0x21c], str.msedge.exe
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42a46c
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
movzx ecx, word [eax + 0x440828]
test ecx, ecx
je 0x42a4ba
mov edx, dword [ebp - 0xb14]
push edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
add ecx, 0x440828
push ecx
call fcn.004013b0
add esp, 0xc
test eax, eax
jne 0x42a4b8
mov edx, dword [ebp - 0xb04]
mov dword [0x456a10], edx
jmp 0x42a4ba
jmp 0x42a45d
cmp dword [0x456a10], 0xffffffff
jne 0x42a556
mov dword [ebp - 0x21c], str.iexplore.exe
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42a509
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
movzx eax, word [edx + 0x440828]
test eax, eax
je 0x42a556
mov ecx, dword [ebp - 0xb14]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
add eax, 0x440828
push eax
call fcn.004013b0
add esp, 0xc
test eax, eax
jne 0x42a554
mov ecx, dword [ebp - 0xb04]
mov dword [0x456a10], ecx
jmp 0x42a556
jmp 0x42a4fa
mov edx, dword [0x456a10]
shl edx, 7
add edx, 0x440828
push edx
mov eax, dword [0x456a10]
shl eax, 7
add eax, 0x440aa8
push eax
mov ecx, dword [0x456a10]
push ecx
push str.__tWinMain__________________DefaultBrowser_________________d___s_:__s_
call fcn.0040b400
add esp, 0x10
push str.parsercommon.data
push 0x457190
push 0x43a274
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0x698]
push ecx
call section..text
add esp, 8
test eax, eax
jl 0x42a609
push 0x446188
push 0x310
lea edx, [ebp - 0x698]
push edx
call fcn.004010e0
add esp, 0xc
test eax, eax
jl 0x42a602
mov eax, dword [0x446190]
mov dword [0x456a10], eax
mov ecx, dword [0x446194]
mov dword [0x43f784], ecx
mov edx, dword [0x44618c]
mov dword [0x456a14], edx
jmp 0x42a609
mov byte [0x446188], 0
movzx eax, byte [0x446188]
test eax, eax
jne 0x42a689
mov byte [0x446188], 9
mov byte [0x446189], 9
mov byte [0x44618a], 3
mov byte [0x44618b], 3
mov ecx, dword [0x456a14]
mov dword [0x44618c], ecx
mov edx, dword [0x456a10]
mov dword [0x446190], edx
mov eax, dword [0x43f784]
mov dword [0x446194], eax
mov byte [0x446198], 0
mov byte [0x446199], 0
mov byte [0x44619a], 0
mov byte [0x44619c], 0
push 0
push 0x446188
push 0x310
lea ecx, [ebp - 0x698]
push ecx
call fcn.004011d0
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x457844], eax
cmp dword [0x457844], 0
je 0x42a708
mov dword [ebp - 0x1448], 0x99
jmp 0x42a6c2
mov edx, dword [ebp - 0x1448]
add edx, 1
mov dword [ebp - 0x1448], edx
cmp dword [ebp - 0x1448], 0xb5
jg 0x42a708
push 0
push 0x10
push 0x10
push 1
movzx eax, word [ebp - 0x1448]
push eax
mov ecx, dword [0x4569f8]
push ecx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x1444], eax
mov edx, dword [ebp - 0x1444]
push edx
push 0xffffffffffffffff
mov eax, dword [0x457844]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x42a6b3
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov ecx, dword [0x4569f8]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x457840], eax
push 0x4000
push 0x2b4
lea edx, [ebp - 0x1440]
push edx
push 0
push 0x43a280
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x457838], eax
push 0x4001
push 0x2b4
lea eax, [ebp - 0x1440]
push eax
push 0
push 0x43a288
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x45783c], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x42a7b7
push str.HtmlHelpW
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4578b0], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x42a7e8
push str.ImmAssociateContext
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4578ac], eax
mov eax, dword [0x43f7a0]
push eax
mov ecx, dword [0x43f79c]
push ecx
mov edx, dword [0x43f798]
push edx
mov eax, dword [0x43f794]
push eax
mov ecx, dword [0x43f7a4]
push ecx
mov edx, dword [ebp - 0xb10]
push edx
push str.__tWinMain______________Run_____IDD_PARSER_BASE_____1______d___d:_d:_d:_d:_d_
call fcn.0040b400
add esp, 0x1c
push 0x8d
mov eax, dword [0x4569f8]
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x456154], eax
push 0
push 0x4253d0
push 0
push 0x259
mov ecx, dword [0x4569f8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x4569f0], 0
mov dword [0x456a0c], 0
mov edx, dword [0x43f7a0]
push edx
mov eax, dword [0x43f79c]
push eax
mov ecx, dword [0x43f798]
push ecx
mov edx, dword [0x43f794]
push edx
mov eax, dword [0x43f7a4]
push eax
mov ecx, dword [ebp - 0xb10]
push ecx
push str.__tWinMain______________End_____parserSearchThread__1______d___d:_d:_d:_d:_d_
call fcn.0040b400
add esp, 0x1c
mov edx, dword [ebp - 0xb10]
push edx
push str.__tWinMain______________End_____parserSearchThread__2______d_
call fcn.0040b400
add esp, 8
push 0x457190
push str._slist.txt
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45616c], 0
je 0x42a919
push 0x1388
mov ecx, dword [0x45616c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x45616c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.004189a0
push str.sitelink.txt
push 0x457190
push str._s_s
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x440d28
push 0x5460
lea ecx, [ebp - 0x698]
push ecx
call fcn.004011d0
add esp, 0x10
mov dword [ebp - 4], eax
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push str.__tWinMain__________________SITE_CHECKST_FILE______________d___d___s_
call fcn.0040b400
add esp, 0x10
mov dword [ebp - 0x218], 0x10
cmp dword [0x457848], 0
je 0x42a99c
mov ecx, dword [0x457848]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x457840], 0
je 0x42a9b2
mov edx, dword [0x457840]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x457844], 0
je 0x42a9c7
mov eax, dword [0x457844]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x456170], 0
je 0x42a9dd
mov ecx, dword [0x456170]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x456168], 0
je 0x42a9f3
mov edx, dword [0x456168]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456164], 0
je 0x42aa08
mov eax, dword [0x456164]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456158], 0
je 0x42aa1e
mov ecx, dword [0x456158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xb1c]
mov dword [ebp - 0x1450], edx
cmp dword [ebp - 0x1450], 0x3df
jg 0x42aa58
cmp dword [ebp - 0x1450], 0x3df
je 0x42ab03
cmp dword [ebp - 0x1450], 0
je 0x42aaf5
jmp case.default.0x42aae9
cmp dword [ebp - 0x1450], 0x3e9
jg 0x42aaa9
cmp dword [ebp - 0x1450], 0x3e9
je 0x42ac0b
cmp dword [ebp - 0x1450], 0x3e0
je 0x42ab39
cmp dword [ebp - 0x1450], 0x3e1
je 0x42ab6f
cmp dword [ebp - 0x1450], 0x3e2
je 0x42abcb
jmp case.default.0x42aae9
cmp dword [ebp - 0x1450], 0x270e
jg 0x42aaf0
cmp dword [ebp - 0x1450], 0x270d
jge 0x42ad77
mov eax, dword [ebp - 0x1450]
sub eax, 0x3ea
mov dword [ebp - 0x1450], eax
cmp dword [ebp - 0x1450], 3
ja case.default.0x42aae9
mov ecx, dword [ebp - 0x1450]
jmp dword [ecx*4 + 0x42ae88]
jmp case.default.0x42aae9
xor edx, edx
mov word [ebp - 0x698], dx
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ab22
push 0x43a588
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42ab34
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ab58
push 0x43a688
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42ab6a
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ab9c
mov ecx, dword [ebp - 0xb18]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x43a780
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x42abbc
mov ecx, dword [ebp - 0xb18]
push ecx
mov edx, dword [ebp - 4]
push edx
push str.OS_state_is_unstable___d_:__d_
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x218], 0x30
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42abea
push 0x43a848
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42abfc
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x218], 0x30
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ac31
mov eax, dword [ebp - 4]
push eax
push 0x43a928
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42ac53
lea edx, [ebp - 0xd26]
push edx
call fcn.0040bd60
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ac7e
mov ecx, dword [ebp - 4]
push ecx
push 0x43ab28
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42aca0
lea eax, [ebp - 0xd26]
push eax
call fcn.0040bd60
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42accb
mov edx, dword [ebp - 4]
push edx
push 0x43ad28
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42aced
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bd60
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ad18
mov eax, dword [ebp - 4]
push eax
push 0x43af28
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42ad31
mov edx, dword [ebp - 4]
push edx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ad5c
mov ecx, dword [ebp - 4]
push ecx
push 0x43b128
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42ad75
mov eax, dword [ebp - 4]
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42add1
push 0
call fcn.00413de0
test eax, eax
je 0x42ada0
mov edx, dword [ebp - 0xb18]
push edx
push 0x43b328
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42adbc
mov ecx, dword [ebp - 0xb18]
push ecx
push 0x43b358
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x218], 0x30
jmp 0x42add1
xor eax, eax
mov word [ebp - 0x698], ax
movzx ecx, word [ebp - 0x698]
test ecx, ecx
je 0x42adfc
mov edx, dword [ebp - 0x218]
push edx
push str._notification_BOX
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.__tWinMain__________________End__________
call fcn.0040b400
add esp, 4
mov ecx, dword [ebp - 0xb18]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
push str.__tWinMain__________________fcret__________________________d_:__d___d_
call fcn.0040b400
add esp, 0x10
push 0x43b354
call fcn.0040b400
add esp, 4
call fcn.0040b550
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0x144c], ecx
lea ecx, [ebp - 0x699]
call fcn.00401610
lea ecx, [ebp - 5]
call fcn.00401610
lea ecx, [ebp - 0xd25]
call fcn.00401610
lea ecx, [ebp - 0xd26]
call fcn.00401610
mov eax, dword [ebp - 0x144c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401b06
mov esp, ebp
pop ebp
ret 0x10