Function at 0x428e10
Capabilities:
Accept command line arguments
Check mutex on windows
Contain obfuscated stackstrings
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get comspec environment variable
Get file system object information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.004091c0
mov eax, dword [0x43e2a0]
xor eax, ebp
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x914], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x910], 0
mov dword [ebp - 0x904], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x908], 0
xor eax, eax
mov word [ebp - 0x498], ax
push 0x45e
push 0
lea ecx, [ebp - 0x496]
push ecx
call fcn.00402860
add esp, 0xc
xor edx, edx
mov word [ebp - 0x8f8], dx
push 0x45e
push 0
lea eax, [ebp - 0x8f6]
push eax
call fcn.00402860
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xb1e]
call fcn.00401ab0
lea ecx, [ebp - 0xb1d]
call fcn.00401ab0
mov dword [ebp - 0x14], str.ErrorInfo.log
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0xb1c], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040fa10
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0xb1e]
push eax
call fcn.0042b080
mov byte [ebp - 0xb2c], 0x4d
mov byte [ebp - 0xb2b], 0x69
mov byte [ebp - 0xb2a], 0x63
mov byte [ebp - 0xb29], 0x72
mov ecx, dword [ebp - 0xb2c]
mov dword [0x43ef5c], ecx
mov byte [ebp - 0xb2c], 0x6f
mov byte [ebp - 0xb2b], 0x73
mov byte [ebp - 0xb2a], 0x6f
mov byte [ebp - 0xb29], 0x66
mov edx, dword [ebp - 0xb2c]
mov dword [0x43ef60], edx
mov byte [ebp - 0xb2c], 0x74
mov byte [ebp - 0xb2b], 0x2e
mov byte [ebp - 0xb2a], 0x4e
mov byte [ebp - 0xb29], 0x45
mov eax, dword [ebp - 0xb2c]
mov dword [0x43ef64], eax
lea ecx, [ebp - 0xb2d]
call fcn.00401ab0
lea ecx, [ebp - 0xb2d]
push ecx
call fcn.0042d6f0
lea ecx, [ebp - 0xb2d]
call fcn.00401aa0
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4583bc], eax
cmp dword [0x4583bc], 0
jne 0x428fc2
mov dword [ebp - 0x914], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
jmp 0x42a31a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0xb7
jne 0x428ff3
mov dword [ebp - 0x914], 0x270d
mov dword [ebp - 0x910], 0
jmp 0x42a31a
mov edx, dword [ebp + 8]
mov dword [0x458c60], edx
push 0x118
push 0x4593f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xb24], eax
cmp dword [ebp - 0x904], 2
jle 0x4291c9
mov dword [ebp - 0xb34], 0xffffffff
lea ecx, [ebp - 0x498]
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb38], 0
lea ecx, [ebp - 0xb3d]
call fcn.00401ab0
mov dword [ebp - 0x914], 0x270f
mov dword [ebp - 0x8fc], 0
jmp 0x429085
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x4593f0]
test ecx, ecx
je 0x4290d2
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x4593f0]
cmp eax, 0x5c
je 0x4290bd
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x4593f0]
cmp edx, 0x2f
jne 0x4290d0
mov eax, dword [ebp - 0x8fc]
lea ecx, [eax*2 + 0x4593f0]
mov dword [ebp - 0xb38], ecx
jmp 0x429076
cmp dword [ebp - 0xb38], 0
je 0x4290f5
xor edx, edx
mov eax, dword [ebp - 0xb38]
mov word [eax], dx
mov ecx, dword [ebp - 0xb38]
add ecx, 2
mov dword [0x43ef58], ecx
mov edx, dword [ebp - 0xb3c]
push edx
mov eax, dword [ebp - 0xb24]
mov ecx, dword [eax + 4]
movzx edx, word [ecx]
sub edx, 0x30
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.0042cbb0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb34]
push ecx
mov edx, dword [ebp - 0xb3c]
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.0042baa0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xb34]
push edx
push str._____d___d__r_n
mov eax, dword [ebp - 0xb3c]
add eax, 0x27
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x439718
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x4593f0
push 0x439740
lea edx, [ebp - 0x8f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb3c]
push eax
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x8f8]
push edx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb3d]
call fcn.00401aa0
jmp 0x42a31a
lea ecx, [ebp - 0xb25]
call fcn.00401ab0
lea ecx, [ebp - 0xb26]
call fcn.00401ab0
lea eax, [ebp - 0xb25]
push eax
call fcn.0042b2a0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb26]
push ecx
call fcn.0042eea0
lea edx, [ebp - 0xb1e]
push edx
call fcn.0042b050
lea ecx, [ebp - 0xd60]
call fcn.0042ad40
push 1
lea ecx, [ebp - 0xd60]
call fcn.0042aa60
test eax, eax
je 0x429240
lea eax, [ebp - 0xd60]
push eax
call fcn.004143f0
push 1
lea ecx, [ebp - 0xd60]
call fcn.0042a980
jmp 0x429331
mov dword [ebp - 0x914], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4593f0
push 0x43974c
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
lea ecx, [ebp - 0xd60]
call fcn.0042ac70
push eax
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xd60]
call fcn.0042acb0
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
lea ecx, [ebp - 0xd60]
call fcn.0042acb0
push 0x118
lea edx, [ebp - 0x8f8]
push edx
push 0xffffffffffffffff
push str.sysinfoview.xml
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0x18], 0x36387828
mov dword [ebp - 0x8fc], 0
jmp 0x429385
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x4593f0]
test edx, edx
je 0x4293d2
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x4593f0]
cmp ecx, 0x5c
je 0x4293bd
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x4593f0]
cmp eax, 0x2f
jne 0x4293d0
mov ecx, dword [ebp - 0x8fc]
lea edx, [ecx*2 + 0x4593f0]
mov dword [ebp - 0xd64], edx
jmp 0x429376
cmp dword [ebp - 0xd64], 0
je 0x4293f5
xor eax, eax
mov ecx, dword [ebp - 0xd64]
mov word [ecx], ax
mov edx, dword [ebp - 0xd64]
add edx, 2
mov dword [0x43ef58], edx
mov eax, dword [0x43ef58]
push eax
push 0x4397b0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42942f
mov dword [ebp - 0x914], 0x3df
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
lea ecx, [ebp - 0x8f8]
push ecx
push 0x4593f0
push 0x4397d0
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x498]
push ecx
call fcn.004010b0
add esp, 8
test eax, eax
jge 0x42948f
mov dword [ebp - 0x914], 0x3e0
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
lea edx, [ebp - 0x900]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
push fcn.0041d810
push 0
push 0
call fcn.00404587
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4295a0
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4593f0
push 0x4397dc
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.parserSearchThread_Call_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push 0x439840
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x498]
push eax
call fcn.00419550
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429647
cmp dword [ebp - 4], 0xc9
jne 0x4295e3
mov dword [ebp - 0x914], 0x3e9
jmp 0x42962c
cmp dword [ebp - 4], 0xca
jne 0x4295f8
mov dword [ebp - 0x914], 0x3ea
jmp 0x42962c
cmp dword [ebp - 4], 0xcb
jne 0x42960d
mov dword [ebp - 0x914], 0x3eb
jmp 0x42962c
cmp dword [ebp - 4], 0x96
jl 0x429622
mov dword [ebp - 0x914], 0x3ec
jmp 0x42962c
mov dword [ebp - 0x914], 0x3ed
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
push str.parserchk.txt
push 0x4593f0
push 0x43988c
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x910]
push edx
lea eax, [ebp - 0x498]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x4296cd
mov dword [0x458c8c], 1
push str.parsernot.txt
push 0x4593f0
push 0x4398b4
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x910]
push edx
lea eax, [ebp - 0x498]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x4296cd
mov dword [0x458c8c], 2
push 0x4593f0
push str._sHTTP_Parser.chm
push 0x459620
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xd74], 0
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xd6c], 0
mov dword [ebp - 0xd70], 0
push str.BINTYPE
push 0x12d
mov ecx, dword [0x458c60]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0xd74], 0
je 0x4297e4
push 0x460
push 0
lea edx, [ebp - 0x498]
push edx
call fcn.00402860
add esp, 0xc
cmp dword [ebp - 0xd74], 0
je 0x429778
mov eax, dword [ebp - 0xd74]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xd68], eax
cmp dword [ebp - 0xd74], 0
je 0x429798
mov edx, dword [ebp - 0xd74]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd68], 0
je 0x4297b4
mov ecx, dword [ebp - 0xd68]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xd70], eax
lea edx, [ebp - 0x498]
push edx
push str.logo.gif
mov eax, dword [ebp - 0xd6c]
push eax
mov ecx, dword [ebp - 0xd70]
push ecx
call fcn.00419480
lea edx, [ebp - 0x498]
push edx
call fcn.0040ed30
mov dword [0x458c64], eax
cmp dword [ebp - 0xd68], 0
je 0x4297fa
mov eax, dword [ebp - 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x4593f0
push str._s_themes_b_good.bmp
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x4593f0
push str._s_themes_b_bad.bmp
lea edx, [ebp - 0x8f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x4593f0
push str._s_themes_b_desktop.bmp
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x498]
push ecx
call fcn.0040ed30
mov dword [0x458c68], eax
lea edx, [ebp - 0x8f8]
push edx
call fcn.0040ed30
mov dword [0x458c6c], eax
lea eax, [ebp - 0xb18]
push eax
call fcn.0040ed30
mov dword [0x458c70], eax
mov dword [ebp - 0xd78], 0xa00000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x4583cc], eax
cmp dword [0x4583cc], 0xffffffff
jne 0x42999b
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
mov dword [0x4583cc], 0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4593f0
push 0x4399c8
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.Mail_Handle_Create_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push 0x439a08
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
push str.PARSER_SHARED_MAPMEMORY
mov edx, dword [ebp - 0xd78]
push edx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x4583d0], eax
cmp dword [0x4583d0], 0
jne 0x429aad
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4593f0
push 0x439a84
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x910]
push eax
push 0x439a90
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x439ac0
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xb1c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x498]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xb1c]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
mov ecx, dword [ebp - 0xd78]
push ecx
push 0
push 0
push 2
mov edx, dword [0x4583d0]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4583d8], eax
cmp dword [0x4583d8], 0
jne 0x429bbf
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4593f0
push 0x439b0c
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x910]
push eax
push str.Map_Handle_Create_Error
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x439b48
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xb1c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x498]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xb1c]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
jmp 0x42a31a
mov dword [ebp - 0xd80], 8
mov dword [ebp - 0xd7c], 0x3ff
lea ecx, [ebp - 0xd80]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [ebp - 0xb26]
call fcn.00401aa0
lea ecx, [ebp - 0xb25]
call fcn.00401aa0
push 0x100
push 0x458fc0
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x429c1f
push str.cmd.exe
push 0x458fc0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x4512b0
call fcn.00402860
add esp, 0xc
push 0x439bb4
push 0x4593f0
push 0x439bd0
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x498]
push ecx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x429c85
push 0x4512b0
push 0x5460
lea edx, [ebp - 0x498]
push edx
call fcn.004012f0
add esp, 0xc
push 0x43ef5c
push str.sysinfoview.xml
call fcn.0040ed70
mov dword [0x458c74], 1
lea eax, [ebp - 0x900]
push eax
push 0
push 0
push 0x41a260
push 0
push 0
call fcn.00404587
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429d97
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4593f0
push 0x439bdc
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.sessionSearchThread_Call_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
jmp 0x42a31a
call fcn.0040f590
push str._test.html
call fcn.0040edb0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x429fb6
mov dword [ebp - 0x8fc], 0
jmp 0x429dce
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x429e03
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x429e01
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x10], edx
jmp 0x429dbf
cmp dword [ebp - 0x10], 0
jne 0x429e10
mov dword [ebp - 0x10], 0x439c8c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x458c78], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x429e45
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
movzx eax, word [edx + 0x4508b0]
test eax, eax
je 0x429e8f
mov ecx, dword [ebp - 0x90c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
add eax, 0x4508b0
push eax
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x429e8d
mov ecx, dword [ebp - 0x8fc]
mov dword [0x458c78], ecx
jmp 0x429e8f
jmp 0x429e36
cmp dword [0x458c78], 0xffffffff
jne 0x429f22
mov dword [ebp - 0x10], str.msedge.exe
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x458c78], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x429ed8
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
movzx edx, word [ecx + 0x4508b0]
test edx, edx
je 0x429f22
mov eax, dword [ebp - 0x90c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
add edx, 0x4508b0
push edx
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x429f20
mov eax, dword [ebp - 0x8fc]
mov dword [0x458c78], eax
jmp 0x429f22
jmp 0x429ec9
cmp dword [0x458c78], 0xffffffff
jne 0x429fb6
mov dword [ebp - 0x10], str.iexplore.exe
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x458c78], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x429f6b
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
movzx ecx, word [eax + 0x4508b0]
test ecx, ecx
je 0x429fb6
mov edx, dword [ebp - 0x90c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
add ecx, 0x4508b0
push ecx
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x429fb4
mov edx, dword [ebp - 0x8fc]
mov dword [0x458c78], edx
jmp 0x429fb6
jmp 0x429f5c
push str.parsercommon.data
push 0x4593f0
push 0x439cfc
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x42a037
push 0x456710
push 0x310
lea eax, [ebp - 0x498]
push eax
call fcn.004012f0
add esp, 0xc
test eax, eax
jl 0x42a030
mov ecx, dword [0x456718]
mov dword [0x458c78], ecx
mov edx, dword [0x45671c]
mov dword [0x43ef30], edx
mov eax, dword [0x456714]
mov dword [0x458c7c], eax
jmp 0x42a037
mov byte [0x456710], 0
movzx ecx, byte [0x456710]
test ecx, ecx
jne 0x42a0b7
mov byte [0x456710], 9
mov byte [0x456711], 9
mov byte [0x456712], 3
mov byte [0x456713], 3
mov edx, dword [0x458c7c]
mov dword [0x456714], edx
mov eax, dword [0x458c78]
mov dword [0x456718], eax
mov ecx, dword [0x43ef30]
mov dword [0x45671c], ecx
mov byte [0x456720], 0
mov byte [0x456721], 0
mov byte [0x456722], 0
mov byte [0x456724], 0
push 0
push 0x456710
push 0x310
lea edx, [ebp - 0x498]
push edx
call fcn.00401400
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x459860], eax
cmp dword [0x459860], 0
je 0x42a137
mov dword [ebp - 0x1040], 0x99
jmp 0x42a0f0
mov eax, dword [ebp - 0x1040]
add eax, 1
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0xb5
jg 0x42a137
push 0
push 0x10
push 0x10
push 1
movzx ecx, word [ebp - 0x1040]
push ecx
mov edx, dword [0x458c60]
push edx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x103c]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x459860]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x42a0e1
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov edx, dword [0x458c60]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x45985c], eax
push 0x4000
push 0x2b4
lea eax, [ebp - 0x1038]
push eax
push 0
push 0x439d08
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x459854], eax
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x1038]
push ecx
push 0
push 0x439d10
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x459858], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x42a1da
push str.HtmlHelpW
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45986c], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x42a202
push str.ImmAssociateContext
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x459868], eax
mov dword [ebp - 0x1048], 8
mov dword [ebp - 0x1044], 0x3ff
lea ecx, [ebp - 0x1048]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x8d
mov edx, dword [0x458c60]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x4583b8], eax
push 0
push 0x425020
push 0
push 0x259
mov eax, dword [0x458c60]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x458c58], 0
mov dword [0x458c74], 0
push 2
call fcn.0041d810
push 0x4593f0
push str._slist.txt
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4583d4], 0
je 0x42a2d6
push 0x1388
mov edx, dword [0x4583d4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4583d4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00414a60
push str.sitelink.txt
push 0x4593f0
push str._s_s
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x4512b0
push 0x5460
lea edx, [ebp - 0x498]
push edx
call fcn.00401400
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x10
cmp dword [0x459864], 0
je 0x42a336
mov eax, dword [0x459864]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x45985c], 0
je 0x42a34c
mov ecx, dword [0x45985c]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x459860], 0
je 0x42a362
mov edx, dword [0x459860]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x4583d8], 0
je 0x42a377
mov eax, dword [0x4583d8]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x4583d0], 0
je 0x42a38d
mov ecx, dword [0x4583d0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4583cc], 0
je 0x42a3a3
mov edx, dword [0x4583cc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4583bc], 0
je 0x42a3b8
mov eax, dword [0x4583bc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x914]
mov dword [ebp - 0x1050], ecx
cmp dword [ebp - 0x1050], 0x3df
jg 0x42a3f2
cmp dword [ebp - 0x1050], 0x3df
je 0x42a49e
cmp dword [ebp - 0x1050], 0
je 0x42a490
jmp case.default.0x42a484
cmp dword [ebp - 0x1050], 0x3e9
jg 0x42a443
cmp dword [ebp - 0x1050], 0x3e9
je 0x42a5a0
cmp dword [ebp - 0x1050], 0x3e0
je 0x42a4d4
cmp dword [ebp - 0x1050], 0x3e1
je 0x42a50a
cmp dword [ebp - 0x1050], 0x3e2
je 0x42a563
jmp case.default.0x42a484
cmp dword [ebp - 0x1050], 0x270e
jg 0x42a48b
cmp dword [ebp - 0x1050], 0x270d
jge 0x42a727
mov edx, dword [ebp - 0x1050]
sub edx, 0x3ea
mov dword [ebp - 0x1050], edx
cmp dword [ebp - 0x1050], 3
ja case.default.0x42a484
mov eax, dword [ebp - 0x1050]
jmp dword [eax*4 + 0x42a7e0]
jmp case.default.0x42a484
xor ecx, ecx
mov word [ebp - 0x498], cx
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a4bd
push 0x439dc0
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42a4cf
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a4f3
push 0x439ec0
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42a505
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a537
mov eax, dword [ebp - 0x910]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x439fb8
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x42a557
mov eax, dword [ebp - 0x910]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.OS_state_is_unstable___d_:__d_
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xc], 0x30
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a582
push 0x43a080
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42a594
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0xc], 0x30
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a5cf
lea edx, [ebp - 0xb1e]
push edx
call fcn.0042ada0
push eax
push 0x43a160
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a5f1
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.0042ada0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a625
lea eax, [ebp - 0xb1e]
push eax
call fcn.0042ada0
push eax
push 0x43a360
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a647
lea edx, [ebp - 0xb1e]
push edx
call fcn.0042ada0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a67b
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.0042ada0
push eax
push 0x43a560
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a69d
lea eax, [ebp - 0xb1e]
push eax
call fcn.0042ada0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a6c8
mov edx, dword [ebp - 4]
push edx
push 0x43a760
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a6e1
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a70c
mov eax, dword [ebp - 4]
push eax
push 0x43a960
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a725
mov edx, dword [ebp - 4]
push edx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a77e
push 0
call fcn.0040fa10
test eax, eax
je 0x42a750
mov ecx, dword [ebp - 0x910]
push ecx
push 0x43ab60
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42a76c
mov eax, dword [ebp - 0x910]
push eax
push 0x43ab90
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0xc], 0x30
jmp 0x42a77e
xor edx, edx
mov word [ebp - 0x498], dx
movzx eax, word [ebp - 0x498]
test eax, eax
je 0x42a7a6
mov ecx, dword [ebp - 0xc]
push ecx
push str._notification_BOX
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x104c], eax
lea ecx, [ebp - 0xb1d]
call fcn.00401aa0
lea ecx, [ebp - 0xb1e]
call fcn.00401aa0
mov eax, dword [ebp - 0x104c]
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 0x10