Function at 0x41c2d0
Capabilities:
Accept command line arguments
Check mutex on windows
Enumerate gui resources
Get session user name
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc2c], eax
push 0x20a
lea eax, [ebp - 0x550]
mov dword [ebp - 0xc38], 0
push esi
push eax
xor edi, edi
mov dword [ebp - 0xc40], esi
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x344]
mov dword [ebp - 0xc48], 0x104
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0xc10], esi
mov dword [ebp - 0xc00], esi
mov dword [ebp - 0xbfc], 7
mov dword [ebp - 0xc44], esi
mov ecx, 1
mov edx, 0x449ffc
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41c3c6
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x41c3c6
push 0x40
xorps xmm0, xmm0
mov dword [0x449ff8], 0x44a010
push edi
movq qword [esi], xmm0
push 0x44a010
mov dword [esi], 0x43d7dc
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x449ff8]
add esp, 0xc
add eax, 0x10
push eax
push edi
push edi
push esi
push 1
push dword [section..data]
push edi
push 0x41bbd0
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov eax, dword [ebp - 0xc38]
cmp eax, 1
jle 0x41d07f
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
cmp eax, 2
jle 0x41c411
push str._Verbose
push dword [ebx + 8]
call esi
add esp, 8
mov dword [ebp - 0xc34], 1
test eax, eax
je 0x41c417
mov dword [ebp - 0xc34], edi
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xbf8], edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xbf8]
mov word [ebp - 0xbf4], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov edi, eax
mov dword [ebp - 0xc30], edi
test edi, edi
je 0x41c48c
lea eax, [ebp - 0xc30]
push eax
push dword [ebp - 0xc2c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0xc2c]
neg eax
sbb eax, eax
and dword [ebp - 0xc30], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edi, dword [ebp - 0xc30]
push 0x104
lea eax, [ebp - 0x344]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41c506
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
jle 0x41c4b9
movzx ecx, cx
or ecx, 0x80070000
mov edx, dword [0x449ff8]
test edx, edx
je 0x41c513
mov eax, dword [edx]
or eax, dword [edx + 4]
je 0x41c513
test byte [edx + 8], 1
je 0x41c513
cmp byte [edx + 0xf], 9
jb 0x41c513
push 0
push 4
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc2c], ecx
push eax
push 9
push str.wWinMain
push 0x18
push 0x43d7ec
push 0x2b
push dword [edx + 4]
push dword [edx]
call fcn.0041bd20
add esp, 0x28
jmp 0x41c513
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str._RegServer
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41d072
push str._UnregServer
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41d072
push str._regChrome
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41ccff
push str._regEdge
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41ccff
push str._regIE
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41ccff
push str._regall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41ccff
push str._unregChrome
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c995
push str._unregEdge
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c995
push str._unregIE
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c995
push str._unregall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c995
push str._Embedding
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c8c9
push str._Startup
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41c8c9
push str._terminate
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41c6ba
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41c656
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41c656
test byte [ecx + 8], 2
je 0x41c656
cmp byte [ecx + 0xf], 9
jb 0x41c656
push dword [ebx + 4]
push 0x43d7ec
push 0x29
push edx
push esi
call fcn.0041bf80
push 0
push 0x414e50
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x41d403
mov edx, dword [0x449ff8]
test edx, edx
je 0x41d409
mov eax, dword [edx]
or eax, dword [edx + 4]
je 0x41d409
test byte [edx + 8], 1
je 0x41d409
cmp byte [edx + 0xf], 9
jb 0x41d409
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x449ff8]
push 0x43d7ec
push 0x5d
push dword [eax + 4]
push dword [eax]
call fcn.0041c0e0
jmp 0x41d403
mov eax, dword [ebp - 0xc38]
cmp eax, 3
jne 0x41c72a
push str._launch
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41c724
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41c717
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41c717
test byte [ecx + 8], 2
je 0x41c717
cmp byte [ecx + 0xf], 9
jb 0x41c717
cmp dword [ebp - 0xc38], 2
jle 0x41c705
mov eax, dword [ebx + 8]
jmp 0x41c708
mov eax, dword [ebx + 4]
push eax
push 0x43d7ec
push 0x2a
push edx
push esi
call fcn.0041bf80
push dword [ebx + 8]
call fcn.004127d0
jmp 0x41d403
mov eax, dword [ebp - 0xc38]
cmp eax, 2
jne 0x41c791
push 0x43eac8
push dword [ebx + 4]
call sub.VCRUNTIME140.dll_wcsstr
add esp, 8
test eax, eax
je 0x41c791
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41c784
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41c784
test byte [ecx + 8], 2
je 0x41c784
cmp byte [ecx + 0xf], 9
jb 0x41c784
cmp dword [ebp - 0xc38], 2
jle 0x41c772
mov eax, dword [ebx + 8]
jmp 0x41c775
mov eax, dword [ebx + 4]
push eax
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bf80
push dword [ebx + 4]
call fcn.004127d0
jmp 0x41d403
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41c848
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
mov dword [ebp - 0xc34], edx
je 0x41c848
test byte [ecx + 8], 1
je 0x41c848
cmp byte [ecx + 0xf], 9
jb 0x41c848
mov edx, dword [ebx + 4]
test edx, edx
je 0x41c81b
movzx esi, word [edx]
test si, si
je 0x41c809
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xc2c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c7e2
sub ecx, dword [ebp - 0xc2c]
mov eax, str._NULL_
sar ecx, 1
test si, si
cmovne eax, edx
lea ecx, [ecx*2 + 2]
jmp 0x41c825
test si, si
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, edx
jmp 0x41c825
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 9
push str.wWinMain
push 0x2c
push 0x43d7ec
push 0x2b
push dword [ebp - 0xc34]
push edi
call fcn.0041bd20
add esp, 0x28
movups xmm0, xmmword [str.Invalid_option_specified.]
mov eax, dword [0x43eb00]
lea edi, [ebp - 0xbf0]
mov dword [ebp - 8], eax
mov ecx, 0x1a8
movups xmmword [ebp - 0x38], xmm0
mov esi, str._nUSAGE:_redirector.exe___regIE___regFF___regChrome___regAll___unregIE___unregFF___unregChrome___unregAll___Verbose___t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_regIE________t_Registers_Internet_Explorer_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_regChrome____t_Registers_Chrome_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_regEdge____t_Registers_Chromium_Edge_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_regAll_______t_Registers_all_browsers_Internet_Explorer__Chrome__Chromium_Edge__BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_unregIE______t_Unregisters_Internet_Explorer_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_unregChrome__t_Unregisters_Chrome_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_unregEdge__t_Unregisters_Chromium_Edge_BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_unregAll_____t_Unregisters_all_browsers_Internet_Explorer__Chrome__Chromium_Edge__BHO._t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_Verbose___________t_Verbose_mode._Message_window_will_show_up.__t_t_t_t_t_t_t_t_t_t_t_t_t_n____t_Parameters_inside____are_valid_only_as_a_second_paramter
lea eax, [ebp - 0x38]
movups xmm0, xmmword [0x43eae0]
push eax
rep movsd dword es:[edi], dword [esi]
movups xmmword [ebp - 0x28], xmm0
lea ecx, [ebp - 0xc10]
movups xmm0, xmmword [0x43eaf0]
movups xmmword [ebp - 0x18], xmm0
call fcn.0040c960
lea eax, [ebp - 0xbf0]
push eax
lea ecx, [ebp - 0xc10]
call fcn.0040c960
cmp dword [ebp - 0xbfc], 8
lea eax, [ebp - 0xc10]
cmovae eax, dword [ebp - 0xc10]
push eax
call fcn.00413420
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x41d403
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41c8fb
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41c8fb
test byte [ecx + 8], 2
je 0x41c8fb
cmp byte [ecx + 0xf], 9
jb 0x41c8fb
push dword [ebx + 4]
push 0x43d7ec
push 0x27
push edx
push edi
call fcn.0041bf80
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41c97a
lea eax, [ebp - 0x550]
push str.SYSTEM
push eax
call esi
add esp, 8
test eax, eax
jne 0x41c97a
mov edx, dword [0x449ff8]
test edx, edx
je 0x41d409
mov esi, dword [edx]
mov eax, esi
mov ecx, dword [edx + 4]
or eax, ecx
je 0x41d409
test byte [edx + 8], 2
je 0x41d409
cmp byte [edx + 0xf], 9
jb 0x41d409
push 0
push 9
push str.wWinMain
push 0x28
push 0x43d7ec
push 0x2b
push ecx
push esi
call fcn.0041bd20
add esp, 0x20
jmp 0x41d403
call fcn.00403e80
mov ecx, eax
call fcn.00403230
call fcn.0040ed00
call fcn.00403f70
jmp 0x41d3fe
test edi, edi
jne 0x41c9fa
push str._nYou_must_be_logged_on_as_an_administrator_to_perform_this_operation.
lea ecx, [ebp - 0xc10]
call fcn.0040c960
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cced
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cced
test byte [ecx + 8], 1
je 0x41cced
cmp byte [ecx + 0xf], 9
jb 0x41cced
push edi
push 9
push str.wWinMain
push 0x20
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
jmp 0x41cced
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41ca37
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41ca37
test byte [ecx + 8], 1
je 0x41ca37
cmp byte [ecx + 0xf], 9
jb 0x41ca37
push 0
push 9
push str.wWinMain
push 0x21
push 0x43d7ec
push 0x2b
push edx
push edi
call fcn.0041bd20
add esp, 0x20
push 0
call fcn.00410420
test eax, eax
jne 0x41ca7f
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41ca7f
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41ca7f
test byte [ecx + 8], 1
je 0x41ca7f
cmp byte [ecx + 0xf], 9
jb 0x41ca7f
push 0
push 9
push str.wWinMain
push 0x22
push 0x43d7ec
push 0x2b
push edx
push edi
call fcn.0041bd20
add esp, 0x20
push str._unregChrome
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41caa1
push str._unregall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41cb15
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0xc28]
call fcn.00402fa0
lea eax, [ebp - 0xc10]
push eax
push 0x449060
push 0x449048
lea eax, [ebp - 0xc28]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call fcn.00414f90
mov edx, dword [ebp - 0xc14]
cmp edx, 8
jb 0x41cb15
mov ecx, dword [ebp - 0xc28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cb0b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d49f
push edx
push ecx
call fcn.00435eb6
add esp, 8
push str._unregEdge
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41cb37
push str._unregall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41cbab
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0xc28]
call fcn.00402fa0
lea eax, [ebp - 0xc10]
push eax
push 0x449090
push 0x449078
lea eax, [ebp - 0xc28]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call fcn.00414f90
mov edx, dword [ebp - 0xc14]
cmp edx, 8
jb 0x41cbab
mov ecx, dword [ebp - 0xc28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cba1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d49f
push edx
push ecx
call fcn.00435eb6
add esp, 8
push str._unregIE
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41cbd1
push str._unregall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41cced
call fcn.004075e0
test eax, eax
jne 0x41cc2c
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cc17
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cc17
test byte [ecx + 8], 1
je 0x41cc17
cmp byte [ecx + 0xf], 9
jb 0x41cc17
push 0
push 9
push str.wWinMain
push 0x23
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push str._nFailed_unregistering_Internet_Explorer_BHO
lea ecx, [ebp - 0xc10]
call fcn.0040c960
jmp 0x41cced
push str._nInternet_Explorer_BHO_unregistration_successful
lea ecx, [ebp - 0xc10]
call fcn.0040c960
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cc79
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cc79
test byte [ecx + 8], 2
je 0x41cc79
cmp byte [ecx + 0xf], 9
jb 0x41cc79
push 0
push 9
push str.wWinMain
push 0x24
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push 0
lea eax, [ebp - 0xc44]
push eax
push str.IsBrowserAddConfigured
call fcn.00428e10
test eax, eax
jne 0x41ccb7
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cced
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cced
test byte [ecx + 8], 2
je 0x41cced
cmp byte [ecx + 0xf], 9
jb 0x41cced
push 0
push 0x25
jmp 0x41ccdc
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cced
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cced
test byte [ecx + 8], 1
je 0x41cced
cmp byte [ecx + 0xf], 9
jb 0x41cced
push 0
push 0x26
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x18
cmp dword [ebp - 0xc34], 0
je 0x41c8be
jmp 0x41c8a4
test edi, edi
jne 0x41cd53
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cd3f
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cd3f
test byte [ecx + 8], 1
je 0x41cd3f
cmp byte [ecx + 0xf], 9
jb 0x41cd3f
push edi
push 9
push str.wWinMain
push 0x19
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push 0x45
push str._nYou_must_be_logged_on_as_an_administrator_to_perform_this_operation.
lea ecx, [ebp - 0xc10]
call fcn.00405d10
jmp 0x41cced
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cd90
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cd90
test byte [ecx + 8], 1
je 0x41cd90
cmp byte [ecx + 0xf], 9
jb 0x41cd90
push 0
push 9
push str.wWinMain
push 0x1a
push 0x43d7ec
push 0x2b
push edx
push edi
call fcn.0041bd20
add esp, 0x20
push 1
call fcn.00410420
test eax, eax
jne 0x41cdd8
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cdd8
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cdd8
test byte [ecx + 8], 1
je 0x41cdd8
cmp byte [ecx + 0xf], 9
jb 0x41cdd8
push 0
push 9
push str.wWinMain
push 0x1b
push 0x43d7ec
push 0x2b
push edx
push edi
call fcn.0041bd20
add esp, 0x20
push str._regChrome
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41cdfa
push str._regall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41ce70
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0xc28]
call fcn.00402fa0
lea eax, [ebp - 0xc10]
push eax
push 0x449060
push 0x449048
lea eax, [ebp - 0xc28]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call fcn.00413b00
mov edx, dword [ebp - 0xc14]
cmp edx, 8
jb 0x41ce70
mov ecx, dword [ebp - 0xc28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ce66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41ce66
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
push str._regEdge
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41ce92
push str._regall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41cf08
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0xc28]
call fcn.00402fa0
lea eax, [ebp - 0xc10]
push eax
push 0x449090
push 0x449078
lea eax, [ebp - 0xc28]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call fcn.00413b00
mov edx, dword [ebp - 0xc14]
cmp edx, 8
jb 0x41cf08
mov ecx, dword [ebp - 0xc28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cefe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41cefe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
push str._regIE
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
je 0x41cf2e
push str._regall
push dword [ebx + 4]
call esi
add esp, 8
test eax, eax
jne 0x41cced
lea eax, [ebp - 0x344]
push eax
call fcn.00407510
test eax, eax
jns 0x41cf90
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cf7b
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cf7b
test byte [ecx + 8], 1
je 0x41cf7b
cmp byte [ecx + 0xf], 9
jb 0x41cf7b
push 0
push 9
push str.wWinMain
push 0x1c
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push str._nFailed_registering_Internet_Explorer_BHO
lea ecx, [ebp - 0xc10]
call fcn.0040c960
jmp 0x41cced
push str._nInternet_Explorer_BHO_registration_successful
lea ecx, [ebp - 0xc10]
call fcn.0040c960
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cfdd
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cfdd
test byte [ecx + 8], 2
je 0x41cfdd
cmp byte [ecx + 0xf], 9
jb 0x41cfdd
push 0
push 9
push str.wWinMain
push 0x1d
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push 0
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 1
push eax
push str.IsBrowserAddConfigured
call fcn.00428e10
test eax, eax
jne 0x41d038
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cced
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cced
test byte [ecx + 8], 2
je 0x41cced
cmp byte [ecx + 0xf], 9
jb 0x41cced
push 0
push 0x1e
jmp 0x41ccdc
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41cced
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41cced
test byte [ecx + 8], 1
je 0x41cced
cmp byte [ecx + 0xf], 9
jb 0x41cced
push 0
push 0x1f
jmp 0x41ccdc
push dword [ebx + 4]
call fcn.004069d0
jmp 0x41d403
jne 0x41d403
mov dword [ebp - 0xc30], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea eax, [ebp - 0x13c]
push 0x104
push 0
push eax
mov dword [ebp - 0xc34], esi
call sub.VCRUNTIME140.dll_memset
push esi
push str.CtxRdrAsRSTaskManager__u
lea eax, [ebp - 0x13c]
push 0x104
push eax
call fcn.0041c240
add esp, 0x1c
lea eax, [ebp - 0x13c]
push eax
call sub.CCMSDK.dll_CCMInitialize
mov esi, eax
test esi, esi
je 0x41d146
mov edx, dword [0x449ff8]
test edx, edx
je 0x41d3fa
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ebp - 0xc3c], eax
or eax, ecx
je 0x41d390
test byte [edx + 8], 1
je 0x41d390
cmp byte [edx + 0xf], 9
jb 0x41d390
push 0
push 4
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc2c], esi
push eax
push 9
push str.wWinMain
push 0x2d
push 0x43d7ec
push 0x2b
push ecx
push dword [ebp - 0xc3c]
call fcn.0041bd20
add esp, 0x28
jmp 0x41d38a
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41d1a0
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x41d1a0
test byte [ecx + 8], 2
je 0x41d1a0
cmp byte [ecx + 0xf], 9
jb 0x41d1a0
lea ecx, [ebp - 0x13c]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d170
push 0
sub ecx, edi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x13c]
push eax
push 9
push str.wWinMain
push 0x2e
push 0x43d7ec
push 0x2b
push esi
push edx
call fcn.0041bd20
add esp, 0x28
lea eax, [ebp - 0xc30]
push eax
push dword [ebp - 0xc34]
call sub.CCMSDK.dll_CCMGetSessionForRSApplicationPid
mov esi, eax
mov edi, 1
test esi, esi
jne 0x41d38a
mov edi, dword [ebp - 0xc30]
cmp edi, 0xffffffff
je 0x41d385
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41d230
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41d230
test byte [ecx + 8], 2
je 0x41d230
cmp byte [ecx + 0xf], 9
jb 0x41d230
mov eax, dword [ebp - 0xc34]
push 0
push 4
mov dword [ebp - 0xc3c], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
lea eax, [ebp - 0xc40]
mov dword [ebp - 0xc40], edi
push eax
push 0x2f
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
mov edi, dword [ebp - 0xc30]
add esp, 0x28
push 0x104
lea eax, [ebp - 0x654]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
push str.SZ_RD_MUTEX_NAME__u
lea eax, [ebp - 0x654]
push 0x104
push eax
call fcn.0041c240
add esp, 0x1c
lea eax, [ebp - 0x654]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xc40], esi
call edi
cmp eax, 5
je 0x41d3fe
cmp eax, 0xb7
jne 0x41d333
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41d2cf
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41d2cf
test byte [ecx + 8], 1
je 0x41d2cf
cmp byte [ecx + 0xf], 9
jb 0x41d2cf
push 0
push 9
push str.wWinMain
push 0x30
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push dword [ebp - 0xc30]
push 0x40d910
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x41d3fe
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41d3fe
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x41d3fe
test byte [ecx + 8], 1
je 0x41d3fe
cmp byte [ecx + 0xf], 9
jb 0x41d3fe
call edi
push eax
mov eax, dword [0x449ff8]
push 0x43d7ec
push 0xc
push dword [eax + 4]
push dword [eax]
call fcn.0041c0e0
jmp 0x41d3fe
test esi, esi
je 0x41d3fe
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x41d378
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x41d378
test byte [ecx + 8], 1
je 0x41d378
cmp byte [ecx + 0xf], 9
jb 0x41d378
push 0
push 9
push str.wWinMain
push 0x31
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
push dword [ebp - 0xc2c]
call fcn.00422fd0
jmp 0x41d3fe
mov edi, 1
mov edx, dword [0x449ff8]
test edx, edx
je 0x41d3fa
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ebp - 0xbf8], eax
or eax, ecx
je 0x41d3fa
test byte [edx + 8], 1
je 0x41d3fa
cmp byte [edx + 0xf], 9
jb 0x41d3fa
mov eax, dword [ebp - 0xc34]
push 0
push 4
mov dword [ebp - 0xc3c], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc2c], esi
push eax
push 9
push str.wWinMain
push 0x32
push 0x43d7ec
push 0x2b
push ecx
push dword [ebp - 0xbf8]
call fcn.0041bd20
mov edx, dword [0x449ff8]
add esp, 0x30
test edi, edi
je 0x41d409
call sub.CCMSDK.dll_CCMUninitialize
mov edx, dword [0x449ff8]
test ebx, ebx
je 0x41d41a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [0x449ff8]
mov eax, dword [0x44a050]
test eax, eax
je 0x41d430
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x449ff8]
mov ebx, dword [ebp - 0xc40]
test ebx, ebx
je 0x41d44e
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x449ff8]
pop edi
pop esi
pop ebx
test edx, edx
je 0x41d46d
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x10]
push eax
push ecx
mov dword [0x449ff8], 0
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov edx, dword [ebp - 0xbfc]
cmp edx, 8
jb 0x41d4af
mov ecx, dword [ebp - 0xc10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d4a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41d4a5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x10