Function at 0x42a2b0
Capabilities:
Create directory
Create process on windows
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x10b8]
mov eax, 0x10b8
call fcn.0044ab60
push 0xffffffffffffffff
push 0x46985e
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x48fac0]
xor eax, ebp
mov dword [ebp + 0x10b4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
call fcn.00420c60
push str.log_
lea eax, [ebp - 0x14]
push 0x4910b8
push eax
call fcn.0040bb70
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0xc
xor edi, edi
push edi
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a33e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.alcdb_
lea ecx, [ebp - 0x14]
push 0x4910b8
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push edi
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a379
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.temp_
lea ecx, [ebp - 0x14]
push 0x4910b0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push edi
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a3b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.engine_
lea ecx, [ebp - 0x14]
push 0x4910b0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push edi
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a3ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.engine_
lea ecx, [ebp - 0x14]
push 0x4910b0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00432340
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a437
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.auhome_
lea ecx, [ebp - 0x74]
push 0x4910c0
push ecx
call fcn.0040bb70
push str.auhome_
lea edx, [ebp - 0x70]
push 0x4910b0
push edx
mov dword [ebp - 4], 1
call fcn.0040bb70
push str.TMAS_common_
lea eax, [ebp - 0x3c]
push 0x4910b4
push eax
mov byte [ebp - 4], 2
call fcn.0040bb70
mov ecx, dword [ebp - 0x3c]
push edi
push ecx
mov byte [ebp - 4], 3
call fcn.0044a108
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x42a4b8
mov edx, dword [ebp - 0x3c]
push edi
push edx
call esi
test eax, eax
je 0x42a4a7
mov eax, dword [ebp - 0x3c]
push eax
push str.____Create_Folder___s_
jmp 0x42a4b0
mov ecx, dword [ebp - 0x3c]
push ecx
push str.xxx_Can_not_create_Folder___s_
call fcn.00409e70
add esp, 8
push 0x800
lea edx, [ebp + 0x8b2]
push edi
push edx
mov word [ebp + 0x8b0], di
call fcn.004481f0
push str.TMAS_OL.ini
lea eax, [ebp - 0x14]
push 0x4910c0
push eax
call fcn.0040bb70
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x18
push eax
push edi
push str.Debug
push 0x472128
call ebx
cmp eax, 1
mov eax, dword [ebp - 0x14]
sete byte [ebp - 0x35]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a523
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x35], 0
je 0x42a6e0
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
push str.TMAntispam.log
push 0x477d30
push 0x472128
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.log_
lea eax, [ebp - 0x20]
push 0x4910b8
push eax
call fcn.0040bb70
lea ecx, [ebp + 0x8b0]
push ecx
push eax
lea edx, [ebp - 0x14]
mov bl, 4
push edx
mov byte [ebp - 4], bl
call fcn.0040bb70
add esp, 0x18
mov esi, dword [ebp - 0x28]
add esi, 0x98
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.004037f0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a5b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a5db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
push eax
call fcn.00409210
add esp, 4
call fcn.00417bc0
test eax, eax
jne 0x42a6ad
push str.TMAntispam.log
lea ecx, [ebp - 0x34]
call fcn.00406140
mov edi, eax
push str.log_
lea ecx, [ebp - 0x20]
push 0x4910b8
push ecx
mov byte [ebp - 4], 6
call fcn.0040bb70
push edi
push eax
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 7
call fcn.00403920
add esp, 0x18
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.004037f0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a65a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a67d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a6a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esi]
push esi
call fcn.00409210
add esp, 4
xor edi, edi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x9c], 1
mov edx, dword [0x4910bc]
push edx
push edi
push str.HiddenFunc
push 0x472128
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
sbb eax, eax
neg eax
mov dword [0x491078], eax
push str._Outlook_Shadow_Starts_
call fcn.00409e70
mov eax, dword [0x4910b0]
push eax
push str.____User_Root:__s
call fcn.00409e70
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x18], esp
push 7
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.TMAS_OL
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042eb20
test al, al
jne 0x42a746
push str.Error:_MUI_string_loader_initialize_failed_
push str.COLShadow::PostPrepareSysInfo
push 0x1aa
push str...win32OLShadow.cpp
call fcn.0040e560
add esp, 0x10
mov ecx, dword [str.X_TrendMicro_AntispamAddin_Checked]
mov esi, dword [ebp - 0x28]
push 3
push 0x491108
push ecx
add esi, 0x54
push esi
mov byte [ebp - 4], 9
call fcn.00432d50
mov edx, dword [str.X_TrendMicro_AntispamAddin_QuarantineTime]
add esp, 0x10
push 3
push 0x49110c
push edx
push esi
call fcn.00432d50
mov eax, dword [str.X_TrendMicro_Header]
add esp, 0x10
push 0x1f
push 0x491104
push eax
push esi
call fcn.00432d50
mov ecx, dword [str.x_has_been_reported_spam]
add esp, 0x10
push 3
push 0x491110
push ecx
push esi
call fcn.00432d50
mov edx, dword [str.x_has_been_reported_fp]
add esp, 0x10
push 3
push 0x491114
push edx
push esi
call fcn.00432d50
mov eax, dword [str.x_has_been_detected_spam]
add esp, 0x10
push 3
push 0x491118
push eax
push esi
call fcn.00432d50
mov ecx, dword [str.x_has_been_detected_normal]
add esp, 0x10
push 3
push 0x49111c
push ecx
push esi
call fcn.00432d50
add esp, 0x10
mov dword [ebp - 4], 3
mov dword [ebp - 0x4c], edi
mov esi, dword [esi]
mov edx, dword [esi]
mov ecx, dword [edx + 0x34]
lea eax, [ebp - 0x4c]
push eax
push esi
mov byte [ebp - 4], 0xb
call ecx
cmp eax, edi
jl 0x42a854
call dword [0x490f8c]
mov esi, dword [ebp - 0x4c]
cmp esi, edi
jne 0x42a820
xor eax, eax
jmp 0x42a834
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42a825
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, 0x491170
call fcn.00402d50
mov edx, dword [0x491170]
push edx
push str.____Outlook_ver:__s
call fcn.00409e70
add esp, 8
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00429a90
mov eax, dword [0x4910bc]
push eax
push 1
push str.EnableTMASE
push str.Antispam
call ebx
mov edx, dword [0x4910bc]
push edx
push 2
test eax, eax
push str.EnableTmufe
setne cl
push str.Tmufe
mov byte [0x491219], cl
call ebx
cmp eax, 2
jne 0x42a93a
push str.TMAS_OL.ini
lea eax, [ebp - 0x14]
push 0x4910c0
push eax
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push edi
push str.EnableTmufe
push str.Tmufe
call ebx
test eax, eax
mov eax, dword [ebp - 0x14]
setne cl
add eax, 0xfffffff0
mov byte [0x491218], cl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a8ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OL.ini
lea ecx, [ebp - 0x14]
push 0x4910c0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 2
push str.SecurityLevel
push str.Tmufe
call ebx
mov dword [0x49121c], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a95f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42a95f
mov edx, dword [0x4910bc]
push edx
push 2
cmp eax, edi
push str.SecurityLevel
setne cl
push str.Tmufe
mov byte [0x491218], cl
call ebx
mov dword [0x49121c], eax
mov eax, dword [0x4910bc]
push eax
push edi
push str.ProcessedMsg
push str.Statistics
call ebx
mov ecx, dword [0x4910bc]
push ecx
push edi
push str.DetectedSpam
push str.Statistics
mov dword [0x491240], eax
call ebx
mov edx, dword [0x4910bc]
push edx
push edi
push str.ReportedSpam
push str.Statistics
mov dword [0x491244], eax
call ebx
mov dword [0x491248], eax
mov eax, dword [0x4910bc]
push eax
push edi
push 0x472084
push str.Statistics
call ebx
mov ecx, dword [0x4910bc]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
push str.spam:
push str.TisTag
push 0x472128
mov dword [0x49124c], eax
call esi
lea eax, [ebp + 0x8b0]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x42a9f4
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp + 0x8b0]
push eax
mov ecx, 0x491174
call fcn.00402d50
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x22
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
mov ecx, 0x4912d8
call fcn.0042dc60
push eax
push str.PhishPrefix
push 0x472128
call esi
lea eax, [ebp + 0x8b0]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x42aa74
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp + 0x8b0]
push eax
mov ecx, 0x491178
call fcn.00402d50
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [0x4910bc]
mov edx, dword [ebp]
push eax
push 5
push str.WTCRetry
push str.Statistics
mov dword [0x49125c], edx
call ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [0x491260], eax
push 0x22
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_INI_DEF_SPAMADDRESS
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
mov ecx, 0x4912d8
call fcn.0042dc60
push eax
push str.Address
push str.ReportSpam
call esi
lea eax, [ebp + 0x8b0]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406140
mov ecx, 0x4912d8
mov byte [ebp - 4], 0xc
call fcn.0042dc60
push eax
push 0x3b
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
push 0x491264
call fcn.0041b0e0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ab6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x20
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_INI_DEF_FPADDRESS
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
mov ecx, 0x4912d8
call fcn.0042dc60
push eax
push str.Address
push str.ReportFP
call esi
lea eax, [ebp + 0x8b0]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406140
mov ecx, 0x4912d8
mov byte [ebp - 4], 0xd
call fcn.0042dc60
push eax
push 0x3b
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
push 0x491280
call fcn.0041b0e0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ac15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x23
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_INI_DEF_PHISHADDRESS
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
mov ecx, 0x4912d8
call fcn.0042dc60
push eax
push str.Address
push str.ReportPhish
call esi
lea eax, [ebp + 0x8b0]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406140
mov ecx, 0x4912d8
mov byte [ebp - 4], 0xe
call fcn.0042dc60
push eax
push 0x3b
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
push 0x49129c
call fcn.0041b0e0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42acbf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4910bc]
push ecx
push 0x400
lea edx, [ebp + 0x8b0]
push edx
push 0x46d9f4
push str.TMASELog
push str.Antispam
call esi
lea eax, [ebp + 0x8b0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42acf0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x8b0]
push eax
mov ecx, 0x49117c
call fcn.00402d50
mov ecx, dword [0x49117c]
cmp dword [ecx - 0xc], edi
je 0x42ad66
lea edx, [ebp + 0x8b0]
push edx
lea eax, [ebp - 0x14]
push 0x4910b0
push eax
call fcn.0040bb70
add esp, 0xc
push eax
mov ecx, 0x49117c
mov byte [ebp - 4], 0xf
call fcn.004037f0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ad66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4910bc]
push ecx
push 3
push str.MonitorInterval
push 0x472128
call ebx
mov edx, dword [0x4910bc]
push edx
push 0x3e8
push str.TrainCriteria
push str.Antispam
mov dword [0x4912c0], eax
mov byte [0x491220], 0
mov byte [0x491234], 0
call ebx
mov dword [0x491238], eax
mov eax, dword [0x4910bc]
push eax
push edi
push str.NotifyIcon
push 0x472128
call ebx
push 0x800
test eax, eax
lea edx, [ebp + 0xae]
setne cl
push edi
push edx
mov byte [0x49123c], cl
mov word [ebp + 0xac], di
call fcn.004481f0
mov eax, dword [0x4910bc]
add esp, 0xc
push eax
push 0x400
lea ecx, [ebp + 0xac]
push ecx
push 0x476b60
push str.NotifyIcon
push 0x472128
call esi
lea edx, [ebp + 0xac]
push edx
lea ecx, [ebp - 0x20]
call fcn.00406140
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x10
call fcn.0041a9f0
mov ecx, eax
call fcn.00419dc0
lea eax, [ebp - 0x20]
push 0x476b60
push eax
call fcn.004183f0
add esp, 8
test al, al
mov eax, dword [ebp - 0x20]
setne cl
add eax, 0xfffffff0
mov byte [0x49123c], cl
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ae69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4910bc]
push ecx
push edi
push str.RunningSince
push str.Statistics
call ebx
test eax, eax
jne 0x42bb09
mov ecx, dword [ebp - 0x28]
call fcn.0041a780
lea ecx, [ebp - 0x84]
call fcn.0040aa40
push str.BlockEncodings.dat
lea edx, [ebp - 0x14]
push 0x4910b8
push edx
mov byte [ebp - 4], 0x11
call fcn.0040bb70
add esp, 0xc
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x12
call fcn.0040ac00
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42aee7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x84]
call fcn.00408760
push str.BlockEncodings.dat
lea ecx, [ebp - 0x14]
push 0x4910b0
push ecx
call fcn.0040bb70
add esp, 0xc
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x13
call fcn.0040a370
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42af3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OL.ini
lea ecx, [ebp - 0x14]
push 0x4910c0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push eax
push edi
push str.DefaultSender
push 0x472128
call esi
cmp eax, 1
mov eax, dword [ebp - 0x14]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42af8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42b5ee
mov ecx, dword [0x4910bc]
push ecx
push edi
push str.DefaultSender
push 0x472128
call esi
test eax, eax
jne 0x42b5ee
call fcn.00437eea
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x42afcc
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
push str.WhiteList.dat
lea ecx, [ebp - 0x14]
push 0x4910b8
push ecx
mov byte [ebp - 4], 0x14
call fcn.0040bb70
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.004037f0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b025
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x6c]
call fcn.0044363e
mov ecx, dword [ebp - 0x20]
push edi
push 0x5011
push ecx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x16
call fcn.00443654
test eax, eax
lea ecx, [ebp - 0x6c]
jne 0x42b0b1
mov byte [ebp - 4], 0x14
call fcn.00443a42
lea ecx, [ebp - 0x20]
call fcn.00408280
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xb
call fcn.0040a330
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x3c]
call fcn.00408280
lea ecx, [ebp - 0x70]
call fcn.00408280
lea ecx, [ebp - 0x74]
call fcn.00408280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10b4]
xor ecx, ebp
call fcn.00448e02
add ebp, 0x10b8
mov esp, ebp
pop ebp
ret
push str.__Written_by_TMAS_v3.5__c__2005_TrendMicro_n
call fcn.0044382e
push str.TMAS_OL.ini
lea eax, [ebp - 0x14]
push 0x4910c0
push eax
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea ecx, [ebp + 0x8b0]
push ecx
push 0x46d9f4
push str.ApproveMailList
push 0x472128
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x14]
call fcn.00408280
lea edx, [ebp + 0x8b0]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00406140
lea ecx, [ebp - 0x34]
call fcn.00402640
lea ecx, [ebp - 0x30]
call fcn.00402640
lea ecx, [ebp - 0x24]
call fcn.00402640
lea ecx, [ebp - 0x14]
call fcn.00402640
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
cmp eax, edi
mov bl, 0x1b
mov byte [ebp - 4], bl
je 0x42b2dc
test eax, eax
jle 0x42b15e
push 0x3b
push ecx
call fcn.004486ad
add esp, 8
test eax, eax
je 0x42b15e
sub eax, dword [ebp - 0x1c]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x42b17e
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004037f0
push 0
push 0x46d9f4
lea ecx, [ebp - 0x1c]
call fcn.00402d50
jmp 0x42b201
push esi
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004088d0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1c
call fcn.004037f0
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b1ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
sub eax, esi
sub eax, 1
push eax
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0040ba70
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.004037f0
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b201
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x24]
cmp dword [edi - 0xc], 0
jle 0x42b574
push 0x2c
push edi
call fcn.004486ad
add esp, 8
test eax, eax
je 0x42b574
sub eax, edi
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x42b574
push esi
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004088d0
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1e
call fcn.004037f0
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b26c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi - 0xc]
sub eax, esi
sub eax, 1
push eax
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040ba70
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1f
call fcn.004037f0
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b2b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0040b2d0
add esp, 4
test al, al
je 0x42b574
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x42b141
mov al, 1
test al, al
je 0x42b574
lea edx, [ebp + 0x8b0]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00404b20
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x42b588
jle 0x42b316
push 0x3b
push ecx
call fcn.004486ad
add esp, 8
test eax, eax
je 0x42b316
sub eax, dword [ebp - 0x1c]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x42b334
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004037f0
push 0x46d9f4
lea ecx, [ebp - 0x1c]
call fcn.00404b20
jmp 0x42b3b7
push esi
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004088d0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x20
call fcn.004037f0
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b370
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
sub eax, esi
sub eax, 1
push eax
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0040ba70
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x21
call fcn.004037f0
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b3b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x24]
cmp dword [edi - 0xc], 0
jle 0x42b588
push 0x2c
push edi
call fcn.004486ad
add esp, 8
test eax, eax
je 0x42b588
sub eax, edi
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x42b588
push esi
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004088d0
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x22
call fcn.004037f0
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b422
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi - 0xc]
sub eax, esi
sub eax, 1
push eax
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040ba70
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x23
call fcn.004037f0
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b466
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x18]
push str._WL_REC__SN_ATTR_
push edx
call fcn.0040bc50
push str._SN_ATTR__SA_ATTR_
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x24
call fcn.0040bb70
lea ecx, [ebp - 0x30]
push ecx
push eax
lea edx, [ebp - 0x54]
push edx
mov byte [ebp - 4], 0x25
call fcn.00403920
push str._SA_ATTR__WL_REC_
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0x26
call fcn.0040bb70
add esp, 0x30
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x27
call fcn.004037f0
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x26
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b4e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x25
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b506
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x24
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b529
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b54b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.0044382e
push 0x46db54
lea ecx, [ebp - 0x6c]
call fcn.0044382e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x42b2f9
jmp 0x42b588
mov ecx, dword [ebp - 0x28]
push 0
push str.Hint
push str.Mail_List_Format_is_not_correct_
call fcn.0043b6e6
lea ecx, [ebp - 0x6c]
call fcn.00443a06
mov edx, dword [0x4910bc]
push edx
push 0x476b80
push str.DefaultSender
push 0x472128
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x14]
call fcn.00408280
lea ecx, [ebp - 0x24]
call fcn.00408280
lea ecx, [ebp - 0x30]
call fcn.00408280
lea ecx, [ebp - 0x34]
call fcn.00408280
lea ecx, [ebp - 0x1c]
call fcn.00408280
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x14
call fcn.00443a42
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.00408280
xor edi, edi
call fcn.00437eea
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x42b608
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0x28
call fcn.00437eea
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x42b635
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x34], eax
push str.TMAS_OL.ini
lea ecx, [ebp - 0x18]
push 0x4910c0
push ecx
mov byte [ebp - 4], 0x29
call fcn.0040bb70
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push eax
push 0x400
lea edx, [ebp + 0xac]
push edx
push 0x46d9f4
push str.ImportAddressCaption
push 0x472128
call esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b6a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp + 0xac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42b6b0
sub eax, edx
sar eax, 1
jne 0x42b71d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.IDS_CAPTION_CONFIRMATION
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x2a
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x29
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b72c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42b72c
lea ecx, [ebp + 0xac]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00404b20
push str.TMAS_OL.ini
lea edx, [ebp - 0x18]
push 0x4910c0
push edx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea eax, [ebp + 0xac]
push eax
push 0x46d9f4
push str.ImportAddressMessage
push 0x472128
call esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b781
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp + 0xac]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42b790
sub eax, edx
sar eax, 1
jne 0x42b7fd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.IDS_MSG_ASKIMPORT
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2b
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x29
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b80c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42b80c
lea ecx, [ebp + 0xac]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404b20
lea edx, [ebp - 0x30]
push edx
call fcn.0041c0f0
mov ecx, dword [0x4910dc]
add esp, 4
push 1
call fcn.0042fa20
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
push 0x24
push eax
mov eax, dword [edx + 0x20]
push ecx
push eax
mov byte [ebp - 4], 0x2c
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42ba9e
push 0x40
xor eax, eax
lea ecx, [ebp - 0xc4]
push edi
push ecx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
call fcn.004481f0
push 0x4910b8
lea edx, [ebp - 0x48]
push 0x477800
push edx
mov dword [ebp - 0xc8], 0x44
call fcn.0040bc50
push str.WhiteList.dat
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0x2d
call fcn.0040bb70
push 0x4777f8
push eax
lea ecx, [ebp - 0x58]
push ecx
mov byte [ebp - 4], 0x2e
call fcn.0040bb70
push 0x4910b8
push eax
lea edx, [ebp - 0x54]
push edx
mov byte [ebp - 4], 0x2f
call fcn.00403920
push str.BlackList.dat
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x30
call fcn.0040bb70
add esp, 0x48
push 0x4777f0
push eax
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 4], 0x31
call fcn.0040bb70
push str.D0DDEF71_F704_46C7_8479_1986E867F375
push eax
lea edx, [ebp - 0x20]
push edx
mov byte [ebp - 4], 0x32
call fcn.0040bb70
add esp, 0x18
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x34
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b91e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x35
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b941
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x36
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b964
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x37
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b987
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x38
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b9aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x39
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b9cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OLImp.exe
lea ecx, [ebp - 0x40]
push 0x4910c0
push ecx
call fcn.0040bb70
add esp, 0xc
mov esi, eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov byte [ebp - 4], 0x3a
or ecx, eax
jge 0x42ba07
push edi
lea ecx, [ebp - 0x20]
call fcn.00402010
mov edx, dword [ebp - 0x20]
mov eax, dword [esi]
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0xc8]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov eax, dword [ebp - 0x40]
sete bl
add eax, 0xfffffff0
mov byte [ebp - 4], 0x39
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ba4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42ba5d
push str.xxx_Can_not_launch_TMAS_OLImp
call fcn.00409e70
add esp, 4
jmp 0x42ba7b
mov ecx, dword [ebp - 0x68]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x64]
push eax
call esi
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ba9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4910dc]
push edi
mov byte [ebp - 4], 0x29
call fcn.0042fa20
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x28
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bad1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42baf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xb
call fcn.0040a330
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x22
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_CONTEXTMENU_APPROVE
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
mov esi, dword [ebp - 0x28]
lea ecx, [esi + 0xd8]
push eax
mov byte [ebp - 4], 0x3b
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42bb79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x20
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_CONTEXTMENU_BLOCK
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea ecx, [esi + 0xdc]
push eax
mov byte [ebp - 4], 0x3c
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42bbe6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x25
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_CONTEXTMENU_REPORTSPAM
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea ecx, [esi + 0xe0]
push eax
mov byte [ebp - 4], 0x3d
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42bc53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x23
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_CONTEXTMENU_REPORTFP
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea ecx, [esi + 0xe4]
push eax
mov byte [ebp - 4], 0x3e
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42bcc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x26
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_CONTEXTMENU_REPORTPHISH
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea ecx, [esi + 0xe8]
push eax
mov byte [ebp - 4], 0x3f
call fcn.004037f0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42bd2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4910bc]
push ecx
push edi
push str.HiddenFunc
push 0x472128
call ebx
test eax, eax
mov eax, dword [0x4910bc]
push eax
push edi
push str.DumpMsg
setne dl
push str.Antispam
mov byte [0x491100], dl
call ebx
test eax, eax
setne cl
sub esp, 0x1c
mov byte [0x491101], cl
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x22
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push str.IDS_SPAMBUSTER_SPAMMAIL_FOLDERNAME
mov word [ecx + 4], di
call fcn.00404930
mov ecx, 0x4912d8
call fcn.0042e1a0
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x4912d8
call fcn.0042e3b0
mov esi, dword [eax]
mov eax, dword [0x491194]
cmp esi, eax
mov byte [ebp - 4], 0x40
je 0x42bdde
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, edi
je 0x42bdd8
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, edi
mov dword [0x491194], eax
jne 0x42bdde
push 0x8007000e
call fcn.00401210
mov dword [0x491194], edi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42be01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42be2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x70]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42be51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x74]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b08c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42b08c