Function at 0x417d30
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path
Get installed programs
Open recentdocs registry key
Parse pe header
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42897d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2bc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0xcc]
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0xcc]
push str.Temp
push ecx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea edx, [esp + 0xcc]
lea ecx, [esp + 0x74]
push edx
call sub.MFC42u.DLL_CString::CString_1
xor ebx, ebx
push 0x4335d0
lea ecx, [esp + 0x78]
mov dword [esp + 0x2d8], ebx
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esp + 0x74]
mov edi, dword [sym.imp.MSVCRT.dll__waccess]
push ebx
push eax
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x417dd6
push 0x4335cc
lea ecx, [esp + 0x78]
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [esp + 0x74]
push ebx
push ecx
call edi
add esp, 8
cmp eax, 0xffffffff
jne 0x417db8
mov edx, dword [esp + 0x74]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417e0d
push ebx
push ebx
push str.Problem_in_creating_Temp_Folder
call sub.MFC42u.DLL_AfxMessageBox
lea ecx, [esp + 0x74]
mov dword [esp + 0x2d4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor al, al
jmp 0x41f163
push ecx
lea eax, [esp + 0x78]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
mov ecx, 0x440bc0
call fcn.00402350
lea ecx, [esp + 0x74]
push str._none.html
lea edx, [esp + 0x84]
push ecx
push edx
call sub.MFC42u.DLL_operator
push 0x10
mov byte [esp + 0x2d8], 1
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x2d4], 2
je 0x417e79
mov ecx, dword [esp + 0x80]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x417e7b
xor edi, edi
push str._HTML__BODY_bgcolor__F5FFFF____html_
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 1
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [edi]
push 2
push ebx
mov ecx, edi
mov byte [esp + 0x2dc], 3
call dword [edx + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x54]
push 0xb8
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x2d4], 4
je 0x417ee3
push ebx
mov ecx, eax
call fcn.00416d80
jmp 0x417ee5
xor eax, eax
lea ebp, [esi + 4]
push ebx
mov byte [esp + 0x2d8], 3
push ebx
mov ecx, eax
mov dword [ebp], eax
call fcn.00416ef0
mov ecx, dword [ebp]
push 5
call sub.MFC42u.DLL_CWnd::ShowWindow
mov ecx, dword [ebp]
push 0x23
push ebx
call fcn.00417240
mov ecx, dword [ebp]
push str.Extracting_Registry_Information...
call fcn.00416fc0
mov ecx, dword [ebp]
push 1
call fcn.00417020
mov ecx, dword [ebp]
push ebx
call fcn.00416fe0
push 0xffffffffffffffff
push ebx
mov ecx, 0x440ba8
call sub.MFC42u.DLL_CStringArray::SetSize
lea eax, [esp + 0x78]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str._regmodtime.html
lea ecx, [esp + 0x80]
push eax
push ecx
mov byte [esp + 0x2e0], 5
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x78]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x2d4], 8
je 0x417fa6
mov edx, dword [esp + 0x7c]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov ebx, eax
push str._HTML__BODY_bgcolor__F5FFFF__
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 7
call fcn.00423f2c
push str._H3__center_REGISTRY_MODIFICATION_TIME__center___H3__br_
lea ecx, [esp + 0x70]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [ebx]
push 2
push 0
mov ecx, ebx
call dword [eax + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push 0
push 0x80000001
call edi
test eax, eax
jne 0x4180d5
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x30]
lea eax, [esp + 0x48]
push edx
push eax
mov ecx, esi
call fcn.004232c0
lea ecx, [esp + 0x48]
lea edx, [esp + 0x20]
push ecx
push str._h5__font_face___courier___NTUSER.DAT_:__br___font__font_face___courier__color___999999__
push edx
mov byte [esp + 0x2e0], 9
call sub.MFC42u.DLL_operator_2
push str.__font___h5_
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2dc], 0xa
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 0xb
call fcn.00423f0e
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xa
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 9
call sub.MFC42u.DLL_CString::CString
mov edx, dword [ebx]
push 2
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push 0x440300
push 0x80000002
call edi
test eax, eax
jne 0x4181c0
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x30]
lea eax, [esp + 0x48]
push edx
push eax
mov ecx, esi
call fcn.004232c0
lea ecx, [esp + 0x48]
lea edx, [esp + 0x20]
push ecx
push str._h5__font_face___courier___SAM_:__br___font__font_face___courier__color___999999__
push edx
mov byte [esp + 0x2e0], 0xc
call sub.MFC42u.DLL_operator_2
push str.__font___h5_
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2dc], 0xd
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 0xe
call fcn.00423f0e
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xc
call sub.MFC42u.DLL_CString::CString
mov edx, dword [ebx]
push 2
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SYSTEM
push 0x80000002
call edi
test eax, eax
jne 0x4182ab
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x30]
lea eax, [esp + 0x48]
push edx
push eax
mov ecx, esi
call fcn.004232c0
lea ecx, [esp + 0x48]
lea edx, [esp + 0x20]
push ecx
push str._h5__font_face___courier___SYSTEM_:__br___font__font_face___courier__color___999999__
push edx
mov byte [esp + 0x2e0], 0xf
call sub.MFC42u.DLL_operator_2
push str.__font___h5_
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2dc], 0x10
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 0x11
call fcn.00423f0e
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x10
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xf
call sub.MFC42u.DLL_CString::CString
mov edx, dword [ebx]
push 2
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
call edi
test eax, eax
jne 0x418396
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x30]
lea eax, [esp + 0x48]
push edx
push eax
mov ecx, esi
call fcn.004232c0
lea ecx, [esp + 0x48]
lea edx, [esp + 0x20]
push ecx
push str._h5__font_face___courier___SOTWARE_:__br___font__font_face___courier__color___999999__
push edx
mov byte [esp + 0x2e0], 0x12
call sub.MFC42u.DLL_operator_2
push str.__font___h5_
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2dc], 0x13
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d8], 0x14
call fcn.00423f0e
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x13
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x12
call sub.MFC42u.DLL_CString::CString
mov edx, dword [ebx]
push 2
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov eax, dword [esp + 0x6c]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x54]
lea eax, [esp + 0x18]
push eax
push str.SAMSAMDomainsAccountUsers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x418894
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x58]
push ecx
push 0
push 4
push edx
mov dword [esp + 0x68], 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov eax, dword [esp + 0x58]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x58]
mov edi, eax
push ecx
push edi
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x418410
push 0
push 0
push str.RegGetKeySecurity_failed
call sub.MFC42u.DLL_AfxMessageBox
lea eax, [esp + 0x30]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x41843e
push eax
push eax
push str.GetSecurityDescriptorDacl_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x48]
test eax, eax
je 0x418475
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x418475
push 2
lea ecx, [esp + 0x88]
push 0xc
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x4185b8
push eax
push eax
push str.GetAclInformation_failed
call sub.MFC42u.DLL_AfxMessageBox
mov edi, dword [esp + 0x78]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 2
push edi
push eax
mov dword [esp + 0x50], eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x4184a0
push eax
push eax
push str.InitializeAcl_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x48]
test eax, eax
je 0x418517
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x418517
mov eax, dword [esp + 0x84]
test eax, eax
jbe 0x418517
xor edi, edi
test eax, eax
jbe 0x418517
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x41850b
mov eax, dword [esp + 0x10]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x5c], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x5e]
mov ecx, dword [ecx + 8]
and edx, 0xffff
push edx
push eax
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push 2
push eax
mov dword [esp + 0x78], ecx
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov eax, dword [esp + 0x84]
inc edi
cmp edi, eax
jb 0x4184c1
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004224a0
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
mov dword [esp + 0x24], edx
push eax
push 0x20019
push 0
push str.SAMSAMDomainsAccountUsers
push 0x80000002
call edi
test eax, eax
jne 0x418818
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.userdets.html
lea edx, [esp + 0x54]
push eax
push edx
mov byte [esp + 0x2e0], 0x15
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x17
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov byte [esp + 0x2d4], 0x18
je 0x4185c4
mov ecx, dword [esp + 0x50]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x4185c6
mov edi, dword [esp + 0x88]
jmp 0x418479
xor edi, edi
push 0x440958
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x17
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2d8], 0x19
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.User_Details
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x1a
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x1b
mov ecx, esp
mov dword [esp + 0x68], esp
push str.HKLMSAMSAMDomainsAccountUsers
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x19
call fcn.00417ae0
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
call fcn.00423f2c
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_User_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Relative_ID__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Full_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Comment__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Login_date__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_password_changed_date__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Login_failed_date__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Login_count__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SAMSAMDomainsAccountUsers
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::CString_1
push 0x43f880
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2d8], 0x1c
call sub.MFC42u.DLL_CString::CString_1
push 1
mov byte [esp + 0x2d8], 0x1d
push edi
push ecx
lea edx, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x78]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
mov byte [esp + 0x2e8], 0x1e
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0x1d
push ecx
mov ecx, esi
call fcn.00422590
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
push 0x434ac4
lea ecx, [esp + 0x74]
mov dword [esi + 0x18], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x70]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x1f
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d4], 0x1d
call sub.MFC42u.DLL_CString::CString
push 0x434ab4
lea ecx, [esp + 0x74]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x70]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x20
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d4], 0x1d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 0x1c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0x19
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x17
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x94]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x418838
push eax
push eax
push str.InitializeSecurityDescriptor_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x44]
push 0
push eax
lea ecx, [esp + 0x9c]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x41885f
push eax
push eax
push str.SetSecurityDescriptorDacl_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x94]
push edx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x418886
push 0
push 0
push str.RegSetKeySecurity_failed
call sub.MFC42u.DLL_AfxMessageBox
mov ecx, dword [esp + 0x18]
push ecx
call ebx
mov edx, dword [esp + 0x24]
push edx
call ebx
lea eax, [esp + 0x18]
push eax
push str.SAMSAMDomainsBuiltinAliases
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x418d47
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x58]
push ecx
push eax
push 4
push edx
mov dword [esp + 0x68], eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov eax, dword [esp + 0x58]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x58]
mov edi, eax
push ecx
push edi
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x4188fc
push 0
push 0
push str.RegGetKeySecurity_failed
call sub.MFC42u.DLL_AfxMessageBox
lea eax, [esp + 0x30]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x41892a
push eax
push eax
push str.GetSecurityDescriptorDacl_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x24]
test eax, eax
je 0x418961
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x418961
push 2
lea ecx, [esp + 0x98]
push 0xc
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x418aa7
push eax
push eax
push str.GetAclInformation_failed
call sub.MFC42u.DLL_AfxMessageBox
mov edi, dword [esp + 0x78]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 2
push edi
push eax
mov dword [esp + 0x54], eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41898c
push eax
push eax
push str.InitializeAcl_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x24]
test eax, eax
je 0x418a0f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x418a0f
mov eax, dword [esp + 0x94]
test eax, eax
jbe 0x418a0f
xor edi, edi
test eax, eax
jbe 0x418a0f
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x418a03
mov eax, dword [esp + 0x10]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x84], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x88], edx
mov edx, dword [esp + 0x86]
mov ecx, dword [ecx + 8]
and edx, 0xffff
push edx
push eax
mov eax, dword [esp + 0x50]
push 0xffffffffffffffff
push 2
push eax
mov dword [esp + 0xa0], ecx
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov eax, dword [esp + 0x94]
inc edi
cmp edi, eax
jb 0x4189ad
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004224a0
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
push str.SAMSAMDomainsBuiltinAliases
push 0x80000002
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x418ccd
lea eax, [esp + 0x10]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str.groupdets.html
lea ecx, [esp + 0x6c]
push eax
push ecx
mov byte [esp + 0x2e0], 0x21
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x23
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov byte [esp + 0x2d4], 0x24
je 0x418ab3
mov edx, dword [esp + 0x68]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x418ab5
mov edi, dword [esp + 0x98]
jmp 0x418965
xor edi, edi
push 0x440958
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x23
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2d8], 0x25
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.Group_Details
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x26
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x27
mov ecx, esp
mov dword [esp + 0x68], esp
push str.HKLMSAMSAMDomainsBuiltinAliases
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x25
call fcn.00417ae0
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
call fcn.00423f2c
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Group_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width50___FONT_face___Courier__size___2___color__white___B_No._of_users__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300___FONT_face___Courier__size___2___color__white___B_Comment__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300___FONT_face___Courier__size___2___color__white___B_Users__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SAMSAMDomainsBuiltinAliases
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::CString_1
push 0x43f880
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d8], 0x28
call sub.MFC42u.DLL_CString::CString_1
push 2
push edi
push ecx
lea edx, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
mov byte [esp + 0x2e4], 0x29
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e4], 0x2a
mov ecx, esp
mov dword [esp + 0x50], esp
lea eax, [esp + 0x60]
push eax
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0x29
push ecx
mov ecx, esi
call fcn.00422590
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
push 0x434ac4
lea ecx, [esp + 0x48]
mov dword [esi + 0x18], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x44]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x2b
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x29
call sub.MFC42u.DLL_CString::CString
push 0x434738
lea ecx, [esp + 0x48]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x44]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x2c
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x29
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x28
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0x25
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x23
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [esp + 0x20]
lea edx, [esp + 0xb8]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x418ced
push eax
push eax
push str.InitializeSecurityDescriptor_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x48]
push 0
push eax
lea ecx, [esp + 0xc0]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x418d14
push eax
push eax
push str.SetSecurityDescriptorDacl_failed
call sub.MFC42u.DLL_AfxMessageBox
lea edx, [esp + 0xb8]
push edx
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x418d37
push 0
push 0
push str.RegSetKeySecurity_failed
call sub.MFC42u.DLL_AfxMessageBox
mov eax, dword [esp + 0x18]
push eax
call ebx
push edi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push str.SystemCurrentControlSetControlComputerNameComputerName
push 0x80000002
call edi
test eax, eax
jne 0x419032
lea edx, [esp + 0x10]
mov ecx, 0x440bc0
push edx
call fcn.004023a0
push str.compname.html
push eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x2dc], 0x2d
push eax
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x2f
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x30
je 0x418dce
mov ecx, dword [esp + 0x54]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x418dd0
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x2f
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x31
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Computer_Name
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x32
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x33
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSystemCurrentControlSetControlComputerNameComputerName
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x31
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B__CENTER_Computer_Name__CENTER___B___FONT___TH___TR_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x34
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.ComputerName
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x4c]
push edx
push eax
mov ecx, esi
call fcn.00421da0
lea ecx, [esp + 0x44]
lea edx, [esp + 0x28]
push ecx
push str._TR_height25_bgcolor_FFFFD9___TD__FONT_face___Courier__size___2___colorblack__CENTER_
push edx
mov byte [esp + 0x2e0], 0x35
call sub.MFC42u.DLL_operator_2
push str.nbsp__CENTER___font___TD___tr_
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x2dc], 0x36
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x37
call fcn.00423f0e
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x36
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x35
call sub.MFC42u.DLL_CString::CString
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436c2c
lea ecx, [esp + 0x28]
mov dword [esi + 0x20], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x38
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x35
call sub.MFC42u.DLL_CString::CString
push 0x434600
lea ecx, [esp + 0x28]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x39
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x35
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x34
call sub.MFC42u.DLL_CString::CString
mov byte [esp + 0x2d4], 0x31
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x2f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlWindows
push 0x80000002
call edi
test eax, eax
jne 0x41931d
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._shutdown.html
lea edx, [esp + 0x58]
push eax
push edx
mov byte [esp + 0x2e0], 0x3a
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x3c
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x3d
je 0x4190b9
mov ecx, dword [esp + 0x54]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x4190bb
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x3c
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x3e
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Last_Shutdown_Time
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x3f
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x40
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSystemCurrentControlSetControlWindows
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x3e
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Shutdown_Time__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x41
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.ShutdownTime
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x4c]
push edx
push eax
mov ecx, esi
call fcn.00421da0
lea ecx, [esp + 0x44]
lea edx, [esp + 0x28]
push ecx
push str._TR_height25_bgcolor_FFFFD9___TD__FONT_face___Courier__size___2___colorblack__CENTER_
push edx
mov byte [esp + 0x2e0], 0x42
call sub.MFC42u.DLL_operator_2
push str.nbsp__CENTER___font___TD___tr_
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x2dc], 0x43
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x44
call fcn.00423f0e
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x43
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x42
call sub.MFC42u.DLL_CString::CString
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436c2c
lea ecx, [esp + 0x28]
mov dword [esi + 0x20], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x45
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x42
call sub.MFC42u.DLL_CString::CString
push 0x4344cc
lea ecx, [esp + 0x28]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x46
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x42
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x41
call sub.MFC42u.DLL_CString::CString
mov byte [esp + 0x2d4], 0x3e
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x3c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlTimeZoneInformation
push 0x80000002
call edi
test eax, eax
jne 0x419915
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._timezone.html
lea edx, [esp + 0x6c]
push eax
push edx
mov byte [esp + 0x2e0], 0x47
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x49
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x4a
je 0x4193a4
mov ecx, dword [esp + 0x68]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x4193a6
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x49
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x54]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x4b
mov ecx, esp
mov dword [esp + 0x34], esp
push str.TimeZoneInformation
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x4c
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x4d
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSystemCurrentControlSetControlTimeZoneInformation
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x4b
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x4e
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200___FONT_face___Courier__size___2___color__white___B_Data__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.StandardName
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x58]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.DaylightName
mov byte [esp + 0x2e0], 0x4f
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x4c]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Bias
mov byte [esp + 0x2e0], 0x50
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push str._hours
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x51
call sub.MFC42u.DLL_CString::operator_1
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.ActiveTimeBias
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x60]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push str._hours
lea ecx, [esp + 0x5c]
mov byte [esp + 0x2d8], 0x52
call sub.MFC42u.DLL_CString::operator_1
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call fcn.00423f2c
push str._TD__FONT_face___Courier__size___2__colorblack_Standard_Namenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x50]
lea edx, [esp + 0x28]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x53
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x54
call sub.MFC42u.DLL_operator_1
mov byte [esp + 0x2d4], 0x55
push eax
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x54
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x53
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x52
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_Daylight_Namenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea eax, [esp + 0x44]
lea ecx, [esp + 0x28]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0x56
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x57
push edx
push eax
lea eax, [esp + 0x28]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x58
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x57
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x56
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x52
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_Biasnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x59
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x5a
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x5b
call sub.MFC42u.DLL_CString::operator
mov byte [esp + 0x2d4], 0x5a
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x59
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x52
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_Activetime_Biasnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea eax, [esp + 0x58]
lea ecx, [esp + 0x28]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0x5c
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x5d
push edx
push eax
lea eax, [esp + 0x28]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x5e
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x5d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x5c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x52
call sub.MFC42u.DLL_CString::CString
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436c2c
lea ecx, [esp + 0x28]
mov dword [esi + 0x20], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x5f
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov byte [esp + 0x2d4], 0x52
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString
push 0x434468
lea ecx, [esp + 0x28]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x60
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x52
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x58]
mov byte [esp + 0x2d4], 0x51
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x50
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x4f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x4e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x4b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0x49
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x41a351
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.osdetails.html
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x2e0], 0x61
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0x63
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x64
je 0x41999c
mov ecx, dword [esp + 0x10]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41999e
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x63
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x65
mov ecx, esp
mov dword [esp + 0x34], esp
push str.OS_Details
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x66
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x67
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersion
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x65
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x68
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Data__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.ProductName
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x30]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.CSDVersion
mov byte [esp + 0x2e0], 0x69
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.InstallDate
mov byte [esp + 0x2e0], 0x6a
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.RegisteredOwner
mov byte [esp + 0x2e0], 0x6b
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x78]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.ProductId
mov byte [esp + 0x2e0], 0x6c
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.RegisteredOrganization
mov byte [esp + 0x2e0], 0x6d
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x70]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.SystemRoot
mov byte [esp + 0x2e0], 0x6e
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x5c]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.CurrentVersion
mov byte [esp + 0x2e0], 0x6f
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x58]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.SourcePath
mov byte [esp + 0x2e0], 0x70
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x71
call fcn.00423f2c
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_ProductNamenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea edx, [esp + 0x28]
lea eax, [esp + 0x2c]
push edx
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push eax
mov byte [esp + 0x2e0], 0x72
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x73
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x74
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x73
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x72
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_CSDVersionnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x3c]
push eax
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0x75
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x76
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x77
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x76
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x75
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_InstallDatenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x58]
lea edx, [esp + 0x3c]
push ecx
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x78
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x79
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x7a
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x79
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x78
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_RegisteredOwnernbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea eax, [esp + 0x70]
lea ecx, [esp + 0x3c]
push eax
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0x7b
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x7c
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x7d
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x7c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x7b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_RegisteredOrganizationnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x68]
lea edx, [esp + 0x3c]
push ecx
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x7e
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x7f
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x80
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x7f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x7e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_ProductIdnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
mov byte [esp + 0x2d4], 0x81
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x40]
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x82
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x83
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x82
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x81
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__face___Courier__size___2__colorblack_SystemRootnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x54]
lea edx, [esp + 0x3c]
push ecx
push str._TD__FONT_face___Courier__face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x84
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x85
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x86
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x85
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x84
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_CurrentVersionnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea eax, [esp + 0x50]
mov byte [esp + 0x2d4], 0x87
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
lea ecx, [esp + 0x44]
push ecx
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x88
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x89
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x88
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x87
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_HEIGHT30_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_SourcePathnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x28]
call fcn.00423f32
lea ecx, [esp + 0x44]
lea edx, [esp + 0x3c]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x8a
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x8b
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x8c
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x8b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x8a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436c2c
lea ecx, [esp + 0x28]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x8d
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
push 0x4358e0
lea ecx, [esp + 0x28]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x8e
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x70
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x6f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0x6e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 0x6d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 0x6c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x70]
mov byte [esp + 0x2d4], 0x6b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x58]
mov byte [esp + 0x2d4], 0x6a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x69
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x68
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x65
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x63
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call edi
test eax, eax
jne 0x41aaed
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.logondetails.html
lea edx, [esp + 0x4c]
push eax
push edx
mov byte [esp + 0x2e0], 0x8f
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x91
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x92
je 0x41a3d8
mov ecx, dword [esp + 0x48]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41a3da
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x91
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x68]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x93
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Logon_Details
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x94
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x95
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x93
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x96
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Data__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.DefaultDomainName
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x5c]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.DefaultUserName
mov byte [esp + 0x2e0], 0x97
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x58]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.LegalNoticeCaption
mov byte [esp + 0x2e0], 0x98
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.LegalNoticeText
mov byte [esp + 0x2e0], 0x99
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.LastUserLoggedIn
mov byte [esp + 0x2e0], 0x9a
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.AutoAdminLogon
mov byte [esp + 0x2e0], 0x9b
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, esi
call fcn.00421da0
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x9c
call fcn.00423f2c
push str._TD__FONT_face___Courier__size___2__colorblack_DefaultDomainNamenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea edx, [esp + 0x54]
lea eax, [esp + 0x4c]
push edx
push str._TD__FONT_face___Courier__size___2___colorblack_
push eax
mov byte [esp + 0x2e0], 0x9d
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x9e
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x9f
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x9e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0x9d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack__DefaultUserNamenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0xa0
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xa1
push edx
push eax
lea eax, [esp + 0x44]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xa2
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xa1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xa0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_LegalNoticeCaptionnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x44]
lea edx, [esp + 0x4c]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0xa3
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0xa4
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xa5
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xa4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xa3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack__LegalNoticeTextnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea eax, [esp + 0x24]
lea ecx, [esp + 0x4c]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0xa6
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xa7
push edx
push eax
lea eax, [esp + 0x44]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xa8
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xa7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xa6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_LastUserLoggedInnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
mov byte [esp + 0x2d4], 0xa9
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x50]
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0xaa
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xab
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xaa
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xa9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_AutoAdminLogonnbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea eax, [esp + 0x20]
lea ecx, [esp + 0x4c]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0xac
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xad
push edx
push eax
lea eax, [esp + 0x44]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xae
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xad
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xac
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436c2c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xaf
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
push 0x436c1c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xb0
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x9c
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x9b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x9a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x99
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0x98
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0x97
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0x96
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x93
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 0x91
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
push 0x80000001
call edi
test eax, eax
jne 0x41ae1a
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.openfiles.html
lea edx, [esp + 0x48]
push eax
push edx
mov byte [esp + 0x2e0], 0xb1
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xb3
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xb4
je 0x41ab74
mov ecx, dword [esp + 0x44]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41ab76
xor edi, edi
push ecx
mov byte [esp + 0x2d8], 0xb3
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Opened_Saved_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0xb5
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0xb6
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xb3
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xb7
call fcn.00423f2c
push str._TH_HEIGHT30_width400__FONT_face___Courier__size___2___color__white___B__center_Opened_Saved_Files_via_Windows_Explorer__center___B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::CString_1
push 0x43d5a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d8], 0xb8
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xb9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
mov byte [esp + 0x2d4], 0xba
push str._TR_height25__TD_colspan3_BGCOLOR_E0FFFF___FONT_face___Courier__size__2__colorblack___center_Files_without_extension___LastWrittenTime_:
lea ecx, [esp + 0x18]
call fcn.00423f2c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42u.DLL_CString::operator
push str.___nbsp__center___font___td___tr_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 4
push edi
push edx
mov ecx, esi
call fcn.00420740
push 0
push edi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x2e8], 0xbb
call sub.MFC42u.DLL_CString::CString_4
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
mov byte [esp + 0x2e8], 0xba
call fcn.0041f1e0
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::Empty
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov ecx, dword [esp + 0x18]
push ecx
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xbc
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xba
call sub.MFC42u.DLL_CString::CString
push 0x435e7c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
mov byte [esp + 0x2d4], 0xbd
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xba
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xb9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0xb8
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0xb7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0xb3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
push 0x80000001
call edi
test eax, eax
jne 0x41b139
lea eax, [esp + 0x2c]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str._recentdocs.html
lea ecx, [esp + 0x48]
push eax
push ecx
mov byte [esp + 0x2e0], 0xbe
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xc0
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xc1
je 0x41aea1
mov edx, dword [esp + 0x44]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41aea3
xor edi, edi
lea eax, [esp + 0x5c]
mov byte [esp + 0x2d4], 0xc0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x24], 1
mov ecx, dword [esp + 0x38]
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x5c]
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xc2
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_Documents
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
mov byte [esp + 0x2e0], 0xc3
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xc4
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xc2
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xc5
call fcn.00423f2c
push str._TH_HEIGHT30_width400__FONT_face___Courier__size___2___color__white___B__center_Recent_Documents__center___B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push 0x43d5a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d8], 0xc6
call sub.MFC42u.DLL_CString::CString_1
push str._TR_height25__TD_colspan3_BGCOLOR_E0FFFF____FONT_face___Courier__size__2__colorblack___center_Recently_Accessed_Files_Folders
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xc7
call fcn.00423f2c
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 4
push edi
push edx
mov ecx, esi
call fcn.00420740
push 0
push edi
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x2e8], 0xc8
call sub.MFC42u.DLL_CString::CString_4
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
mov byte [esp + 0x2e8], 0xc7
call fcn.0041f1e0
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::Empty
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov ecx, dword [esp + 0x18]
push ecx
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xc9
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xc7
call sub.MFC42u.DLL_CString::CString
push 0x435c34
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xca
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov byte [esp + 0x2d4], 0xc7
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x24], 0
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xc6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0xc5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0xc2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0xc0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU
push 0x80000001
call edi
test eax, eax
jne 0x41b3fa
lea eax, [esp + 0x2c]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str.lastvisited.html
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x2e0], 0xcb
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xcd
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xce
je 0x41b1c0
mov edx, dword [esp + 0x28]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41b1c2
xor edi, edi
lea eax, [esp + 0x5c]
mov byte [esp + 0x2d4], 0xcd
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x28], 1
mov ecx, dword [esp + 0x38]
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x5c]
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xcf
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Last_Visited_Exes
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
mov byte [esp + 0x2e0], 0xd0
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xd1
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xcf
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xd2
call fcn.00423f2c
push str._TH_HEIGHT30_width100__FONT_face___Courier__size___2___color__white___B_Recently_Used_Exe__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width400__FONT_face___Courier__size___2___color__white___B__center_Folder_path_of_file_opened_saved_using_Exe__center___B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerLastVisitedMRU
lea ecx, [esp + 0x50]
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x2d4], 0xd3
push 0x43d5a0
lea ecx, [esp + 0x40]
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x18]
push 4
push edi
push edx
mov ecx, esi
mov byte [esp + 0x2e0], 0xd4
call fcn.00420740
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::Empty
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xd5
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xd4
call sub.MFC42u.DLL_CString::CString
push 0x4359e4
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xd6
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xd4
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xd3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xd2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xcf
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xcd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareNico_Mak_ComputingWinZip_filemenu
push 0x80000001
call edi
test eax, eax
jne 0x41b648
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.winzip.html
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2e0], 0xd7
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xd9
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xda
je 0x41b481
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41b483
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xd9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xdb
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_Winzip_Archives
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xdc
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xdd
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareNico_Mak_ComputingWinZip_filemenu
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xdb
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xde
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_WinZip_Archives__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xdf
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xde
call sub.MFC42u.DLL_CString::CString
push 0x436154
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xe0
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xde
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xdb
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xd9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftMediaPlayerPlayerRecentFileList
push 0x80000001
call edi
test eax, eax
jne 0x41b896
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.mediaplayerfiles.html
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2e0], 0xe1
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xe3
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xe4
je 0x41b6cf
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41b6d1
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xe3
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xe5
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_MediaPlayer_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xe6
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xe7
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftMediaPlayerPlayerRecentFileList
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xe5
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xe8
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_MediaPlayer_Files__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xe9
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xe8
call sub.MFC42u.DLL_CString::CString
push 0x4369f0
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xea
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xe8
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xe5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xe3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftOffice9.0ExcelRecent_Files
push 0x80000001
call edi
test eax, eax
jne 0x41bae4
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.excelfiles.html
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2e0], 0xeb
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xed
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xee
je 0x41b91d
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41b91f
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xed
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xef
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_Excel_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xf0
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xf1
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftOffice9.0ExcelRecent_Files
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xef
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xf2
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Excel_Files__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xf3
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xf2
call sub.MFC42u.DLL_CString::CString
push 0x4368c0
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xf4
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xf2
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xef
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xed
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftOffice9.0PowerPointRecent_File_List
push 0x80000001
call edi
test eax, eax
jne 0x41bd32
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.powerpointfiles.html
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2e0], 0xf5
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xf7
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], pe_nt_image_headers32
je 0x41bb6b
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41bb6d
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xf7
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xf9
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_PowerPoint_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xfa
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xfb
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftOffice9.0PowerPointRecent_File_List
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xf9
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xfc
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_PowerPoint_Files__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [ebp]
call fcn.00417050
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xfd
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xfc
call sub.MFC42u.DLL_CString::CString
push 0x43676c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xfe
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xfc
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xf9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xf7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionAppletsPaintRecent_File_List
push 0x80000001
call edi
test eax, eax
jne 0x41bf86
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.paintfiles.html
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2e0], 0xff
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2d4], 0x101
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 2
je 0x41bdbc
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41bdbe
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 3
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_Paint_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 4
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 5
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionAppletsPaintRecent_File_List
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 3
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 6
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Paint_Files__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [ebp]
call fcn.00417050
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 7
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 6
call sub.MFC42u.DLL_CString::CString
push 0x4364fc
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 8
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 6
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpadRecent_File_List
push 0x80000001
call edi
test eax, eax
jne 0x41c1da
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.wordpadfiles.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x109
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xb
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xc
je 0x41c010
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41c012
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xb
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xd
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Recent_WordPad_Files
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xe
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xf
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionAppletsWordpadRecent_File_List
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xd
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x10
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_WordPad_Files__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [ebp]
call fcn.00417050
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x11
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x10
call sub.MFC42u.DLL_CString::CString
push 0x43662c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x12
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x10
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xb
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
push 0x80000001
call edi
test eax, eax
jne 0x41c42e
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._runmru.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x113
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x15
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x16
je 0x41c264
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41c266
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x15
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x17
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Run_Commands
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x18
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x19
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x17
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x1a
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Commands_typed_in_Run_box__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 4
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [ebp]
call fcn.00417050
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x1b
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x1a
call sub.MFC42u.DLL_CString::CString
push 0x436290
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x1c
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x1a
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x17
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x15
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftSearch_AssistantACMru
push 0x80000001
call edi
test eax, eax
jne 0x41c6b4
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._searchterms.html
lea edx, [esp + 0x28]
push eax
push edx
mov dword [esp + 0x2e0], 0x11d
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x1f
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x20
je 0x41c4b8
mov ecx, dword [esp + 0x24]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41c4ba
xor edi, edi
push ecx
mov byte [esp + 0x2d8], 0x1f
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Searched_Keywords
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x21
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x22
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SoftwareMicrosoftSearch_AssistantACMru
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x1f
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x23
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Searched_terms__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftSearch_AssistantACMru
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push 0x43d5a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d8], 0x24
call sub.MFC42u.DLL_CString::CString_1
push 5
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x2e4], 0x25
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x2e8], 0x26
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0x25
push ecx
mov ecx, esi
call fcn.0041f1e0
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436a04
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x27
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x25
call sub.MFC42u.DLL_CString::CString
push 0x4363c0
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x28
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x25
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x24
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x23
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x1f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServices
push 0x80000002
call edi
test eax, eax
jne 0x41c980
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._services.html
lea edx, [esp + 0x28]
push eax
push edx
mov dword [esp + 0x2e0], 0x129
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x2b
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x2c
je 0x41c73e
mov ecx, dword [esp + 0x24]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41c740
xor edi, edi
push 0x440958
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x2b
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2d8], 0x2d
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Services
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x2e
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x2f
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSystemCurrentControlSetServices
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x2d
call fcn.00417ae0
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
call fcn.00423f2c
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Display__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_ImagePath__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Start__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Group__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_LastWrittenTime__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SystemCurrentControlSetServices
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push 0x43f880
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d8], 0x30
call sub.MFC42u.DLL_CString::CString_1
push 1
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x2e4], 0x31
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x2e8], 0x32
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0x31
push ecx
mov ecx, esi
call fcn.0041f1e0
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x436d64
lea ecx, [esp + 0x14]
mov dword [esi + 0x20], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x33
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x31
call sub.MFC42u.DLL_CString::CString
push 0x433d58
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x34
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x31
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x30
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x2d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x2b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call edi
test eax, eax
jne 0x41cbe2
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._starupprogms.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x135
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x37
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x38
je 0x41ca0a
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41ca0c
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x37
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x39
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Startup_Programs
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x3a
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x3b
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionRun
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x39
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x3c
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Startup_Programs__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 6
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436d64
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x3d
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x3c
call sub.MFC42u.DLL_CString::CString
push 0x436d50
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x3e
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x3c
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x39
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x37
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call edi
test eax, eax
jne 0x41ce44
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._starupprogms.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x13f
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x41
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x42
je 0x41cc6c
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41cc6e
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x41
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x43
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x44
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x45
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x43
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x46
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Startup_Programs__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 6
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436d64
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x47
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x46
call sub.MFC42u.DLL_CString::CString
push 0x436d50
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x48
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x46
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x43
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x41
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call edi
test eax, eax
jne 0x41d0a6
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._starupprogms.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x149
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x4b
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x4c
je 0x41cece
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41ced0
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x4b
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x4d
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x4e
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x4f
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionRun
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x4d
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x50
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Startup_Programs__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 6
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436d64
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x51
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x50
call sub.MFC42u.DLL_CString::CString
push 0x436d50
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x52
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x50
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x4d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x4b
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call edi
test eax, eax
jne 0x41d308
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._starupprogms.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x153
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x55
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x56
je 0x41d130
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41d132
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x55
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x57
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x58
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x59
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x57
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x5a
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Startup_Programs__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 6
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x436d64
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x5b
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x5a
call sub.MFC42u.DLL_CString::CString
push 0x436d50
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x5c
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x5a
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x57
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x55
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call edi
test eax, eax
jne 0x41d55c
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._typedurls.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x15d
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x5f
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x60
je 0x41d392
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41d394
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x5f
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x61
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Typed_URLs
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x62
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x63
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftInternet_ExplorerTypedURLs
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x61
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x64
call fcn.00423f2c
push str._TH_HEIGHT30_width300__FONT_face___Courier__face___Courier__size___2___color__white___B_Typed_URLs__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x4376d8
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x65
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x64
call sub.MFC42u.DLL_CString::CString
push 0x435590
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x66
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x64
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x61
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x5f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call edi
test eax, eax
jne 0x41d930
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.IEsettings.html
lea edx, [esp + 0x28]
push eax
push edx
mov dword [esp + 0x2e0], 0x167
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x69
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x6a
je 0x41d5e6
mov ecx, dword [esp + 0x24]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41d5e8
xor edi, edi
push ecx
mov byte [esp + 0x2d8], 0x69
mov ecx, esp
mov dword [esp + 0x34], esp
push str.IE_Settings
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x6b
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x6c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftInternet_ExplorerMain
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x69
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width100__FONT_face___Courier__size___2___color__white___B_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x6d
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Data__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Start_Page
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x30]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Save_Directory
mov byte [esp + 0x2e0], 0x6e
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, esi
call fcn.00421da0
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x6f
call fcn.00423f2c
push str._TD__FONT_face___Courier__size___2__colorblack_StartPagenbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea eax, [esp + 0x28]
lea ecx, [esp + 0x4c]
push eax
push str._TD__FONT_face___Courier__size___2___colorblack_
push ecx
mov byte [esp + 0x2e0], 0x70
call sub.MFC42u.DLL_operator_2
lea edx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x71
push edx
push eax
lea eax, [esp + 0x44]
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x72
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x71
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0x70
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x6f
call sub.MFC42u.DLL_CString::CString
push str._TR_height25_BGCOLOR_FFFFFF__
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TD__FONT_face___Courier__size___2__colorblack_SaveDirectorynbsp__font___TD_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str.nbsp__font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x20]
lea edx, [esp + 0x4c]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack_
push edx
mov byte [esp + 0x2e0], 0x73
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x74
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x75
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x74
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0x73
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x6f
call sub.MFC42u.DLL_CString::CString
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x4376d8
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x76
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x6f
call sub.MFC42u.DLL_CString::CString
push 0x43547c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x77
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x6f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x6e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x6d
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x69
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsUrl_History
push 0x80000001
call edi
test eax, eax
jne 0x41dc56
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.dayssaved.html
lea edx, [esp + 0x28]
push eax
push edx
mov dword [esp + 0x2e0], 0x178
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x7a
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x7b
je 0x41d9ba
mov ecx, dword [esp + 0x24]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41d9bc
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x7a
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x7c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.URL_History
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x7d
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x7e
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsUrl_History
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x7c
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Days_To_Keep_URL_History__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x7f
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 5
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.DaysToKeep
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x80
call fcn.00423f2c
push str.nbsp__center___font___TD___TR_
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x20]
lea edx, [esp + 0x4c]
push ecx
push str._TD__FONT_face___Courier__size___2___colorblack__center_
push edx
mov byte [esp + 0x2e0], 0x81
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x2e0], 0x82
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x83
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0x82
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0x81
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x80
call sub.MFC42u.DLL_CString::CString
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x4376d8
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x84
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x80
call sub.MFC42u.DLL_CString::CString
push 0x437580
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x85
push edx
push eax
mov ecx, 0x440ba8
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x80
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x7f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x7c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x7a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000001
call edi
test eax, eax
jne 0x41ded1
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.downloaddirectory.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x186
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x88
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x89
je 0x41dce0
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41dce2
xor edi, edi
push 0x440958
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x88
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2d8], 0x8a
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Download_Directory
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0x8b
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0x8c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftInternet_Explorer
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x8a
call fcn.00417ae0
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___CENTER_Default_Download_Directory__CENTER___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Download_Directory
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
call fcn.00421da0
push str._TR_height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0x8d
call fcn.00423f2c
push str._TD__FONT_face___Courier__size___2___colorblack__center_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator
push 0x43ad4c
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x4376d8
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x8e
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x8d
call sub.MFC42u.DLL_CString::CString
push 0x4376c4
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x8f
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x8d
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x8a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0x88
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call edi
test eax, eax
jne 0x41e177
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str._softwareinstall.html
lea edx, [esp + 0x48]
push eax
push edx
mov dword [esp + 0x2e0], 0x190
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x92
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x93
je 0x41df5b
mov ecx, dword [esp + 0x44]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41df5d
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0x92
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0x94
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Software_Installed
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0x95
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0x96
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0x94
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0x97
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Software_Installed__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_LastWrittenTime__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x2d4], 0x98
push 0x43f880
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_1
push 2
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x2e4], 0x99
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x2e8], 0x9a
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0x99
push ecx
mov ecx, esi
call fcn.0041f1e0
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x4356bc
lea ecx, [esp + 0x14]
mov dword [esi + 0x1c], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0x9b
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0x99
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x98
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0x97
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0x94
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0x92
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist75048700_EF1F_11D0_9888_006097DEACF9Count
push 0x80000001
call edi
test eax, eax
jne 0x41e3ab
lea eax, [esp + 0x2c]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str.useracts.html
lea ecx, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x2e0], 0x19c
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0x9e
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0x9f
je 0x41e201
mov edx, dword [esp + 0x28]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41e203
xor edi, edi
lea eax, [esp + 0x5c]
mov ecx, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov byte [esp + 0x304], 0x9e
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [esp + 0x5c]
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xa0
mov ecx, esp
mov dword [esp + 0x34], esp
push str.User_Activities
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
mov byte [esp + 0x2e0], 0xa1
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xa2
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist75048700_EF1F_11D0_9888_006097DEACF9Count
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xa0
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xa3
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Application__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width100__FONT_face___Courier__size___2___color__white___B_Last_run_time__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width50__FONT_face___Courier__size___2___color__white___B_Run_count__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 1
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x4351b4
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], 1
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xa4
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xa3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xa0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0x9e
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call edi
test eax, eax
jne 0x41e64d
lea eax, [esp + 0x2c]
mov ecx, 0x440bc0
push eax
call fcn.004023a0
push str._networkcards.html
lea ecx, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x2e0], 0x1a5
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xa7
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xa8
je 0x41e435
mov edx, dword [esp + 0x24]
push 0x3001
push edx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41e437
xor edi, edi
push ecx
mov byte [esp + 0x2d8], 0xa7
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Network_Cards
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0xa9
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0xaa
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xa7
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xab
call fcn.00423f2c
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Service_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_Description__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width200__FONT_face___Courier__size___2___color__white___B_LastWrittenTime__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
push 2
push 0
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push 0x43f880
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d8], 0xac
call sub.MFC42u.DLL_CString::CString_1
push 3
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x2e4], 0xad
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x2e8], 0xae
call sub.MFC42u.DLL_CString::CString_4
mov byte [esp + 0x2e4], 0xad
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, esi
call fcn.0041f1e0
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x43728c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xaf
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xad
call sub.MFC42u.DLL_CString::CString
push 0x436f7c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xb0
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xad
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x1c], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xac
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0xab
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xa7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComputerDescriptions
push 0x80000001
call edi
test eax, eax
jne 0x41e8af
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.compdesc.html
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x2e0], 0x1b1
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xb3
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x2d4], 0xb4
je 0x41e6d7
mov ecx, dword [esp + 0x28]
push 0x3001
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41e6d9
xor edi, edi
lea edx, [esp + 0x5c]
mov eax, dword [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x304], 0xb3
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004232c0
push ecx
mov byte [esp + 0x2d8], 0xb5
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Machines_in_Network
call sub.MFC42u.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x2e0], 0xb6
call sub.MFC42u.DLL_CString::CString_4
push ecx
mov byte [esp + 0x2e0], 0xb7
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerComputerDescriptions
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xb5
call fcn.00417ae0
push 0x440958
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xb8
call fcn.00423f2c
push str._TH_HEIGHT30_width100__FONT_face___Courier__size___2___color__white___B_Machine_Name__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30_width300__FONT_face___Courier__size___2___color__white___B_Machine_Description__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [edi]
push 2
push 0
mov ecx, edi
call dword [edx + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0x40]
mov edx, dword [esp + 0x18]
push 6
push edi
push edx
mov ecx, esi
call fcn.00420740
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov eax, dword [esp + 0x18]
push eax
call ebx
push 0x43728c
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xb9
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xb8
call sub.MFC42u.DLL_CString::CString
push 0x437278
lea ecx, [esp + 0x14]
call fcn.00423f32
mov eax, dword [0x440bb0]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x440ba8
mov byte [esp + 0x2dc], 0xba
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xb8
call sub.MFC42u.DLL_CString::CString
mov dword [esi + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xb5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xb3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetEnumUSBSTOR
push 0x80000002
call edi
test eax, eax
jne 0x41eb6b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x440bc0
call fcn.004023a0
push str.usbdev.html
lea edx, [esp + 0x28]
push eax
push edx
mov dword [esp + 0x2e0], 0x1bb
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xbd
call sub.MFC42u.DLL_CString::CString
push 0x10
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 4
mov dword [esp + 0x30], edi
test edi, edi
mov byte [esp + 0x2d4], 0xbe
je 0x41e940
push 0x3001
lea ecx, [esp + 0x28]
call fcn.0041f1d0
push eax
mov ecx, edi
call sub.MFC42u.DLL_CFile::CFile_1
mov edi, eax
jmp 0x41e942
xor edi, edi
push 0x440958
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov byte [esp + 0x2d8], 0xbd
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2d8], 0xbf
mov ecx, esp
mov dword [esp + 0x34], esp
push str.USB_Devices
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0xc0
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0xc1
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKLMSystemCurrentControlSetEnumUSBSTOR
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
mov byte [esp + 0x2e4], 0xbf
call fcn.00417ae0
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x18]
call fcn.00423f2c
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Serial_no.__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_USBDevice_Name__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Mounted_Volume__B___FONT___TH_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_LastWrittenTime__B___FONT___TH___TR_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
mov ecx, edi
call fcn.0041f1b0
mov edi, dword [edi]
lea ecx, [esp + 0x14]
call fcn.0041f1c0
shl eax, 1
push eax
lea ecx, [esp + 0x18]
call fcn.0041f1d0
mov dword [esp + 0x40], edi
mov edi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x44]
mov ecx, edi
call dword [eax + 0x40]
push str.SystemCurrentControlSetEnumUSBSTOR
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push 0x43f880
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d8], 0xc2
call sub.MFC42u.DLL_CString::CString_1
push 4
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x2e4], 0xc3
call sub.MFC42u.DLL_CString::CString_4
mov byte [esp + 0x2e0], 0xc4
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e4], 0xc3
push ecx
mov ecx, esi
call fcn.0041f1e0
push edi
mov ecx, esi
call fcn.00417cb0
mov ecx, dword [ebp]
call fcn.00417050
mov edx, dword [esp + 0x18]
push edx
call ebx
push 0x43411c
lea ecx, [esp + 0x14]
mov dword [esi + 0x20], 1
call fcn.00423f32
lea eax, [esp + 0x10]
mov ecx, 0x440ba8
push eax
mov byte [esp + 0x2d8], 0xc5
call fcn.0041f180
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xc3
call sub.MFC42u.DLL_CString::CString
push 0x434110
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xc6
push ecx
mov ecx, 0x440ba8
call fcn.0041f180
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xc3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xc2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0xbf
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0xbd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d4], 7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xa8]
call fcn.004136e0
lea ecx, [esp + 0xa8]
mov dword [esp + 0x2d4], 0x1c7
call fcn.00413740
lea ecx, [esp + 0xa8]
call fcn.00413730
test eax, eax
mov dword [esp + 0x70], eax
je 0x41f095
lea edx, [esp + 0x2c]
mov ecx, 0x440bc0
push edx
call fcn.004023a0
push str.passwords.html
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x2dc], 0xc8
push eax
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2d4], 0xca
call sub.MFC42u.DLL_CString::CString
push 0x10
call fcn.0041f1a0
mov edi, eax
mov dword [esp + 0x30], edi
test edi, edi
mov byte [esp + 0x2d4], 0xcb
je 0x41ec11
push 0x3001
lea ecx, [esp + 0x48]
call fcn.0041f1d0
push eax
mov ecx, edi
call sub.MFC42u.DLL_CFile::CFile_1
mov ebx, eax
jmp 0x41ec13
xor ebx, ebx
push ecx
mov byte [esp + 0x2d8], 0xca
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x439480
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2dc], 0xcc
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x433a84
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x2e0], 0xcd
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.HKCUSoftwareMicrosoftProtected_Storage_System_Provider
call sub.MFC42u.DLL_CString::CString_1
push ebx
mov ecx, esi
mov byte [esp + 0x2e4], 0xca
call fcn.00417ae0
push str._TH_HEIGHT30_width75__FONT_face___Courier__size___2___color__white___B__center_S.No__center___B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_ItemName__B___FONT___TH_
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d8], 0xce
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_ItemType__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_UserName__B___FONT___TH_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
push str._TH_HEIGHT30__FONT_face___Courier__size___2___color__white___B_Password__B___FONT___TH___TR_
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::operator_1
mov ecx, ebx
call fcn.0041f1b0
mov edi, dword [ebx]
lea ecx, [esp + 0x1c]
call fcn.0041f1c0
shl eax, 1
push eax
lea ecx, [esp + 0x20]
call fcn.0041f1d0
push eax
mov ecx, ebx
call dword [edi + 0x40]
push str.AutoCompleteFields__Passwords
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xcf
push ecx
mov ecx, 0x440ba8
call fcn.0041f180
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xce
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp]
call fcn.00417050
mov dword [esi + 0x14], 1
mov edi, dword [esp + 0x70]
mov dword [esp + 0x58], 0
push edi
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::CString_4
lea edx, [edi + 4]
lea ecx, [esp + 0x28]
push edx
mov byte [esp + 0x2d8], 0xd0
call sub.MFC42u.DLL_CString::CString_4
lea eax, [edi + 8]
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x2d8], 0xd1
call sub.MFC42u.DLL_CString::CString_4
add edi, 0xc
lea ecx, [esp + 0x10]
push edi
mov byte [esp + 0x2d8], 0xd2
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0xd3
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x2d4], 0xd4
and ecx, 0x80000001
jns 0x41eda4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x41edad
push str._TR__height25_BGCOLOR_FFFFFF__
jmp 0x41edb2
push str._TR__height25_BGCOLOR_FFFFD9__
lea ecx, [esp + 0x18]
call fcn.00423f2c
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x48]
inc edi
mov dword [esp + 0x58], edi
call sub.MFC42u.DLL_CString::CString_3
push edi
lea edx, [esp + 0x4c]
push 0x43334c
push edx
mov byte [esp + 0x2e0], 0xd5
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x48]
lea ecx, [esp + 0x4c]
push eax
push str._TD__FONT_face_Courier__size___2___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
push 0x4386c4
lea edx, [esp + 0x40]
push eax
push edx
mov byte [esp + 0x2e0], 0xd6
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xd7
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d4], 0xd6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2d4], 0xd5
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x24]
lea ecx, [esp + 0x54]
push eax
push str._TD___FONT_face___Courier__face_Courier__size___1___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
push 0x4386c4
lea edx, [esp + 0x54]
push eax
push edx
mov byte [esp + 0x2e0], 0xd8
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xd9
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0xd8
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x2d4], 0xd5
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x28]
lea ecx, [esp + 0x90]
push eax
push str._TD___FONT_face___Courier__face_Courier__size___1___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
push 0x4386c4
lea edx, [esp + 0x6c]
push eax
push edx
mov byte [esp + 0x2e0], 0xda
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xdb
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x68]
mov byte [esp + 0x2d4], 0xda
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x90]
mov byte [esp + 0x2d4], 0xd5
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x20]
lea ecx, [esp + 0x40]
push eax
push str._TD__FONT_face___Courier__face_Courier__size___1___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
push 0x4386c4
lea edx, [esp + 0x60]
push eax
push edx
mov byte [esp + 0x2e0], 0xdc
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xdd
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x5c]
mov byte [esp + 0x2d4], 0xdc
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d4], 0xd5
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
push str._TD__FONT_face___Courier__face_Courier__size___1___colorblack_
push ecx
call sub.MFC42u.DLL_operator_2
push 0x438664
lea edx, [esp + 0x3c]
push eax
push edx
mov byte [esp + 0x2e0], 0xde
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2d8], 0xdf
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x38]
mov byte [esp + 0x2d4], 0xde
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x2d4], 0xd5
call sub.MFC42u.DLL_CString::CString
mov ecx, ebx
call fcn.0041f1b0
mov edi, dword [ebx]
lea ecx, [esp + 0x14]
call fcn.0041f1c0
shl eax, 1
push eax
lea ecx, [esp + 0x18]
call fcn.0041f1d0
push eax
mov ecx, ebx
call dword [edi + 0x40]
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x48]
mov edi, dword [eax + 0x10]
mov byte [esp + 0x2d4], 0xd4
mov dword [esp + 0x70], edi
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 0xd3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xd2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d4], 0xd1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 0xd0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d4], 0xce
call sub.MFC42u.DLL_CString::CString
test edi, edi
jne 0x41ed31
push ebx
mov ecx, esi
call fcn.00417cb0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2d4], 0xca
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d4], 0xc7
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x41f0b1
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41f0b1
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x41f0b1
mov eax, dword [esi + 0x20]
test eax, eax
je 0x41f0e7
push 0x43321c
lea ecx, [esp + 0x14]
call fcn.00423f32
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xe0
push ecx
mov ecx, 0x440ba8
call fcn.0041f180
lea ecx, [esp + 0x10]
mov byte [esp + 0x2d4], 0xc7
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp]
push 0x23
call fcn.00416fe0
mov ecx, dword [ebp]
mov edx, dword [ecx]
call dword [edx + 0x60]
mov dword [ebp], 0
lea ecx, [esp + 0xa8]
mov dword [esp + 0x2d4], 7
call fcn.00413720
lea ecx, [esp + 0x7c]
mov byte [esp + 0x2d4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2d4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x80]
mov byte [esp + 0x2d4], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x74]
mov dword [esp + 0x2d4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 0x2cc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c8
ret