Function at 0x401f5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x42911c
call fcn.0041bd3c
sub esp, 0x234
test byte [esp + 0x248], 1
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push edi
mov edi, ecx
je 0x402d79
test byte [edi], 1
jne 0x402d79
lea eax, [esp + 0x64]
push str._:text:KERNEL32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
and dword [esp + 0x24c], 0
cmp dword [eax + 0x14], 0x10
jb 0x401fb7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [edi + 8], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.0040165f
test esi, esi
je 0x402d79
call fcn.00406c75
cmp eax, 2
jae 0x401ffe
push str.Local1300
push 1
push 1
push 0
call ebp
test eax, eax
je 0x401ffe
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x40201b
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x64], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402054
mov esi, 0x1ae
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x1ae
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40202c
call fcn.00406c75
cmp eax, 3
jae 0x40206b
push str.Local972
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x402088
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x4020a5
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x4020a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x4020c6
push str.Local1307
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x4020c6
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402100
mov esi, 0x31c
jmp 0x4020db
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x31c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x4020d9
push str._:hash:CreateFileA
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:CreateFileMappingA
push dword [edi + 8]
mov dword [edi + 0x54], eax
call fcn.0040a0ba
push str._:hash:CreateFileMappingW
push dword [edi + 8]
mov dword [edi + 0x58], eax
call fcn.0040a0ba
push str._:hash:CreateFileW
push dword [edi + 8]
mov dword [edi + 0x5c], eax
call fcn.0040a0ba
push str._:hash:CreateProcessA
push dword [edi + 8]
mov dword [edi + 0x60], eax
call fcn.0040a0ba
push str._:hash:CreateProcessW
push dword [edi + 8]
mov dword [edi + 0x64], eax
call fcn.0040a0ba
push str._:hash:CreateRemoteThread
push dword [edi + 8]
mov dword [edi + 0x68], eax
call fcn.0040a0ba
push str._:hash:CreateToolhelp32Snapshot
push dword [edi + 8]
mov dword [edi + 0x6c], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x70], eax
call fcn.00406c75
cmp eax, 2
jae 0x40219f
push str.901901
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40219f
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x4021c6
push str.Global314
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4021c6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x4021df
push str.Local391
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402201
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 2
jae 0x40221c
push ecx
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x40221c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x40223e
push str.Local1321
push 1
push 1
push 0
call ebp
test eax, eax
je 0x40223e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x40225e
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str._:hash:ExpandEnvironmentStringsA
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:ExpandEnvironmentStringsW
push dword [edi + 8]
mov dword [edi + 0x74], eax
call fcn.0040a0ba
push str._:hash:FindFirstFileA
push dword [edi + 8]
mov dword [edi + 0x78], eax
call fcn.0040a0ba
push str._:hash:FindFirstFileW
push dword [edi + 8]
mov dword [edi + 0x7c], eax
call fcn.0040a0ba
push str._:hash:FindNextFileA
push dword [edi + 8]
mov dword [edi + 0x80], eax
call fcn.0040a0ba
push str._:hash:FindNextFileW
push dword [edi + 8]
mov dword [edi + 0x84], eax
call fcn.0040a0ba
push str._:hash:FlushInstructionCache
push dword [edi + 8]
mov dword [edi + 0x88], eax
call fcn.0040a0ba
push str._:hash:GetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x8c], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x90], eax
push str._:hash:GetCurrentConsoleFontEx
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:GetEnvironmentVariableA
push dword [edi + 8]
mov dword [edi + 0x94], eax
call fcn.0040a0ba
push str._:hash:GetEnvironmentVariableW
push dword [edi + 8]
mov dword [edi + 0x98], eax
call fcn.0040a0ba
push str._:hash:GetExitCodeProcess
push dword [edi + 8]
mov dword [edi + 0x9c], eax
call fcn.0040a0ba
push str._:hash:GetFullPathNameA
push dword [edi + 8]
mov dword [edi + 0xa0], eax
call fcn.0040a0ba
push str._:hash:GetFullPathNameW
push dword [edi + 8]
mov dword [edi + 0xa4], eax
call fcn.0040a0ba
push str._:hash:GetLogicalDriveStringsA
push dword [edi + 8]
mov dword [edi + 0xa8], eax
call fcn.0040a0ba
push str._:hash:GetLogicalDriveStringsW
push dword [edi + 8]
mov dword [edi + 0xac], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0xb0], eax
push str._:hash:GetModuleFileNameA
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:GetModuleFileNameW
push dword [edi + 8]
mov dword [edi + 0xb4], eax
call fcn.0040a0ba
push str._:hash:GetModuleHandleA
push dword [edi + 8]
mov dword [edi + 0xb8], eax
call fcn.0040a0ba
push str._:hash:GetModuleHandleExA
push dword [edi + 8]
mov dword [edi + 0xbc], eax
call fcn.0040a0ba
push str._:hash:GetModuleHandleExW
push dword [edi + 8]
mov dword [edi + 0xc0], eax
call fcn.0040a0ba
add esp, 0x28
mov dword [edi + 0xc4], eax
call fcn.00406c75
cmp eax, 2
jae 0x40240a
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x60], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402443
mov esi, 0x3a8
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x3a8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40241b
call fcn.00406c75
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 2
jae 0x40245e
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ecx
call esi
call fcn.00406c75
cmp eax, 2
jae 0x40247f
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40247f
push eax
mov byte [eax + 1], 0x17
call fcn.0040c4f8
pop ecx
push str._:hash:GetModuleHandleW
push dword [edi + 8]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0xc8], eax
call fcn.00406c75
cmp eax, 3
jae 0x4024ad
push str.Local648
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x4024c6
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0
call esi
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4024e6
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x402502
push str.227227
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402502
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x402524
push str.Local1339
push 1
push 1
push 0
call ebp
test eax, eax
je 0x402524
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x40253d
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0
call esi
push str._:hash:GetSystemWow64DirectoryA
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:GetSystemWow64DirectoryW
push dword [edi + 8]
mov dword [edi + 0xcc], eax
call fcn.0040a0ba
push str._:hash:GetTickCount64
push dword [edi + 8]
mov dword [edi + 0xd0], eax
call fcn.0040a0ba
push str._:hash:GetVersionExA
push dword [edi + 8]
mov dword [edi + 0xd4], eax
call fcn.0040a0ba
push str._:hash:GetVersionExW
push dword [edi + 8]
mov dword [edi + 0xd8], eax
call fcn.0040a0ba
push str._:hash:GetVolumeInformationA
push dword [edi + 8]
mov dword [edi + 0xdc], eax
call fcn.0040a0ba
add esp, 0x30
mov dword [edi + 0xe0], eax
call fcn.00406c75
cmp eax, 2
jae 0x4025d4
push str.Local1342
push 1
push 1
push 0
call ebp
test eax, eax
je 0x4025d4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x4025f3
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x4025f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x40260f
push str.390390
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40260f
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x402628
push str.Local91
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x402641
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x58], 0
call esi
call fcn.00406c75
cmp eax, 2
jae 0x40265d
push str.748748
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40265d
push eax
call ebx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402697
mov esi, 0x3e7
jmp 0x402672
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x402670
call fcn.00406c75
cmp eax, 2
jae 0x4026b3
push str.679679
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4026b3
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x4026cc
push str.Local275
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402706
mov esi, 0x3df
jmp 0x4026e1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x3df
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x4026df
push str._:hash:GetVolumeInformationW
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:IsBadReadPtr
push dword [edi + 8]
mov dword [edi + 0xe4], eax
call fcn.0040a0ba
push str._:hash:IsBadWritePtr
push dword [edi + 8]
mov dword [edi + 0xe8], eax
call fcn.0040a0ba
push str._:hash:IsWow64Process
push dword [edi + 8]
mov dword [edi + 0xec], eax
call fcn.0040a0ba
push str._:hash:LoadLibraryA
push dword [edi + 8]
mov dword [edi + 0xf0], eax
call fcn.0040a0ba
push str._:hash:LoadLibraryW
push dword [edi + 8]
mov dword [edi + 0xf4], eax
call fcn.0040a0ba
push str._:hash:MapViewOfFile
push dword [edi + 8]
mov dword [edi + 0xf8], eax
call fcn.0040a0ba
push str._:hash:Module32First
push dword [edi + 8]
mov dword [edi + 0xfc], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x100], eax
push str._:hash:Module32FirstW
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:Module32Next
push dword [edi + 8]
mov dword [edi + 0x104], eax
call fcn.0040a0ba
push str._:hash:Module32NextW
push dword [edi + 8]
mov dword [edi + 0x108], eax
call fcn.0040a0ba
push str._:hash:OpenFileMappingA
push dword [edi + 8]
mov dword [edi + 0x10c], eax
call fcn.0040a0ba
push str._:hash:OpenFileMappingW
push dword [edi + 8]
mov dword [edi + 0x110], eax
call fcn.0040a0ba
add esp, 0x28
mov dword [edi + 0x114], eax
call fcn.00406c75
cmp eax, 3
jae 0x40282a
push str.Global332
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40282a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x40284a
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x40286b
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40286b
push eax
mov byte [eax + 1], 0x88
call fcn.0040c4f8
pop ecx
push str._:hash:OpenProcess
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:OpenThread
push dword [edi + 8]
mov dword [edi + 0x118], eax
call fcn.0040a0ba
push str._:hash:Process32First
push dword [edi + 8]
mov dword [edi + 0x11c], eax
call fcn.0040a0ba
push str._:hash:Process32FirstW
push dword [edi + 8]
mov dword [edi + 0x120], eax
call fcn.0040a0ba
push str._:hash:Process32Next
push dword [edi + 8]
mov dword [edi + 0x124], eax
call fcn.0040a0ba
push str._:hash:Process32NextW
push dword [edi + 8]
mov dword [edi + 0x128], eax
call fcn.0040a0ba
push str._:hash:ProcessIdToSessionId
push dword [edi + 8]
mov dword [edi + 0x12c], eax
call fcn.0040a0ba
push str._:hash:QueryDosDeviceA
push dword [edi + 8]
mov dword [edi + 0x130], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x134], eax
push str._:hash:QueryDosDeviceW
push dword [edi + 8]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0x138], eax
call fcn.00406c75
cmp eax, 3
jae 0x402934
push str.Local804
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x402956
push str.Local1362
push 1
push 1
push 0
call ebp
test eax, eax
je 0x402956
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402990
mov esi, 0xb6
jmp 0x40296b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0xb6
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x402969
call fcn.00406c75
cmp eax, 2
jae 0x4029ac
push str.934934
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4029ac
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x4029c5
push str.Local752
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4029fa
push 0x46
pop esi
jmp 0x4029d8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x46
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x4029d6
push str._:hash:ReadProcessMemory
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:SetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x13c], eax
call fcn.0040a0ba
push str._:hash:SetCurrentConsoleFontEx
push dword [edi + 8]
mov dword [edi + 0x140], eax
call fcn.0040a0ba
push str._:hash:TerminateProcess
push dword [edi + 8]
mov dword [edi + 0x144], eax
call fcn.0040a0ba
push str._:hash:VerifyVersionInfoA
push dword [edi + 8]
mov dword [edi + 0x148], eax
call fcn.0040a0ba
push str._:hash:VerifyVersionInfoW
push dword [edi + 8]
mov dword [edi + 0x14c], eax
call fcn.0040a0ba
push str._:hash:VerSetConditionMask
push dword [edi + 8]
mov dword [edi + 0x150], eax
call fcn.0040a0ba
add esp, 0x38
mov dword [edi + 0x154], eax
call fcn.00406c75
cmp eax, 3
jae 0x402a9b
push str.Local480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402ad4
mov esi, 0x2f4
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x402aac
call fcn.00406c75
cmp eax, 2
jae 0x402aef
push ecx
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x402aef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x402b0c
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x402b0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402b45
mov esi, 0x1c0
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x1c0
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x402b1d
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x402b7d
mov esi, 0x2c5
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2c5
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x402b55
call fcn.00406c75
push 2
pop esi
cmp eax, esi
jae 0x402ba0
push str.Local1378
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x402ba0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 3
jae 0x402bc7
push str.Global407
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x402bc7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, esi
jae 0x402be5
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x402be5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:VirtualAlloc
push dword [edi + 8]
call fcn.0040a0ba
push str._:hash:VirtualAllocEx
push dword [edi + 8]
mov dword [edi + 0x158], eax
call fcn.0040a0ba
push str._:hash:VirtualProtect
push dword [edi + 8]
mov dword [edi + 0x15c], eax
call fcn.0040a0ba
push str._:hash:VirtualProtectEx
push dword [edi + 8]
mov dword [edi + 0x160], eax
call fcn.0040a0ba
push str._:hash:VirtualQuery
push dword [edi + 8]
mov dword [edi + 0x164], eax
call fcn.0040a0ba
push str._:hash:WriteProcessMemory
push dword [edi + 8]
mov dword [edi + 0x168], eax
call fcn.0040a0ba
push str._:hash:Wow64DisableWow64FsRedirection
push dword [edi + 8]
mov dword [edi + 0x16c], eax
call fcn.0040a0ba
push str._:hash:Wow64RevertWow64FsRedirection
push dword [edi + 8]
mov dword [edi + 0x170], eax
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x174], eax
push str._:hash:WTSGetActiveConsoleSessionId
push dword [edi + 8]
call fcn.0040a0ba
pop ecx
pop ecx
xor ecx, ecx
mov dword [edi + 0x178], eax
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x402cb7
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 3
jae 0x402cce
push str.Local347
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, esi
jae 0x402cee
push str.Local1385
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x402cee
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 3
jae 0x402d07
push str.Local621
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, esi
jae 0x402d22
push str.413413
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402d22
push eax
call ebx
call fcn.00406c75
cmp eax, esi
jae 0x402d3d
push str.743743
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402d3d
push eax
call ebx
call fcn.00406c75
cmp eax, esi
jae 0x402d5d
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x402d5d
push eax
mov byte [eax + 1], 0xc9
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 3
jae 0x402d76
push str.Local325
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
or dword [edi], 1
test byte [esp + 0x258], 2
je 0x40390b
test byte [edi], 2
jne 0x40390b
lea eax, [esp + 0x94]
push str._:text:ADVAPI32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 1
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0xc], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x94]
call fcn.0040165f
test esi, esi
je 0x40390b
push str._:hash:AccessCheck
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x17c], eax
xor eax, eax
mov byte [esp + 0x1b], al
pop ecx
pop ecx
cmp byte [esp + 0x13], al
je 0x402e26
mov esi, 0x1d4
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x1d4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x402dfe
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x402e47
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x402e66
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x402e82
push str.435435
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402e82
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x402e9f
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x402e9f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x402ec0
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x402ec0
push eax
mov byte [eax + 1], 0xde
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x402edd
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x402efe
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x402efe
push eax
mov byte [eax + 1], 0x69
call fcn.0040c4f8
pop ecx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402f32
push 0x68
pop esi
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x68
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x402f0d
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x402f6b
mov esi, 0x35b
jmp 0x402f46
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x35b
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x402f44
push str._:hash:AdjustTokenPrivileges
push dword [edi + 0xc]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0x180], eax
call fcn.00406c75
cmp eax, 2
jae 0x402f9d
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x402fbd
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x402fd9
push str.477477
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402fd9
push eax
call ebx
push str._:hash:AllocateAndInitializeSid
push dword [edi + 0xc]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0x184], eax
call fcn.00406c75
cmp eax, 2
jae 0x40300a
push str.501501
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40300a
push eax
call ebx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x403043
mov esi, 0x2a5
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2a5
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40301b
call fcn.00406c75
cmp eax, 3
jae 0x40305a
push str.Local585
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:ChangeServiceConfigA
push dword [edi + 0xc]
call fcn.0040a0ba
push str._:hash:ChangeServiceConfigW
push dword [edi + 0xc]
mov dword [edi + 0x188], eax
call fcn.0040a0ba
push str._:hash:CheckTokenMembership
push dword [edi + 0xc]
mov dword [edi + 0x18c], eax
call fcn.0040a0ba
push str._:hash:CloseServiceHandle
push dword [edi + 0xc]
mov dword [edi + 0x190], eax
call fcn.0040a0ba
push str._:hash:ControlService
push dword [edi + 0xc]
mov dword [edi + 0x194], eax
call fcn.0040a0ba
push str._:hash:ConvertSidToStringSidA
push dword [edi + 0xc]
mov dword [edi + 0x198], eax
call fcn.0040a0ba
push str._:hash:ConvertSidToStringSidW
push dword [edi + 0xc]
mov dword [edi + 0x19c], eax
call fcn.0040a0ba
add esp, 0x38
mov dword [edi + 0x1a0], eax
call fcn.00406c75
cmp eax, 3
jae 0x4030fb
push str.Local914
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x403118
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorA
push dword [edi + 0xc]
call fcn.0040a0ba
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorW
push dword [edi + 0xc]
mov dword [edi + 0x1a4], eax
call fcn.0040a0ba
push str._:hash:ConvertStringSidToSidA
push dword [edi + 0xc]
mov dword [edi + 0x1a8], eax
call fcn.0040a0ba
mov dword [edi + 0x1ac], eax
xor eax, eax
mov byte [esp + 0x2b], al
add esp, 0x18
cmp byte [esp + 0x13], al
je 0x403174
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x403195
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403195
push eax
mov byte [eax + 1], 0xdf
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 3
jae 0x4031ae
push str.Local379
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x4031ca
push str.501501
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4031ca
push eax
call ebx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x403203
mov esi, 0x3aa
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x3aa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x4031db
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x403224
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 3
jae 0x40323b
push str.Local65
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x403258
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x403258
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x403274
push str.785785
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403274
push eax
call ebx
push str._:hash:ConvertStringSidToSidW
push dword [edi + 0xc]
call fcn.0040a0ba
push str._:hash:CreateProcessAsUserA
push dword [edi + 0xc]
mov dword [edi + 0x1b0], eax
call fcn.0040a0ba
push str._:hash:CreateProcessAsUserW
push dword [edi + 0xc]
mov dword [edi + 0x1b4], eax
call fcn.0040a0ba
add esp, 0x18
mov dword [edi + 0x1b8], eax
call fcn.00406c75
cmp eax, 2
jae 0x4032cc
push str.874874
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4032cc
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x4032e9
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x40331d
push 0x72
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x72
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x4032f8
call fcn.00406c75
cmp eax, 3
jae 0x403343
push str.Global317
push ecx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403343
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x403360
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x403360
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 3
jae 0x403387
push str.Global273
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403387
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x4033a0
push str.Local11
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x4033c2
push str.Local1443
push 1
push 1
push 0
call ebp
test eax, eax
je 0x4033c2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:CreateServiceA
push dword [edi + 0xc]
call fcn.0040a0ba
push str._:hash:CreateServiceW
push dword [edi + 0xc]
mov dword [edi + 0x1bc], eax
call fcn.0040a0ba
push str._:hash:DeleteService
push dword [edi + 0xc]
mov dword [edi + 0x1c0], eax
call fcn.0040a0ba
push str._:hash:DuplicateToken
push dword [edi + 0xc]
mov dword [edi + 0x1c4], eax
call fcn.0040a0ba
mov dword [edi + 0x1c8], eax
push str._:hash:DuplicateTokenEx
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1cc], eax
push str._:hash:FreeSid
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1d0], eax
push str._:hash:GetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1d4], eax
push str._:hash:GetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x1d8], eax
push str._:hash:GetSecurityInfo
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1dc], eax
push str._:hash:GetTokenInformation
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1e0], eax
push str._:hash:GetUserNameA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1e4], eax
push str._:hash:GetUserNameW
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x1e8], eax
call fcn.00406c75
cmp eax, 2
jae 0x4034cd
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x4034cd
push eax
mov byte [eax + 1], 0xaa
call fcn.0040c4f8
pop ecx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403507
mov esi, 0x26b
jmp 0x4034e2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x26b
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x4034e0
call fcn.00406c75
cmp eax, 2
jae 0x403523
push str.985985
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403523
push eax
call ebx
push str._:hash:ImpersonateLoggedOnUser
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1ec], eax
push str._:hash:ImpersonateSelf
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1f0], eax
push str._:hash:InitializeSecurityDescriptor
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1f4], eax
push str._:hash:IsValidSid
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1f8], eax
push str._:hash:LookupAccountSidA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x1fc], eax
push str._:hash:LookupAccountSidW
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x30
mov dword [edi + 0x200], eax
call fcn.00406c75
cmp eax, 3
jae 0x4035b1
push str.Local522
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x4035d8
push str.Global786
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4035d8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x4035fa
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 3
jae 0x403611
push str.Local705
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x40362a
push str.Local946
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:LookupPrivilegeValueA
push dword [edi + 0xc]
call fcn.0040a0ba
pop ecx
pop ecx
xor ecx, ecx
mov dword [edi + 0x204], eax
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x403661
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x403699
mov esi, 0x27a
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x27a
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x403671
call fcn.00406c75
cmp eax, 2
jae 0x4036ba
push str.Local1455
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x4036ba
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x4036d6
push str.9191
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4036d6
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x4036f7
push str.Local1457
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x4036f7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x40372b
push 0x29
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x29
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x403706
call fcn.00406c75
cmp eax, 2
jae 0x40374a
push str.Local1460
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x40374a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:LookupPrivilegeValueW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x208], eax
push str._:hash:OpenProcessToken
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x20c], eax
push str._:hash:OpenSCManagerA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x210], eax
push str._:hash:OpenSCManagerW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x214], eax
push str._:hash:OpenServiceA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x218], eax
push str._:hash:OpenServiceW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x21c], eax
push str._:hash:OpenThreadToken
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x220], eax
push str._:hash:QueryServiceStatus
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x224], eax
push str._:hash:RegisterServiceCtrlHandlerA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x228], eax
push str._:hash:RegisterServiceCtrlHandlerW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x22c], eax
push str._:hash:RegDeleteKeyExA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x230], eax
push str._:hash:RegDeleteKeyExW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x234], eax
push str._:hash:RevertToSelf
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x238], eax
push str._:hash:SetEntriesInAclA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x23c], eax
push str._:hash:SetEntriesInAclW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x240], eax
push str._:hash:SetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x244], eax
push str._:hash:SetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x248], eax
push str._:hash:SetSecurityInfo
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x24c], eax
push str._:hash:SetServiceStatus
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x250], eax
push str._:hash:StartServiceA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x254], eax
push str._:hash:StartServiceCtrlDispatcherA
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x258], eax
push str._:hash:StartServiceCtrlDispatcherW
push dword [edi + 0xc]
call fcn.0040a0ba
mov dword [edi + 0x25c], eax
push str._:hash:StartServiceW
push dword [edi + 0xc]
call fcn.0040a0ba
add esp, 0x38
mov dword [edi + 0x260], eax
or dword [edi], 2
test byte [esp + 0x258], 0x10
je 0x40398a
test byte [edi], 0x10
jne 0x40398a
lea eax, [esp + 0x214]
push str._:text:SECUR32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 2
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x28], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x214]
call fcn.0040165f
test esi, esi
je 0x40398a
push str._:hash:GetUserNameExA
push dword [edi + 0x28]
call fcn.0040a0ba
mov dword [edi + 0x3c4], eax
push str._:hash:GetUserNameExW
push dword [edi + 0x28]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x3c8], eax
or dword [edi], 0x10
mov eax, 0x400
test dword [esp + 0x258], eax
je 0x403cf7
test dword [edi], eax
jne 0x403cf7
lea eax, [esp + 0xc4]
push str._:text:WS2_32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 3
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x10], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0xc4]
call fcn.0040165f
test esi, esi
je 0x403cf7
push str._:hash:WSAStartup
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x264], eax
push str._:hash:WSACleanup
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x268], eax
push str._:hash:WSAGetLastError
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x26c], eax
push str._:hash:getaddrinfo
push dword [edi + 0x10]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x270], eax
call fcn.00406c75
cmp eax, 2
jae 0x403a57
push str.176176
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403a57
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x403a79
push str.Local1464
push 1
push 1
push 0
call ebp
test eax, eax
je 0x403a79
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403a99
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x403aba
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403aba
push eax
mov byte [eax + 1], 0x79
call fcn.0040c4f8
pop ecx
push str._:hash:freeaddrinfo
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x274], eax
push str._:hash:socket
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x278], eax
push str._:hash:connect
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x27c], eax
push str._:hash:send
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x280], eax
push str._:hash:sendto
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x284], eax
push str._:hash:recv
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x288], eax
push str._:hash:select
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x28c], eax
xor eax, eax
mov byte [esp + 0x4b], al
add esp, 0x38
cmp byte [esp + 0x13], al
je 0x403b76
push 0x53
pop esi
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x53
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x403b51
call fcn.00406c75
cmp eax, 2
jae 0x403b97
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403b97
push eax
mov byte [eax + 1], 2
call fcn.0040c4f8
pop ecx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403bb9
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x403bec
push 0x1b
pop esi
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x1b
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x403bc7
call fcn.00406c75
cmp eax, 2
jae 0x403c0d
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403c0d
push eax
mov byte [eax + 1], 0x80
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x403c29
push str.747747
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403c29
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x403c4a
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403c4a
push eax
mov byte [eax + 1], 0x6a
call fcn.0040c4f8
pop ecx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403c83
mov esi, 0x221
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x221
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x403c5b
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x403ca2
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str._:hash:shutdown
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x290], eax
push str._:hash:closesocket
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x294], eax
push str._:hash:setsockopt
push dword [edi + 0x10]
call fcn.0040a0ba
mov dword [edi + 0x298], eax
push str._:hash:htons
push dword [edi + 0x10]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x29c], eax
or dword [edi], 0x400
mov eax, 0x800
test dword [esp + 0x258], eax
je 0x4041af
test dword [edi], eax
jne 0x4041af
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403d31
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x403d4d
push str.776776
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403d4d
push eax
call ebx
call fcn.00406c75
xor esi, esi
cmp eax, 3
jae 0x403d75
push str.Global197
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403d75
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x403d8c
push str.Local881
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x403da5
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x403dc6
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403dc6
push eax
mov byte [eax + 1], 0x81
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 3
jae 0x403ddd
push str.Local18
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x403df4
push str.Local468
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x403e15
push str.Local1493
push 1
push 1
push esi
call ebp
test eax, eax
je 0x403e15
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x403e36
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x403e36
push eax
mov byte [eax + 1], 0x82
call fcn.0040c4f8
pop ecx
lea eax, [esp + 0x184]
push str._:text:WININET.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 4
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x14], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x184]
call fcn.0040165f
test esi, esi
je 0x4041af
call fcn.00406c75
cmp eax, 2
jae 0x403ea0
push str.Local1495
push 1
push 1
push 0
call ebp
test eax, eax
je 0x403ea0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403ec0
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str._:hash:InternetOpenA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2a0], eax
push str._:hash:InternetOpenW
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2a4], eax
push str._:hash:InternetConnectA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2a8], eax
push str._:hash:InternetConnectW
push dword [edi + 0x14]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x2ac], eax
call fcn.00406c75
cmp eax, 3
jae 0x403f36
push str.Global642
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403f36
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x403f56
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str._:hash:HttpOpenRequestA
push dword [edi + 0x14]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0x2b0], eax
call fcn.00406c75
cmp eax, 3
jae 0x403f84
push str.Local474
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x403fab
push str.Global499
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403fab
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x403fcc
push str.Local1510
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x403fcc
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x403fe8
push str.540540
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403fe8
push eax
call ebx
call fcn.00406c75
xor esi, esi
cmp eax, 2
jae 0x404007
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x404007
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x404023
push str.377377
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x404023
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404044
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x404044
push eax
mov byte [eax + 1], 0x43
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x404061
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x404061
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 3
jae 0x404087
push str.Global498
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404087
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x40409e
push str.Local580
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x4040b5
push str.Local229
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x4040d2
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x4040d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:HttpOpenRequestW
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2b4], eax
push str._:hash:HttpSendRequestA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2b8], eax
push str._:hash:HttpSendRequestW
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2bc], eax
push str._:hash:HttpQueryInfoA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2c0], eax
push str._:hash:HttpQueryInfoW
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2c4], eax
push str._:hash:InternetCloseHandle
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2c8], eax
push str._:hash:InternetCrackUrlA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2cc], eax
push str._:hash:InternetCrackUrlW
push dword [edi + 0x14]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x2d0], eax
push str._:hash:InternetSetOptionA
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2d4], eax
push str._:hash:InternetSetOptionW
push dword [edi + 0x14]
call fcn.0040a0ba
mov dword [edi + 0x2d8], eax
push str._:hash:InternetReadFile
push dword [edi + 0x14]
call fcn.0040a0ba
add esp, 0x18
mov dword [edi + 0x2dc], eax
or dword [edi], 0x800
test byte [esp + 0x258], 4
je 0x404ccc
test byte [edi], 4
jne 0x404ccc
lea eax, [esp + 0xf4]
push str._:text:USER32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 5
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x20], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0xf4]
call fcn.0040165f
test esi, esi
je 0x404ccc
push str._:hash:AppendMenuW
push dword [edi + 0x20]
call fcn.0040a0ba
pop ecx
pop ecx
xor ecx, ecx
mov dword [edi + 0x2e0], eax
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x40425c
mov esi, 0x316
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x316
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x404234
call fcn.00406c75
cmp eax, 3
jae 0x404282
push str.Global543
push ecx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404282
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4042bc
mov esi, 0x17f
jmp 0x404297
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x17f
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x404295
push str._:hash:BringWindowToTop
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2e4], eax
push str._:hash:CallNextHookEx
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2e8], eax
push str._:hash:CheckMenuItem
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2ec], eax
push str._:hash:CloseDesktop
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2f0], eax
push str._:hash:CreateDesktopW
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x28
mov dword [edi + 0x2f4], eax
call fcn.00406c75
cmp eax, 3
jae 0x404345
push str.Global602
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404345
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x40435e
push str.Local312
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x404397
mov esi, 0x14c
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x14c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40436f
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x4043b8
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 2
jae 0x4043d5
push ecx
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x4043d5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x4043f2
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x404426
push 0x50
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x50
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x404401
call fcn.00406c75
cmp eax, 2
jae 0x404447
push str.Local1536
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x404447
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x404463
push str.640640
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x404463
push eax
call ebx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x40449c
mov esi, 0x32c
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x32c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x404474
call fcn.00406c75
cmp eax, 2
jae 0x4044bd
push str.Local1539
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x4044bd
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x4044de
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x4044de
push eax
mov byte [eax + 1], 0x8e
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x4044fa
push str.347347
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4044fa
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x40451b
push str.Local1542
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x40451b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:CreatePopupMenu
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2f8], eax
push str._:hash:CreateWindowExW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x2fc], eax
push str._:hash:DefWindowProcW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x300], eax
push str._:hash:DestroyWindow
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x304], eax
push str._:hash:DispatchMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x308], eax
push str._:hash:EnumWindows
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x30c], eax
push str._:hash:FindWindowA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x310], eax
push str._:hash:FindWindowW
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x314], eax
push str._:hash:GetClientRect
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x318], eax
xor eax, eax
mov byte [esp + 0x1b], al
pop ecx
pop ecx
cmp byte [esp + 0x13], al
je 0x4045eb
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x40460c
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40460c
push eax
mov byte [eax + 1], 0xbf
call fcn.0040c4f8
pop ecx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x404640
push 0x2b
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2b
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40461b
call fcn.00406c75
cmp eax, 2
jae 0x40465d
push ecx
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x40465d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetCursorPos
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x31c], eax
push str._:hash:GetDesktopWindow
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x320], eax
push str._:hash:GetDlgItem
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x18
mov dword [edi + 0x324], eax
call fcn.00406c75
cmp eax, 2
jae 0x4046bb
push str.Local1549
push 1
push 1
push 0
call ebp
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x4046dc
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x4046dc
push eax
mov byte [eax + 1], 0x3b
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x4046fd
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x4046fd
push eax
mov byte [eax + 1], 0xe
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x404719
push str.617617
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x404719
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404736
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:GetLastInputInfo
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x328], eax
push str._:hash:GetMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x32c], eax
push str._:hash:GetParent
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x330], eax
push str._:hash:GetSystemMetrics
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x334], eax
push str._:hash:GetThreadDesktop
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x338], eax
push str._:hash:GetWindowRect
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x30
mov dword [edi + 0x33c], eax
call fcn.00406c75
cmp eax, 3
jae 0x4047c4
push str.Local789
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4047e4
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x404805
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x404805
push eax
mov byte [eax + 1], 0xd9
call fcn.0040c4f8
pop ecx
push str._:hash:GetWindowTextA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x340], eax
push str._:hash:GetWindowTextW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x344], eax
push str._:hash:GetWindowThreadProcessId
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x348], eax
push str._:hash:LoadIconW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x34c], eax
push str._:hash:MessageBoxA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x350], eax
push str._:hash:MessageBoxW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x354], eax
push str._:hash:MsgWaitForMultipleObjects
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x358], eax
push str._:hash:PeekMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x35c], eax
call fcn.00406c75
cmp eax, 3
jae 0x4048c7
push str.Global507
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4048c7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x4048e8
push str.Local1560
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x4048e8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 3
jae 0x404901
push str.Local951
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x404928
push str.Global609
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404928
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x404944
push str.805805
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x404944
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404966
push str.Local1566
push 1
push 1
push 0
call ebp
test eax, eax
je 0x404966
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4049a0
mov esi, 0x390
jmp 0x40497b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x390
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x404979
call fcn.00406c75
cmp eax, 2
jae 0x4049c1
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x4049c1
push eax
mov byte [eax + 1], 0xc8
call fcn.0040c4f8
pop ecx
push str._:hash:PostMessageA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x360], eax
push str._:hash:PostMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x364], eax
push str._:hash:PostQuitMessage
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x368], eax
push str._:hash:RedrawWindow
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x36c], eax
push str._:hash:RegisterClassExW
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x28
mov dword [edi + 0x370], eax
call fcn.00406c75
cmp eax, 3
jae 0x404a3c
push str.Local301
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x404a75
mov esi, 0x8e
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x8e
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x404a4d
call fcn.00406c75
cmp eax, 2
jae 0x404a96
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x404a96
push eax
mov byte [eax + 1], 0x22
call fcn.0040c4f8
pop ecx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x404acf
mov esi, 0xf3
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0xf3
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x404aa7
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x404aee
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, 2
jae 0x404b0c
push str.337337
call esi
test eax, eax
je 0x404b0c
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x404b33
push str.Global641
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404b33
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:RegisterWindowMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x374], eax
push str._:hash:SendMessageA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x378], eax
push str._:hash:SendMessageW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x37c], eax
push str._:hash:SetFocus
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x380], eax
push str._:hash:SetForegroundWindow
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x384], eax
push str._:hash:SetThreadDesktop
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x388], eax
push str._:hash:SetWindowPos
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x38
mov dword [edi + 0x38c], eax
call fcn.00406c75
cmp eax, 2
jae 0x404bd3
push str.578578
call esi
test eax, eax
je 0x404bd3
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404bf2
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x404bf2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x404c11
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x404c11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x404c29
push str.378378
call esi
test eax, eax
je 0x404c29
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404c41
push str.3030
call esi
test eax, eax
je 0x404c41
push eax
call ebx
push str._:hash:SetWindowsHookExA
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x390], eax
push str._:hash:SetWindowsHookExW
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x394], eax
push str._:hash:ShowWindow
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x398], eax
push str._:hash:TrackPopupMenu
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x39c], eax
push str._:hash:TranslateMessage
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x3a0], eax
push str._:hash:UnhookWindowsHookEx
push dword [edi + 0x20]
call fcn.0040a0ba
mov dword [edi + 0x3a4], eax
push str._:hash:UpdateWindow
push dword [edi + 0x20]
call fcn.0040a0ba
add esp, 0x38
mov dword [edi + 0x3a8], eax
or dword [edi], 4
test byte [esp + 0x258], 8
je 0x404e8a
test byte [edi], 8
jne 0x404e8a
lea eax, [esp + 0x1e4]
push str._:text:SHELL32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 6
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x24], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x1e4]
call fcn.0040165f
test esi, esi
je 0x404e8a
push str._:hash:Shell_NotifyIconW
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3ac], eax
push str._:hash:ShellExecuteExA
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3b0], eax
push str._:hash:ShellExecuteExW
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3b4], eax
push str._:hash:SHGetFolderPathA
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3b8], eax
push str._:hash:SHGetFolderPathW
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3bc], eax
push str._:hash:SHGetKnownFolderPath
push dword [edi + 0x24]
call fcn.0040a0ba
mov dword [edi + 0x3c0], eax
or dword [edi], 8
add esp, 0x30
call fcn.00406c75
cmp eax, 3
jae 0x404dca
push str.Global176
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404dca
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x404de9
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x404de9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x404e0a
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x404e0a
push eax
mov byte [eax + 1], 0x6a
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 3
jae 0x404e31
push str.Global102
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x404e31
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x404e4e
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x404e4e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x404e6b
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x404e8a
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x404e8a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [esp + 0x258], 0x20
je 0x404f36
test byte [edi], 0x20
jne 0x404f36
lea eax, [esp + 0x124]
push str._:text:MSHTML.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 7
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x18], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x124]
call fcn.0040165f
test esi, esi
je 0x404f36
call fcn.00406c75
cmp eax, 2
jae 0x404f01
push str.882882
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x404f01
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x404f1e
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:ShowHTMLDialog
push dword [edi + 0x18]
call fcn.0040a0ba
pop ecx
mov dword [edi + 0x3cc], eax
or dword [edi], 0x20
pop ecx
test byte [esp + 0x258], 0x40
je 0x404fb5
test byte [edi], 0x40
jne 0x404fb5
lea eax, [esp + 0x1b4]
push str._:text:URLMON.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 8
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x1c], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x1b4]
call fcn.0040165f
test esi, esi
je 0x404fb5
push str._:hash:CreateURLMoniker
push dword [edi + 0x1c]
call fcn.0040a0ba
mov dword [edi + 0x3d0], eax
push str._:hash:CreateURLMonikerEx
push dword [edi + 0x1c]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x3d4], eax
or dword [edi], 0x40
test byte [esp + 0x258], 0x80
je 0x405037
test byte [edi], 0x80
jne 0x405037
lea eax, [esp + 0x154]
push str._:text:GDI32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 9
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x2c], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x154]
call fcn.0040165f
test esi, esi
je 0x405037
push str._:hash:GetStockObject
push dword [edi + 0x2c]
call fcn.0040a0ba
mov dword [edi + 0x3d8], eax
push str._:hash:CreateFontW
push dword [edi + 0x2c]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x3dc], eax
or dword [edi], 0x80
mov eax, pe_nt_image_headers32
test dword [esp + 0x258], eax
je 0x40531f
test dword [edi], eax
jne 0x40531f
lea eax, [esp + 0x7c]
push str._:text:OLE32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xa
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x30], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.0040165f
test esi, esi
je 0x40531f
push str._:hash:CoCreateInstance
push dword [edi + 0x30]
call fcn.0040a0ba
pop ecx
pop ecx
xor ecx, ecx
mov dword [edi + 0x3e0], eax
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x4050ca
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 2
jae 0x4050e9
push str.Local1598
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x4050e9
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x405122
mov esi, 0x258
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop eax
dec esi
jne 0x4050fa
push str._:hash:CoInitialize
push dword [edi + 0x30]
call fcn.0040a0ba
mov dword [edi + 0x3e4], eax
push str._:hash:CoInitializeEx
push dword [edi + 0x30]
call fcn.0040a0ba
mov dword [edi + 0x3e8], eax
push str._:hash:CoUninitialize
push dword [edi + 0x30]
call fcn.0040a0ba
mov dword [edi + 0x3ec], eax
push str._:hash:CoCreateGuid
push dword [edi + 0x30]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x3f0], eax
call fcn.00406c75
cmp eax, 2
jae 0x40518d
push str.465465
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40518d
push eax
call ebx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x4051af
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x4051d0
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 3
jae 0x4051e7
push str.Local651
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 3
jae 0x40520e
push str.Global410
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40520e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x405230
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.00406c75
cmp eax, 2
jae 0x40524d
push ecx
push 1
push 1
push ecx
call ebp
test eax, eax
je 0x40524d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x40526f
push str.Local1610
push 1
push 1
push 0
call ebp
test eax, eax
je 0x40526f
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x405290
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x405290
push eax
mov byte [eax + 1], 0x64
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x4052ad
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 3
jae 0x4052d4
push str.Global38
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4052d4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x4052f0
push str.153153
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4052f0
push eax
call ebx
push str._:hash:CoTaskMemFree
push dword [edi + 0x30]
call fcn.0040a0ba
mov dword [edi + 0x3f4], eax
push str._:hash:StringFromGUID2
push dword [edi + 0x30]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x3f8], eax
or dword [edi], 0x100
mov eax, 0x200
test dword [esp + 0x258], eax
je 0x4054dd
test dword [edi], eax
jne 0x4054dd
lea eax, [esp + 0xac]
push str._:text:OLEAUT32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xb
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x34], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0xac]
call fcn.0040165f
test esi, esi
je 0x4054dd
push str._:hash:VariantClear
push dword [edi + 0x34]
call fcn.0040a0ba
mov dword [edi + 0x3fc], eax
push str._:hash:VariantInit
push dword [edi + 0x34]
call fcn.0040a0ba
mov dword [edi + 0x400], eax
push str._:hash:VariantChangeType
push dword [edi + 0x34]
call fcn.0040a0ba
mov dword [edi + 0x404], eax
push str._:hash:SysAllocString
push dword [edi + 0x34]
call fcn.0040a0ba
mov dword [edi + 0x408], eax
push str._:hash:SysFreeString
push dword [edi + 0x34]
call fcn.0040a0ba
mov dword [edi + 0x40c], eax
or dword [edi], 0x200
add esp, 0x28
call fcn.00406c75
cmp eax, 3
jae 0x405410
push str.Global199
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x405410
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x405432
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x40546b
mov esi, 0x8f
jmp 0x405446
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x8f
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x405444
call fcn.00406c75
cmp eax, 2
jae 0x40548c
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40548c
push eax
mov byte [eax + 1], 0x19
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x4054a8
push str.768768
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4054a8
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x4054c4
push 0x42d1c8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4054c4
push eax
call ebx
call fcn.00406c75
cmp eax, 3
jae 0x4054dd
push str.Local488
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov eax, 0x1000
test dword [esp + 0x258], eax
je 0x40560b
test dword [edi], eax
jne 0x40560b
lea eax, [esp + 0xdc]
push str._:text:VERSION.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xc
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x38], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0xdc]
call fcn.0040165f
test esi, esi
je 0x40560b
push str._:hash:GetFileVersionInfoSizeA
push dword [edi + 0x38]
call fcn.0040a0ba
mov dword [edi + 0x414], eax
push str._:hash:GetFileVersionInfoSizeW
push dword [edi + 0x38]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x418], eax
call fcn.00406c75
cmp eax, 3
jae 0x40558f
push str.Global32
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40558f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 3
jae 0x4055b6
push str.Global4
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4055b6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetFileVersionInfoA
push dword [edi + 0x38]
call fcn.0040a0ba
mov dword [edi + 0x41c], eax
push str._:hash:GetFileVersionInfoW
push dword [edi + 0x38]
call fcn.0040a0ba
mov dword [edi + 0x420], eax
push str._:hash:VerQueryValueA
push dword [edi + 0x38]
call fcn.0040a0ba
mov dword [edi + 0x424], eax
push str._:hash:VerQueryValueW
push dword [edi + 0x38]
call fcn.0040a0ba
add esp, 0x20
mov dword [edi + 0x428], eax
or dword [edi], 0x1000
mov esi, 0x2000
test dword [esp + 0x258], esi
je 0x405905
test dword [edi], esi
jne 0x405905
lea eax, [esp + 0x10c]
push str._:text:PSAPI.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xd
push eax
mov ecx, edi
call fcn.0040606c
test eax, eax
mov dword [edi + 0x3c], eax
sete bl
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x10c]
call fcn.0040165f
test bl, bl
je 0x4056aa
lea eax, [esp + 0x13c]
push str._:text:KERNEL32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xe
push eax
mov ecx, edi
call fcn.0040606c
mov dword [edi + 0x3c], eax
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x13c]
call fcn.0040165f
cmp dword [edi + 0x3c], 0
je 0x4058ff
push str._:hash:EnumProcesses
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x448], eax
push str._:hash:EnumProcessModules
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x44c], eax
push str._:hash:GetProcessMemoryInfo
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x450], eax
push str._:hash:GetModuleBaseNameA
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x454], eax
push str._:hash:GetModuleBaseNameW
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x458], eax
push str._:hash:GetModuleFileNameExA
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x45c], eax
push str._:hash:GetModuleFileNameExW
push dword [edi + 0x3c]
call fcn.0040a0ba
mov dword [edi + 0x460], eax
push str._:hash:GetProcessImageFileNameA
push dword [edi + 0x3c]
call fcn.0040a0ba
add esp, 0x40
mov dword [edi + 0x464], eax
call fcn.00406c75
cmp eax, 2
jae 0x405770
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x405770
push eax
mov byte [eax + 1], 0x61
call fcn.0040c4f8
pop ecx
xor ebx, ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x4057a9
mov esi, 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x405781
mov esi, 0x2000
call fcn.00406c75
cmp eax, 3
jae 0x4057cf
push 0x42d3ac
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4057cf
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetProcessImageFileNameW
push dword [edi + 0x3c]
call fcn.0040a0ba
pop ecx
mov dword [edi + 0x468], eax
or dword [edi], esi
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x405805
push str.Local1640
push ebx
push ebx
push ebx
call ebp
test eax, eax
je 0x405805
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x405821
push ebx
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x405853
mov esi, 0x2e8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x405830
call fcn.00406c75
cmp eax, 3
jae 0x40586a
push str.Local477
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00406c75
cmp eax, 2
jae 0x40588b
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40588b
push eax
mov byte [eax + 1], 0xa6
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x4058af
push str.789789
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
je 0x4058b5
push eax
call ebx
jmp 0x4058b5
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00406c75
cmp eax, 3
jae 0x4058dc
push str.Global883
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4058dc
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x405905
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x405905
push eax
mov byte [eax + 1], 0x90
call fcn.0040c4f8
pop ecx
jmp 0x405905
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 0x4000
test dword [esp + 0x258], eax
je 0x405976
test dword [edi], eax
jne 0x405976
lea eax, [esp + 0x16c]
push str._:text:IPHLPAPI.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0xf
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x40], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x16c]
call fcn.0040165f
test esi, esi
je 0x405976
push str._:hash:GetAdaptersInfo
push dword [edi + 0x40]
call fcn.0040a0ba
pop ecx
mov dword [edi + 0x410], eax
or dword [edi], 0x4000
pop ecx
mov eax, 0x8000
test dword [esp + 0x258], eax
je 0x405b91
test dword [edi], eax
jne 0x405b91
lea eax, [esp + 0x19c]
push str._:text:USERENV.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0x10
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x44], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x19c]
call fcn.0040165f
test esi, esi
je 0x405b91
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x4059fa
push 0
push 0
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.00406c75
cmp eax, 2
jae 0x405a17
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 3
jae 0x405a3e
push str.Global804
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x405a3e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x405a5a
push str.175175
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x405a5a
push eax
call ebx
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x405a94
mov esi, 0x111
jmp 0x405a6f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x111
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x405a6d
call fcn.00406c75
cmp eax, 2
jae 0x405ab0
push str.583583
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x405ab0
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x405ad2
push str.Local1663
push 1
push 1
push 0
call ebp
test eax, eax
je 0x405ad2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 3
jae 0x405af9
push str.Global740
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x405af9
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x405b16
xor eax, eax
push eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x405b16
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:CreateEnvironmentBlock
push dword [edi + 0x44]
call fcn.0040a0ba
mov dword [edi + 0x42c], eax
push str._:hash:DestroyEnvironmentBlock
push dword [edi + 0x44]
call fcn.0040a0ba
mov dword [edi + 0x430], eax
push str._:hash:LoadUserProfileW
push dword [edi + 0x44]
call fcn.0040a0ba
mov dword [edi + 0x434], eax
push str._:hash:LoadUserProfileA
push dword [edi + 0x44]
call fcn.0040a0ba
mov dword [edi + 0x438], eax
push str._:hash:UnloadUserProfileW
push dword [edi + 0x44]
call fcn.0040a0ba
mov dword [edi + 0x43c], eax
push str._:hash:UnloadUserProfileA
push dword [edi + 0x44]
call fcn.0040a0ba
add esp, 0x30
mov dword [edi + 0x440], eax
or dword [edi], 0x8000
mov eax, 0x10000
test dword [esp + 0x258], eax
je 0x405c02
test dword [edi], eax
jne 0x405c02
lea eax, [esp + 0x1cc]
push str._:text:WTSAPI32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0x11
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x48], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x1cc]
call fcn.0040165f
test esi, esi
je 0x405c02
push str._:hash:WTSQueryUserToken
push dword [edi + 0x48]
call fcn.0040a0ba
pop ecx
mov dword [edi + 0x444], eax
or dword [edi], 0x10000
pop ecx
mov eax, 0x20000
test dword [esp + 0x258], eax
je 0x405dec
test dword [edi], eax
jne 0x405dec
lea eax, [esp + 0x1fc]
push str._:text:NETAPI32.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0x12
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x4c], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x1fc]
call fcn.0040165f
test esi, esi
je 0x405dec
call fcn.00406c75
cmp eax, 2
jae 0x405c83
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x405c83
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x405cbc
mov esi, 0x2c3
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2c3
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x405c94
call fcn.00406c75
cmp eax, 2
jae 0x405cdb
push str.Local1670
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x405cdb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
xor esi, esi
cmp eax, 2
jae 0x405cf6
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x405d13
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x405d13
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c75
cmp eax, 2
jae 0x405d2f
push str.665665
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x405d2f
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x405d50
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x405d50
push eax
mov byte [eax + 1], 0x37
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x405d6d
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x405d6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x405da6
mov esi, 0x137
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x137
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x405d7e
call fcn.00406c75
cmp eax, 3
jae 0x405dbd
push str.Local477
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:NetUserGetInfo
push dword [edi + 0x4c]
call fcn.0040a0ba
mov dword [edi + 0x46c], eax
push str._:hash:NetApiBufferFree
push dword [edi + 0x4c]
call fcn.0040a0ba
add esp, 0x10
mov dword [edi + 0x470], eax
or dword [edi], 0x20000
mov eax, 0x40000
test dword [esp + 0x258], eax
je 0x40604d
test dword [edi], eax
jne 0x40604d
lea eax, [esp + 0x22c]
push str._:text:IEFRAME.dll
push eax
call fcn.00408f85
pop ecx
pop ecx
mov dword [esp + 0x24c], 0x13
push eax
mov ecx, edi
call fcn.0040606c
mov esi, eax
mov dword [edi + 0x50], esi
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x22c]
call fcn.0040165f
test esi, esi
je 0x40604d
push str._:hash:IERegisterWritableRegistryKey
push dword [edi + 0x50]
call fcn.0040a0ba
pop ecx
pop ecx
mov dword [edi + 0x474], eax
call fcn.00406c75
cmp eax, 2
jae 0x405e7f
push str.729729
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x405e7f
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x405ea1
push str.Local1683
push 1
push 1
push 0
call ebp
test eax, eax
je 0x405ea1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x405ec2
push str.Local1684
xor eax, eax
push eax
push eax
push eax
call ebp
test eax, eax
je 0x405ec2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x405efb
mov esi, 0x17c
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x17c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x405ed3
call fcn.00406c75
cmp eax, 2
jae 0x405f16
push ecx
push ecx
push ecx
push ecx
call ebp
test eax, eax
je 0x405f16
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:IERegisterWritableRegistryValue
push dword [edi + 0x50]
call fcn.0040a0ba
mov dword [edi + 0x478], eax
push str._:hash:IEGetWriteableHKCU
push dword [edi + 0x50]
call fcn.0040a0ba
mov dword [edi + 0x47c], eax
push str._:hash:IEIsProtectedModeProcess
push dword [edi + 0x50]
call fcn.0040a0ba
xor ecx, ecx
mov dword [edi + 0x480], eax
mov byte [esp + 0x2b], cl
add esp, 0x18
cmp byte [esp + 0x13], cl
je 0x405f86
push 0x2d
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x2d
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x405f61
call fcn.00406c75
cmp eax, 3
jae 0x405fac
push str.Global700
push ecx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x405fac
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00406c75
cmp eax, 2
jae 0x405fcd
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x405fcd
push eax
mov byte [eax + 1], 0x56
call fcn.0040c4f8
pop ecx
call fcn.00406c75
cmp eax, 2
jae 0x405fea
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00406c75
cmp eax, 2
jae 0x40600c
push str.Local1694
push 1
push 1
push 0
call ebp
test eax, eax
je 0x40600c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00406c75
cmp eax, 2
jae 0x406028
push str.249249
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x406028
push eax
call ebx
call fcn.00406c75
cmp eax, 2
jae 0x406047
push 0
push 1
push 1
push 0
call ebp
test eax, eax
je 0x406047
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0x40000
mov eax, dword [edi]
mov ecx, dword [esp + 0x244]
and eax, dword [esp + 0x258]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 4