Function at 0x408f58
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x22
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4ba]
mov esi, 0x42c88e
push ebx
sub esp, 0x58c
rep movsb byte es:[edi], byte [esi]
cmp byte [eax + str.Failed_to_open_database], 0
je 0x408fb8
inc eax
cmp eax, 0xff6
jne 0x408f78
mov eax, dword [0x428f28]
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 0xc], eax
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
or dword [0x428f28], 0x79ba651
sub dword [0x4291b4], 0x225f58cc
sub dword [0x428f28], 0x6ddcc5ac
mov dword [esp], str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
call fcn.0040f2ac
xor eax, eax
cmp byte [eax + str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.], 0
je 0x408ffa
inc eax
cmp eax, 0x20e7
jne 0x408fda
mov eax, dword [0x4291b4]
or eax, 0xafb8502b
mov dword [0x428f28], eax
lea edi, [ebp - 0x421]
mov esi, str.The_device_is_pending_further_configuration.
xor ebx, ebx
mov ecx, 0x2d
rep movsb byte es:[edi], byte [esi]
sub dword [0x4291b4], 0x69b0ed10
and dword [0x428f28], 0xced98dcb
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov eax, dword [0x428f28]
or eax, 0x64bfaa91
mov dword [0x4291b4], eax
add eax, 0x4be92365
mov dword [0x428f28], eax
call fcn.00410fb0
and dword [0x428f28], 0xaa9050ac
mov edx, str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov ecx, 0xd8e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40908c
add ecx, eax
cmp ecx, 0x23e5
jbe 0x409068
call fcn.00413c50
add dword [0x428f28], 0x1cb11b8c
add dword [0x428f28], 0x2780ff5b
mov dword [esp], str.Below_is_a_list_of_potentially_leaked_heap_entries
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x4291b4]
mov byte [ebp + ebx - 0x318], bl
inc ebx
xor eax, 0x5aec1c08
mov dword [0x428f28], eax
cmp ebx, 0x100
jne 0x40905e
xor edi, edi
xor ecx, ecx
mov esi, 0x2c
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x318]
div esi
movzx eax, byte [ebp + edx - 0x421]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov byte [ebp + edi - 0x318], bl
cmp ecx, 0x100
jne 0x4090cc
call dword [sym.imp.USER32.dll_GetShellWindow]
xor edi, edi
xor esi, esi
xor ebx, ebx
or eax, 0xd9dd0721
mov dword [0x428f28], eax
mov dword [ebp - 0x560], 0x20a9
inc ebx
mov ecx, str.Application_Full_Path
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
mov byte [ebp - 0x55c], al
add eax, esi
movzx esi, al
mov eax, dword [0x4291b4]
lea edx, [eax + 0x389fc8e9]
mov dword [0x4291b4], edx
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x4091aa
add dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0x2565
jbe 0x409155
mov eax, dword [0x428f28]
add eax, 0x6c68875e
mov dword [0x428f28], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
mov eax, dword [0x4291b4]
xor eax, 0x7faff7b2
jmp 0x4091b1
mov eax, edx
and eax, 0x4db699fd
mov cl, byte [ebp + esi - 0x318]
mov dword [0x4291b4], eax
mov eax, dword [0x428f28]
mov byte [ebp + ebx - 0x318], cl
mov cl, byte [ebp - 0x55c]
and eax, 0x39719d92
mov byte [ebp + esi - 0x318], cl
mov dl, byte [ebp + ebx - 0x318]
mov dword [0x428f28], eax
add edx, ecx
movzx edx, dl
mov dl, byte [ebp + edx - 0x318]
xor dl, byte [ebp + edi - 0x4ba]
movzx edx, dl
mov word [ebp + edi*2 - 0x3f4], dx
inc edi
cmp edi, 0x22
jne 0x40911f
or eax, 0x9c2ae9e8
lea edi, [ebp - 0x4fb]
mov esi, 0x42c8dd
mov word [ebp - 0x3b0], 0
imul eax, eax, 0x97d2a4f7
mov ecx, 0x13
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x44a]
mov esi, str.Cached_page_was_locked_during_operation.
mov ecx, 0x29
rep movsb byte es:[edi], byte [esi]
sub eax, 0x6b9180d
xor eax, 0x111bcb83
mov edx, eax
sub eax, 0x5435cbe6
and edx, 0x89d6d6fe
mov dword [0x428f28], eax
mov dword [0x4291b4], edx
call fcn.00412e60
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x409270
xor edi, edi
xor ecx, ecx
mov esi, 0x28
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x218]
div esi
movzx eax, byte [ebp + edx - 0x44a]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + ecx - 0x218], al
inc ecx
mov byte [ebp + edi - 0x218], bl
cmp ecx, 0x100
jne 0x409288
xor edi, edi
xor esi, esi
xor ebx, ebx
mov eax, dword [0x428f28]
or eax, 0xce179434
mov dword [0x4291b4], eax
xor eax, eax
cmp byte [eax + str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.], 0
je 0x4092fc
inc eax
cmp eax, 0x4bc
jne 0x4092dc
call fcn.0040f0d0
add dword [0x428f28], 0x516f6ba1
imul eax, dword [0x428f28], 0xe35c804d
inc ebx
movzx ebx, bl
mov dword [0x4291b4], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov al, byte [ebp + ebx - 0x218]
mov byte [ebp - 0x55c], al
add eax, esi
movzx esi, al
xor eax, eax
cmp byte [eax + str.Failed_to_open_database], 0
je 0x409349
inc eax
cmp eax, 0x14de
jne 0x409329
call fcn.00411b4c
add dword [0x4291b4], 0x69e7d1a
mov eax, dword [0x4291b4]
mov edx, eax
and eax, 0xac11c76b
or edx, 0xc5e19e1b
or eax, 0x8401860b
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov edx, eax
mov dword [ebp - 0x564], eax
or edx, 0x25ac3b96
mov dword [0x4291b4], edx
mov dword [ebp - 0x560], edx
call fcn.00411470
mov eax, dword [ebp - 0x564]
mov edx, dword [ebp - 0x560]
and eax, 0x55bca632
or eax, 0x5ac2212
mov dword [0x428f28], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
imul eax, dword [0x4291b4], 0x7cf498b2
xor eax, 0xc4d89f30
mov dword [0x428f28], eax
call fcn.00413efc
mov eax, dword [0x4291b4]
add eax, 0x6ed66c77
mov dword [0x428f28], eax
call fcn.0041205c
mov al, byte [ebp + esi - 0x218]
mov byte [ebp + ebx - 0x218], al
mov al, byte [ebp - 0x55c]
mov byte [ebp + esi - 0x218], al
add al, byte [ebp + ebx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [ebp + edi - 0x4fb]
movzx eax, al
mov word [ebp + edi*2 - 0x498], ax
inc edi
cmp edi, 0x13
jne 0x4092cb
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [0x428f28]
lea edi, [ebp - 0x472]
xor ebx, ebx
mov word [ebp - 0x472], 0
mov esi, 0x42c919
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
sub eax, 0x7108a6d0
lea edi, [ebp - 0x4d1]
mov esi, 0x42c941
imul eax, eax, 0x7b2e65a9
mov ecx, 0x17
rep movsb byte es:[edi], byte [esi]
mov dword [0x4291b4], eax
xor eax, eax
cmp word [eax + str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64], 0
je 0x4094b2
add eax, 2
cmp eax, 0x4c50
jne 0x40948f
mov eax, dword [0x4291b4]
or eax, 0x2cf85630
mov dword [0x428f28], eax
mov eax, dword [0x428f28]
or eax, 0x793c1c7b
mov dword [0x4291b4], eax
call fcn.00413c50
mov byte [ebp + ebx - 0x118], bl
inc ebx
cmp ebx, 0x100
jne 0x40948d
xor edi, edi
xor ecx, ecx
mov esi, 0x16
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x4d1]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x4094df
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], bl
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [esi + ebp - 0x472]
movzx eax, al
mov word [ebp + esi*2 - 0x368], ax
inc esi
cmp esi, 0x28
jne 0x409522
mov eax, dword [0x428f28]
add eax, 0x4006e957
mov dword [0x4291b4], eax
call fcn.00413efc
mov eax, dword [0x4291b4]
xor eax, 0x75a03cb5
mov dword [0x428f28], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsIconic]
push ebx
mov eax, dword [0x4291b4]
mov ebx, 4
xor eax, 0x3d6f2b76
mov dword [0x428f28], eax
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov eax, dword [0x4291b4]
mov dword [esp], eax
call fcn.00411510
or dword [0x4291b4], 0x67fb2097
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, dword [0x4291b4]
mov word [ebp - 0x318], 0
or eax, 0x1c6f11c9
mov dword [0x428f28], eax
call fcn.00412e60
mov eax, dword [0x4291b4]
or eax, 0x9e258db2
mov dword [0x428f28], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.Application_Full_Path
call fcn.00410ad8
mov eax, dword [0x4291b4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
and eax, 0x3a36fa9f
or eax, 0x34aa0f
mov dword [0x428f28], eax
mov dword [esp], str.FreeEncryptedFileKeyInfo
call edi
push esi
mov dword [esp], str.FreeEncryptedFileKeyInfo
call edi
push eax
and dword [0x428f28], 0x6dcb8d69
mov dword [ebp - 0x55c], 0xe1c
mov esi, str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
movzx eax, word [esi]
test ax, ax
je 0x409740
add dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x1c7d
jbe 0x4096fc
call fcn.00410fb0
and dword [0x428f28], 0xa1629f2f
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call fcn.00411b4c
mov eax, dword [0x428f28]
sub eax, 0x7db1bd75
mov dword [0x4291b4], eax
call dword [sym.imp.USER32.dll_AnyPopup]
imul eax, eax, 0x628ee0c9
add eax, 0x606ca9b9
mov dword [0x428f28], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.Failed_to_open_database
call fcn.00410ad8
jmp 0x409740
xor eax, eax
cmp byte [eax + str.Application_Full_Path], 0
je 0x40971e
inc eax
cmp eax, 0xb88
jne 0x4096fe
call fcn.00411b4c
xor dword [0x428f28], 0x989a26c8
mov eax, dword [0x428f28]
add esi, 2
add eax, 0x7da6e04b
imul eax, eax, 0x735e44b6
mov dword [0x428f28], eax
call fcn.00413efc
jmp 0x409681
call fcn.00411b4c
add dword [0x428f28], 0x17e41777
mov dword [esp], str.Failed_to_open_database
call edi
push ecx
mov eax, dword [0x428f28]
mov edx, eax
and eax, 0x11330ec8
or eax, 0x310000
or edx, 0x48fdd023
add eax, 0x586a0417
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
dec ebx
jne 0x409672
mov dword [0x428f28], 0xfe9bfffe
mov edx, str.Failed_to_open_database
mov ecx, 0x1e81
movsx eax, byte [edx]
inc edx
test al, al
je 0x4097b7
add ecx, eax
cmp ecx, 0x2085
jbe 0x40979b
mov dword [0x428f28], 0xc9b6ad3a
mov eax, dword [0x428f28]
lea edx, [eax - 0x61cfda04]
add eax, 0x38022ee6
or eax, 0xa75c8357
mov dword [0x428f28], edx
mov dword [0x4291b4], eax
call fcn.00410fb0
mov eax, dword [0x4291b4]
add eax, 0x187847e5
mov edx, eax
xor eax, 0x726e3555
xor edx, 0xc07d1120
or eax, 0x1b99b85a
mov dword [0x428f28], edx
mov dword [0x4291b4], eax
call fcn.0040f0d0
mov eax, dword [0x4291b4]
and eax, 0xbff299b6
xor eax, 0xf16b4e1a
mov dword [0x4291b4], eax
add eax, 0x4bbf5cd
mov dword [0x428f28], eax
call fcn.0041205c
mov eax, dword [0x428f28]
sub eax, 0x262239c9
imul eax, eax, 0x5c358884
mov edx, eax
mov dword [0x428f28], eax
xor edx, 0x9267c3a4
mov dword [0x4291b4], edx
xor edx, edx
cmp word [edx + edx + str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64], 0
je 0x409895
inc edx
cmp edx, 0x16ea
jne 0x409850
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
mov eax, dword [0x4291b4]
xor eax, 0xa4224b78
mov dword [0x428f28], eax
jmp 0x40989d
cmp edx, 0x108d
jle 0x4098a9
mov dword [esp], str.Application_Full_Path
call fcn.0040f2ac
mov eax, dword [0x4291b4]
lea edi, [ebp - 0x4e8]
mov esi, str._vO_
xor eax, 0x50b06e51
and eax, 0x754dd172
mov edx, eax
add eax, 0x41bc0da5
or edx, 0x69b4b0fe
mov dword [0x428f28], eax
mov dword [0x4291b4], edx
mov dword [esp + 4], str.Failed_to_open_database
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov ecx, 5
imul eax, dword [0x4291b4], 0xfdeb8f5d
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov dword [0x428f28], eax
xor eax, eax
cmp byte [eax + str.Failed_to_open_database], 0
je 0x40993f
inc eax
cmp eax, 0x2096
jne 0x40990b
mov dword [esp + 4], str.Failed_to_open_database
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov eax, dword [0x4291b4]
add eax, 0x7b079eea
mov dword [0x428f28], eax
mov eax, dword [0x428f28]
sub eax, 0x1683a842
mov dword [0x428f28], eax
and eax, 0xfd320270
mov dword [0x4291b4], eax
call fcn.00412e60
sub edi, dword [ebp + esi*4 - 0x4e8]
inc esi
mov dword [ebp - 0x55c], edi
cmp esi, 5
jne 0x409909
mov eax, dword [0x428f28]
mov esi, 0xeb3
lea edx, [eax - 0x449ae0d7]
and eax, 0xf404e437
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
call fcn.00411b4c
mov eax, dword [0x428f28]
xor dword [0x4291b4], 0x7e70976d
add eax, 0x29e3ea63
mov dword [0x428f28], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], eax
call fcn.00411510
mov ecx, str.Failed_to_open_database
imul eax, dword [0x428f28], 0x89bec7ab
mov dword [0x428f28], eax
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4099ec
add esi, edx
cmp esi, 0x17b2
jbe 0x4099da
xor eax, 0x13ffb75b
mov dword [0x4291b4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
mov eax, dword [0x428f28]
or eax, 0xb96dd9b1
mov dword [0x4291b4], eax
call fcn.00410fb0
mov eax, dword [0x4291b4]
add eax, 0x381cb1c0
xor eax, 0x8f06391b
mov dword [0x4291b4], eax
call fcn.00413c50
mov eax, dword [0x4291b4]
lea edx, [eax + 0x3146dd49]
sub eax, 0x3466fb8c
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea eax, [ebp - 0x3f4]
add dword [0x428f28], 0x47f21db7
mov dword [esp + 4], eax
lea eax, [ebp - 0x540]
mov dword [esp], eax
call fcn.0040d000
cmp word [ebx + str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64], 0
je 0x409aa0
add ebx, 2
cmp ebx, 0x3e48
jne 0x409a86
call fcn.0041205c
mov eax, dword [0x428f28]
lea ebx, [ebp - 0x538]
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x3ac]
imul edx, eax, 0xa29979ce
imul eax, eax, 0x9dc208b7
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.Failed_to_open_database
call fcn.00410ad8
imul eax, dword [0x4291b4], 0x2c138eb9
mov dword [0x428f28], eax
lea eax, [ebp - 0x498]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040d000
lea eax, [ebp - 0x368]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040d000
xor eax, eax
mov dword [ebp - 0x54c], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x540]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov eax, dword [0x416104]
call dword [eax + 0x18]
sub esp, 0x2c
mov dword [esp], str.Failed_to_open_database
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x11
xor eax, eax
push edx
mov edx, str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [ebp - 0x3b0], 0x48
rep stosd dword es:[edi], eax
mov ecx, 0x82e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x409bb4
add ecx, eax
cmp ecx, 0x1136
jbe 0x409b9a
call fcn.00411470
mov eax, dword [0x4291b4]
and eax, 0x877f595d
mov dword [0x428f28], eax
mov dword [esp], 0x34
call fcn.0040c7e4
mov ebx, eax
xor eax, eax
cmp byte [eax + str.Application_Full_Path], 0
je 0x409bf0
inc eax
cmp eax, 0x1b40
jne 0x409bd3
mov dword [esp], str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
call fcn.0040f2ac
mov eax, dword [0x428f28]
or eax, 0x17f01b35
mov dword [0x4291b4], eax
call fcn.00410fb0
imul eax, dword [0x4291b4], 0xa0f5ea05
mov dword [0x428f28], eax
call fcn.00411470
movzx eax, word [ebp - 0x540]
mov dword [ebx], 0x34
mov dword [ebx + 4], 0x20005
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebx + 0x18], 8
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x544], 0x1000
or eax, 0x20010
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x548]
mov dword [ebx + 0x1c], eax
call fcn.0040b5a0
mov dword [ebp - 0x55c], eax
test eax, eax
je 0x40a00a
inc eax
je 0x40a00a
mov eax, dword [0x428f28]
mov dword [esp + 0xc], eax
mov edx, dword [0x4291b4]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str.Application_Full_Path
call fcn.00413018
mov eax, dword [0x4291b4]
and dword [0x428f28], 0x6b393c3d
or eax, 0x6ffb09e8
sub eax, 0x7149713
mov dword [0x4291b4], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], eax
call fcn.00411510
xor eax, eax
cmp byte [eax + str.Application_Full_Path], 0
je 0x409cf8
inc eax
cmp eax, 0x2077
jne 0x409cdd
and dword [0x4291b4], 0x32927705
imul eax, dword [0x4291b4], 0xf47cc234
lea edi, [ebp - 0x51c]
mov dword [0x428f28], eax
or eax, 0x2d4b5ef1
mov dword [0x4291b4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, 0x6d5e2253
mov dword [0x428f28], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [esp + 4], str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov eax, dword [0x4291b4]
lea edx, [eax - 0x19c77efb]
add eax, 0x44461f97
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
call fcn.00410fb0
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov eax, dword [0x4291b4]
lea esi, [eax - 0x2e5a35c3]
mov dword [0x4291b4], esi
and esi, 0xac584cc8
call fcn.00411470
mov dword [0x428f28], esi
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
mov eax, dword [0x4291b4]
lea esi, [eax - 0x2e5a35c3]
call fcn.00411470
and esi, 0xac584cc8
mov ecx, 4
xor esi, 0x52c89157
imul esi, esi, 0xd9013120
mov dword [0x4291b4], esi
mov esi, 0x4161e0
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov eax, dword [0x4291b4]
mov edx, eax
or edx, 0x810d29db
mov dword [0x428f28], edx
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], eax
call fcn.00411510
sub edi, dword [ebp + esi*4 - 0x51c]
inc esi
mov dword [ebp - 0x560], edi
cmp esi, 4
jne 0x409de3
mov edx, dword [0x428f28]
xor esi, esi
mov dword [ebp - 0x528], 0x45
mov edi, 0xb
mov dword [ebp - 0x524], 0x48
mov dword [ebp - 0x520], 0xffffff7d
mov eax, edx
xor eax, 0x14f5f9d
sub eax, 0x50e18bb7
mov dword [0x4291b4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], edx
mov dword [esp + 4], str.Application_Full_Path
call fcn.00413018
mov eax, dword [0x428f28]
imul edx, eax, 0xbbfd7798
imul eax, eax, 0x336e1358
mov dword [0x428f28], edx
mov dword [0x4291b4], eax
xor eax, eax
cmp byte [eax + str.Failed_to_open_database], 0
je 0x409edd
inc eax
cmp eax, 0x2578
jne 0x409e93
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
call fcn.00410ad8
imul eax, dword [0x4291b4], 0x9fc5c1c9
mov dword [0x4291b4], eax
mov dword [esp], 0x1163
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x428f28]
add eax, 0x7ab578cb
mov dword [0x4291b4], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
call fcn.00410ad8
sub edi, dword [ebp + esi*4 - 0x528]
inc esi
mov edx, edi
cmp esi, 3
jne 0x409e91
mov eax, dword [0x428f28]
lea edi, [ebp - 0x50c]
mov esi, 0x4161f0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, 0x1c
or eax, 0xef069f7e
sub eax, 0x436ed35e
mov dword [0x428f28], eax
xor eax, 0xd9595e7d
imul eax, eax, 0x58601565
add edi, dword [ebp + ecx*4 - 0x50c]
inc ecx
or eax, 0x6bba95ee
mov esi, edi
cmp ecx, 4
jne 0x409f51
test edx, edx
mov ecx, dword [ebp - 0x560]
mov dword [0x4291b4], eax
mov edi, 0xa6e
setne dl
movzx edx, dl
or ecx, 0x40000
shl edx, 0x11
or edx, ecx
mov ecx, str.Indicates_that_the_directory_trying_to_be_deleted_is_not_empty.
mov dword [ebx + 0x24], edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x409fe0
add edi, edx
cmp edi, 0x215b
jbe 0x409f90
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
mov eax, dword [0x4291b4]
or eax, 0xf57bcdb3
mov dword [0x428f28], eax
call fcn.0040f0d0
sub dword [0x4291b4], 0x714756c8
mov eax, dword [0x4291b4]
shl esi, 4
sub eax, 0x1f70b93a
mov dword [0x428f28], eax
call fcn.00413efc
mov eax, dword [ebp - 0x55c]
mov dword [ebx + esi + 8], 4
mov dword [ebx + 0x2c], eax
jmp 0x40a00d
sub dword [ebx], 0x10
mov dword [esp + 0x28], ebx
xor ecx, ecx
mov edi, str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov esi, 0x566
lea eax, [ebp - 0x3b0]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x54c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x2000000
mov dword [esp + 8], 0x2000000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00401097
mov dword [ebp - 0x560], eax
movzx eax, word [edi]
test ax, ax
je 0x40a0fc
add esi, eax
mov eax, dword [0x4291b4]
cmp esi, 0x113e
jbe 0x40a0b9
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00412380
mov eax, dword [0x4291b4]
and eax, 0xec575cf1
mov dword [0x428f28], eax
jmp 0x40a0fc
xor eax, 0x960b04bf
add edi, 2
mov dword [0x4291b4], eax
mov dword [esp], 0x239c
call dword [sym.imp.USER32.dll_GetTopWindow]
push edx
imul eax, dword [0x4291b4], 0xa59f0b08
mov dword [0x428f28], eax
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.004147d0
jmp 0x40a06d
mov eax, dword [0x428f28]
imul edx, eax, 0xf34fa9f2
and eax, 0x1bd619a8
mov dword [0x428f28], eax
mov dword [0x4291b4], edx
call fcn.00412e60
mov eax, dword [0x428f28]
lea edx, [eax - 0x1eb5a54c]
and eax, 0x5e12ab14
mov dword [0x4291b4], edx
mov dword [0x428f28], eax
mov dword [esp], edx
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Unable_to_get_NtWow64ReadVirtualMemory64
call fcn.00411510
mov eax, dword [0x4291b4]
sub eax, 0x60bf7937
imul eax, eax, 0x625f1604
mov dword [0x4291b4], eax
mov eax, dword [ebp - 0x55c]
mov dword [esp], eax
call fcn.00401065
mov dword [esp], ebx
call fcn.0040c828
mov eax, dword [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [0x416104]
call dword [eax + 0x1c]
push eax
mov eax, dword [ebp - 0x560]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret