Function at 0x402aad
Capabilities:
Check os version
Enumerate processes
Get common file path
Get disk size
Get hostname
Get memory capacity
Get program files directory
Get session user name
Get startup folder
Initialize winsock library
Query environment variable
Resolve dns
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x700
push ebx
push esi
push edi
and dword [ebp - 4], 0
push 0x9c
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x124], 0x9c
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402d7e
mov eax, dword [ebp - 0x114]
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x6ec], edx
test eax, eax
je 0x402ea7
cmp eax, 1
je 0x402d31
cmp eax, 2
jne 0x402d7e
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x6ec]
push dword [ebp - 0x120]
push str._u._u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x118]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION_BUILD
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0x104
lea eax, [ebp - 0x430]
push eax
push 0x411aed
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x402bed
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION_INFO
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [ebp - 0x120], 0xa
je 0x402c41
mov si, word [ebp - 0x90]
cmp si, 0xff
ja 0x402c7e
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x8e]
push eax
movzx eax, si
push eax
push str._u._u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
jmp 0x402c6a
push 0
push 0x104
lea eax, [ebp - 0x430]
push eax
push str.ReleaseId
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x402c8e
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION_SP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x402c8e
push 0x411ab9
push str.WINDOWS_VERSION_SP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov al, byte [ebp - 0x8a]
cmp al, 1
je 0x402cd1
sub al, 2
cmp al, 1
ja 0x402d14
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 1
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x402d02
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION_SVR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp byte [ebp - 0x110], 0
je 0x402d7e
lea eax, [ebp - 0x110]
push eax
push str.WINDOWS_VERSION_CSD
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x402d7e
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x6ec]
push dword [ebp - 0x120]
push str.WIN32._u._u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x4155c0], 0
jne 0x402d97
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4155c0], eax
cmp dword [0x4155d4], 0
jne 0x402db0
push str.WTSAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4155d4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push esi
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push 0x411a67
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x402f8f
cmp edi, 0xffffffff
je 0x402f8f
push 0x128
push 0
lea eax, [ebp - 0x558]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x558], 0x128
lea eax, [ebp - 0x558]
push eax
push edi
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x6f4], eax
jmp 0x402e93
cmp dword [ebp - 0x550], esi
jne 0x402e60
mov eax, dword [ebp - 0x540]
mov dword [0x4155d8], eax
jmp 0x402e93
push 0x128
push 0
lea eax, [ebp - 0x558]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x558], 0x128
lea eax, [ebp - 0x558]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
je 0x402ee7
cmp dword [0x4155d8], 0
je 0x402e4b
jmp 0x402ef4
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x6ec]
push dword [ebp - 0x120]
push str.WIN32s._u._u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
jmp 0x402d6c
cmp dword [0x4155d8], 0
je 0x402f88
push 0x128
push 0
lea eax, [ebp - 0x558]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x558], 0x128
lea eax, [ebp - 0x558]
push eax
push edi
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x6f4], eax
jmp 0x402f76
mov eax, dword [0x4155d8]
cmp dword [ebp - 0x550], eax
jne 0x402f43
mov eax, dword [ebp - 0x540]
mov dword [0x4155dc], eax
jmp 0x402f76
push 0x128
push 0
lea eax, [ebp - 0x558]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x558], 0x128
lea eax, [ebp - 0x558]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
je 0x402f88
cmp dword [0x4155dc], 0
je 0x402f29
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [0x4155d8]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.PPID
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [0x4155dc]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.P2PID
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call fcn.004014fe
test eax, eax
setne al
movzx eax, al
neg eax
and eax, 0x20
add eax, 0x20
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.WINDOWS_VERSION_BITS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [0x4155c0]
test eax, eax
je 0x40308e
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4155e0], eax
mov eax, dword [0x4155e0]
test eax, eax
je 0x4030dd
call eax
mov esi, eax
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push esi
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.CONSOLE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [0x4155d4]
test eax, eax
je 0x40310d
push str.WTSQuerySessionInformationA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4155e4], eax
push str.WTSFreeMemory
push dword [0x4155d4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4155e8], eax
cmp dword [0x4155e4], 0
je 0x4031ab
and dword [ebp - 0x18], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xe
push 0xffffffffffffffff
push 0
call dword [0x4155e4]
test eax, eax
je 0x403225
cmp dword [ebp - 0x18], 0
je 0x403225
cmp dword [ebp - 8], 0x18
jne 0x403225
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jne 0x4031e7
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 9]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 8]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 7]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 6]
push eax
push str._u._u._u._u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x1c
jmp 0x4031b7
and dword [ebp - 0x6f0], 0
jmp 0x4032a1
lea eax, [ebp - 0x430]
push eax
push str.SESSIONADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x430]
push eax
push str.CLIENTADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0x6f0], 1
jmp 0x40323c
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x403225
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x18]
push dword [eax]
push str.AF__u_
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x4031b7
push 0x4119cd
push str.SESSIONADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x403250
mov edx, dword [0x4155e8]
test edx, edx
je 0x403250
push eax
call edx
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xa
push 0xffffffffffffffff
push 0
call dword [0x4155e4]
test eax, eax
je 0x40328d
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4032a1
cmp dword [ebp - 8], 0
je 0x40328d
mov edx, dword [ebp - 0xc]
cmp byte [edx], 0
je 0x40328d
push eax
push str.CLIENTNAME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4032a1
mov edx, dword [0x4155e8]
test edx, edx
je 0x4032a1
push eax
call edx
lea eax, [ebp - 0x6e8]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4033e9
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x430]
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x4033e4
lea eax, [ebp - 0x430]
push eax
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x4033e4
cmp word [esi + 0xa], 4
jne 0x4033e4
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x4033e4
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
mov dword [ebp - 0xc], eax
xor edi, edi
mov ebx, 0x103
jmp 0x4033a9
cmp byte [ebp - 0x430], 0
je 0x403351
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
mov byte [eax], 0x2c
dec ebx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edi*4]
movzx eax, byte [eax + 3]
push eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edi*4]
movzx eax, byte [eax + 2]
push eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edi*4]
movzx eax, byte [eax + 1]
push eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edi*4]
movzx eax, byte [eax]
push eax
push str._u._u._u._u
push ebx
push dword [ebp - 0xc]
call fcn.0040a040
add esp, 0x1c
push dword [ebp - 0xc]
call fcn.00409600
pop ecx
neg eax
add eax, ebx
mov ebx, eax
push dword [ebp - 0xc]
call fcn.00409600
pop ecx
add dword [ebp - 0xc], eax
inc edi
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x4033b7
cmp ebx, 0x10
jg 0x40333b
cmp dword [ebp - 0x6f0], 0
jne 0x4033d2
lea eax, [ebp - 0x430]
push eax
push str.CLIENTADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x430]
push eax
push str.LOCALADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call sub.WS2_32.dll_WSACleanup
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x4155ec
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x403446
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [0x4155ec]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.SESSION
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x430]
push eax
push str.SESSIONNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x403480
cmp byte [ebp - 0x430], 0
jne 0x403490
push 0x4119cd
push str.SESSIONNAME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 8], 0x103
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4034d4
lea eax, [ebp - 0x430]
push eax
push str.COMPUTERNAME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 8], 0x103
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x403518
lea eax, [ebp - 0x430]
push eax
push str.USERNAME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x228]
push eax
push str.COMPUTERNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40355e
cmp byte [ebp - 0x228], 0
je 0x40355e
mov dword [ebp - 0x6f4], 1
jmp 0x403565
and dword [ebp - 0x6f4], 0
push 0x104
push 0
lea eax, [ebp - 0x32c]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x32c]
push eax
push str.CLIENTNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4035a4
cmp byte [ebp - 0x32c], 0
je 0x4035a4
xor esi, esi
inc esi
jmp 0x4035a6
xor esi, esi
cmp dword [ebp - 0x6f4], 0
je 0x40362a
test esi, esi
je 0x40360d
cmp dword [0x4155ec], 0
je 0x40360d
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x32c]
push eax
push 0x411988
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.CLIENTCOMPUTER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x403640
cmp dword [ebp - 0x6f4], 0
je 0x40362a
lea eax, [ebp - 0x228]
push eax
push str.CLIENTCOMPUTER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x403640
test esi, esi
je 0x403644
lea eax, [ebp - 0x32c]
push eax
push str.CLIENTCOMPUTER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
jne 0x403654
push 0x4119cd
push str.CLIENTNAME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x403692
lea eax, [ebp - 0x430]
push eax
push str.USRWINDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4036d0
lea eax, [ebp - 0x430]
push eax
push str.SYSWINDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call fcn.00402774
test eax, eax
je 0x403701
push 0x41195b
push str.ISADMIN
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x403711
push 0x411959
push str.ISADMIN
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [0x4155c0]
test eax, eax
je 0x40372b
push str.GetTickCount64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4155f0], eax
cmp dword [0x4155f0], 0
je 0x40378b
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call dword [0x4155f0]
push edx
push eax
push 0
push 0x3e8
call fcn.004097f0
push edx
push eax
push str._llu
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.UPTIME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
and dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [ebp - 4]
push edx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403815
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [ebp - 8]
test esi, esi
je 0x40380c
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40380c
lea eax, [ebp - 8]
push eax
push esi
push edi
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x403805
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403833
push eax
push 0x41193a
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x403843
push 0x411936
push 0x41193a
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x40
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x88], 0x40
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
shrd eax, edx, 0x14
shr edx, 0x14
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push 0x411932
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x103
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x430], 0
je 0x4039b0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4039b0
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
shrd eax, edx, 0x1e
sar edx, 0x1e
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.SystemDriveSize
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 0x1e
sar edx, 0x1e
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.SystemDriveFree
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x42]
push eax
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push 0x411909
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x46]
push eax
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.MONTH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x48]
push eax
push str._04u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.YEAR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x40]
push eax
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.HOUR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x3e]
push eax
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.MINUTE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x3c]
push eax
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.SECOND
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x104
lea eax, [ebp - 0x430]
push eax
push 9
lea eax, [ebp - 0x48]
push eax
call fcn.00401612
add esp, 0x10
test eax, eax
je 0x403ba4
lea eax, [ebp - 0x430]
push eax
push str.WDAY
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x44]
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.NDAY
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx ecx, word [ebp - 0x48]
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
push edx
push str._02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.YEAR2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0x104
lea eax, [ebp - 0x430]
push eax
push 2
lea eax, [ebp - 0x48]
push eax
call fcn.00401612
add esp, 0x10
test eax, eax
je 0x403c81
lea eax, [ebp - 0x430]
push eax
push 0x4118d2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x6f6], ax
movzx eax, word [ebp - 0x6f6]
push eax
mov ax, word [ebp - 0x3e]
mov word [ebp - 0x6f8], ax
movzx eax, word [ebp - 0x6f8]
push eax
mov ax, word [ebp - 0x40]
mov word [ebp - 0x6fa], ax
movzx eax, word [ebp - 0x6fa]
push eax
mov ax, word [ebp - 0x42]
mov word [ebp - 0x6fe], ax
movzx eax, word [ebp - 0x6fe]
push eax
mov ax, word [ebp - 0x46]
mov word [ebp - 0x6fc], ax
movzx eax, word [ebp - 0x6fc]
push eax
mov si, word [ebp - 0x48]
movzx eax, si
push eax
push str._04u__02u__02u__02u__02u__02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x24
lea eax, [ebp - 0x430]
push eax
push str.FNOW
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6fe]
push eax
movzx eax, word [ebp - 0x6fc]
push eax
movzx eax, si
push eax
push str._04u__02u__02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.FDATE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6f6]
push eax
movzx eax, word [ebp - 0x6f8]
push eax
movzx eax, word [ebp - 0x6fa]
push eax
push str._02u__02u__02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.FTIME
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6fe]
push eax
movzx eax, word [ebp - 0x6fc]
push eax
movzx eax, si
push eax
push str._04u_02u_02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.DATE8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6fe]
push eax
movzx eax, word [ebp - 0x6fc]
push eax
movzx ecx, si
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
push edx
push str._02u_02u_02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.DATE6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6f6]
push eax
movzx eax, word [ebp - 0x6f8]
push eax
movzx eax, word [ebp - 0x6fa]
push eax
push str._02u_02u_02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.TIME6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
movzx eax, word [ebp - 0x6f8]
push eax
movzx eax, word [ebp - 0x6fa]
push eax
push str._02u_02u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.TIME4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
push edx
push eax
push str._llu
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.TNOW
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call dword [sym.imp.WINMM.dll_timeGetTime]
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.TICKS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
movzx esi, si
push esi
movzx eax, word [ebp - 0x6fc]
push eax
movzx eax, word [ebp - 0x6fe]
push eax
call fcn.0040292c
add esp, 0xc
mov edi, eax
movzx esi, si
push esi
push 1
push 1
call fcn.0040292c
add esp, 0xc
mov ebx, eax
test edi, edi
jle 0x404042
test ebx, ebx
jle 0x404042
cmp edi, ebx
jl 0x404042
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, edi
sub eax, ebx
inc eax
push eax
push str._03u
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.DAYNUM
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x7d0
push 1
push 1
call fcn.0040292c
add esp, 0xc
mov ebx, eax
test edi, edi
jle 0x4040a8
test ebx, ebx
jle 0x4040a8
cmp edi, ebx
jl 0x4040a8
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, edi
sub eax, ebx
inc eax
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.DAY2K
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [edi - 1]
cmp word [ebp - 0x6fa], 3
cmovb edi, eax
test edi, edi
jle 0x404107
test ebx, ebx
jle 0x404107
cmp edi, ebx
jl 0x404107
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
sub edi, ebx
inc edi
push edi
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.DAY2K3
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
movzx esi, si
push esi
movzx eax, word [ebp - 0x6fc]
push eax
movzx eax, word [ebp - 0x6fe]
push eax
call fcn.004029a4
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x40416e
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x14]
push str._02d
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.WEEK
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4041b4
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x3b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4041fa
lea eax, [ebp - 0x430]
push eax
push str.CDBURN_AREA
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x2f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404240
lea eax, [ebp - 0x430]
push eax
push str.COMMON_ADMINTOOLS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x1e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404286
lea eax, [ebp - 0x430]
push eax
push str.COMMON_ALTSTARTUP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4042cc
lea eax, [ebp - 0x430]
push eax
push str.COMMON_APPDATA
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404312
lea eax, [ebp - 0x430]
push eax
push str.COMMON_DESKTOPDIRECTORY
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404358
lea eax, [ebp - 0x430]
push eax
push str.COMMON_DOCUMENTS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x1f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40439e
lea eax, [ebp - 0x430]
push eax
push str.COMMON_FAVORITES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x35
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4043e4
lea eax, [ebp - 0x430]
push eax
push str.COMMON_MUSIC
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x36
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40442a
lea eax, [ebp - 0x430]
push eax
push str.COMMON_PICTURES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404470
lea eax, [ebp - 0x430]
push eax
push str.COMMON_PROGRAMS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4044b6
lea eax, [ebp - 0x430]
push eax
push str.COMMON_STARTMENU
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4044fc
lea eax, [ebp - 0x430]
push eax
push str.COMMON_STARTUP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x2d
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404542
lea eax, [ebp - 0x430]
push eax
push str.COMMON_TEMPLATES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x37
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404588
lea eax, [ebp - 0x430]
push eax
push str.COMMON_VIDEO
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x21
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4045ce
lea eax, [ebp - 0x430]
push eax
push str.COOKIES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404614
lea eax, [ebp - 0x430]
push eax
push str.DESKTOPDIRECTORY
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40465a
lea eax, [ebp - 0x430]
push eax
push str.FAVORITES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x14
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4046a0
lea eax, [ebp - 0x430]
push eax
push str.FONTS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x22
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4046e6
lea eax, [ebp - 0x430]
push eax
push str.HISTORY
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x20
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40472c
lea eax, [ebp - 0x430]
push eax
push str.INTERNET_CACHE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404772
lea eax, [ebp - 0x430]
push eax
push str.LOCALAPPDATA
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4047b8
lea eax, [ebp - 0x430]
push eax
push str.MYDOCUMENTS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0xd
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4047fe
lea eax, [ebp - 0x430]
push eax
push str.MYMUSIC
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x27
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404844
lea eax, [ebp - 0x430]
push eax
push str.MYPICTURES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0xe
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40488a
lea eax, [ebp - 0x430]
push eax
push str.MYVIDEO
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4048d0
lea eax, [ebp - 0x430]
push eax
push str.PROFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404916
lea eax, [ebp - 0x430]
push eax
push str.PROGRAM_FILES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x40495c
lea eax, [ebp - 0x430]
push eax
push str.PROGRAM_FILES_COMMON
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4049a2
lea eax, [ebp - 0x430]
push eax
push str.PROGRAMS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 8
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x4049e8
lea eax, [ebp - 0x430]
push eax
push str.RECENT
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404a2e
lea eax, [ebp - 0x430]
push eax
push str.SENDTO
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404a74
lea eax, [ebp - 0x430]
push eax
push str.STARTMENU
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404aba
lea eax, [ebp - 0x430]
push eax
push str.STARTUP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404b00
lea eax, [ebp - 0x430]
push eax
push str.SYSTEM
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x15
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x430], 0
je 0x404b46
lea eax, [ebp - 0x430]
push eax
push str.TEMPLATES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
sete al
movzx eax, al
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverLocked
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x72
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x404bee
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x14]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverRunning
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x10
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x404c46
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x14]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverEnabled
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
push 0x103
lea eax, [ebp - 0x430]
push eax
push str.ScreenSaverIsSecure
push str.Control_PanelDesktop
push 0x80000001
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x404ce7
push 0x41195b
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
sete al
movzx eax, al
mov dword [ebp - 0x14], eax
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push dword [ebp - 0x14]
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverSecure
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x404d4d
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x1e]
mov esi, 0x3c
mov eax, ecx
cdq
idiv esi
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverTime
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
push 0x103
lea eax, [ebp - 0x430]
push eax
push str.SCRNSAVE.EXE
push str.Control_PanelDesktop
push 0x80000001
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x404d9e
lea eax, [ebp - 0x430]
push eax
push str.ScreensaverPath
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
push 0x103
lea eax, [ebp - 0x430]
push eax
push str.TileWallpaper
push str.Control_PanelDesktop
push 0x80000001
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x405094
push 0x411959
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
je 0x404e48
push 0x41195b
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
je 0x404e48
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Center
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x41195b
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
jne 0x404e98
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Tile
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
push 0x103
lea eax, [ebp - 0x430]
push eax
push str.WallpaperStyle
push str.Control_PanelDesktop
push 0x80000001
call fcn.004027d5
add esp, 0x18
test eax, eax
je 0x40504e
push 0x411959
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
jne 0x404f2b
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Center
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x41158b
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
jne 0x404f7b
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Stretch
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x411581
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
jne 0x404fcb
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Resize
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x411577
lea eax, [ebp - 0x430]
push eax
call fcn.004098a0
pop ecx
pop ecx
test eax, eax
jne 0x405018
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Crop
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Center
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
jmp 0x405082
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push str.Center
push 0x411b76
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.WallpaperMode
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
push 0
lea eax, [ebp - 0x430]
push eax
push 0x103
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x4050d6
lea eax, [ebp - 0x430]
push eax
push str.WallpaperPath
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
cmp esi, 0xffffff
ja 0x40514a
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, esi
and eax, 0xff0000
sar eax, 0x10
push eax
mov eax, esi
and eax, 0xff00
sar eax, 8
push eax
and esi, 0xff
push esi
push str._02X_02X_02X
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push str.DesktopColor
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 8
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00409670
add esp, 0xc
mov dword [ebp - 0x20], 8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x4051cb
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
lea ecx, [eax + 0x1f4]
mov esi, 0x3e8
mov eax, ecx
xor edx, edx
div esi
push eax
push 0x411b52
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push str.IdleTime
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x405222
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
push edx
push eax
push str._llu
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.PerformanceFrequency
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x405279
push 0x104
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00409670
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
push edx
push eax
push str._llu
push 0x103
lea eax, [ebp - 0x430]
push eax
call fcn.0040a040
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push str.PerformanceCounter
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret