Function at 0x427182
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a94
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a8c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x29ac
jg 0x426e9f
je 0x426e8f
add ecx, 0xffffd7fe
cmp ecx, 0x22
ja case.0x426eb5.10677
movzx eax, byte [ecx + 0x427434]
jmp dword [eax*4 + 0x4273d4]
push 0x10
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
jmp case.0x426eb5.10677
call fcn.0042c660
jmp case.0x426eb5.10677
mov eax, dword [0x4e4f3c]
mov dword [0x4e4f40], 1
cmp eax, 0x2e8
jle 0x426315
cmp eax, 0x2ea
jge 0x426315
mov edx, 0x4b32e4
mov ecx, str.STRT
call fcn.00478640
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x94]
push eax
call ebp
lea eax, [esp + 0x90]
mov edx, 0x4b3320
push 0x24
push eax
mov ecx, str.STRT
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, 6
jne 0x4262fc
call fcn.004771f0
push 0
push 0
push 0x1004
push 0x2808
push dword [0x4e6030]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
xor esi, esi
test edi, edi
je 0x4262bc
nop
mov ecx, esi
call fcn.0042dc40
inc esi
cmp esi, edi
jne 0x4262b0
mov edx, 0x4b35b0
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call ebp
lea eax, [esp + 0x90]
mov edx, 0x4b35b4
push 0x30
push eax
mov ecx, str.STRT
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x2808
push dword [0x4e6030]
call ebx
mov ecx, eax
call fcn.0042da60
jmp case.0x426eb5.10677
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x426eb5.10677
mov eax, dword [0x4e4f3c]
mov dword [0x4e4f40], 1
push 0
add eax, 0xfffffd17
jne 0x426317
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x1004
push 0x2808
push dword [0x4e6030]
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
mov edi, eax
xor esi, esi
test edi, edi
je 0x42638c
nop dword [eax + eax]
mov ecx, esi
call fcn.0042dc40
inc esi
cmp esi, edi
jne 0x426380
call fcn.0042e930
push 0x2808
push dword [0x4e6030]
call ebx
mov esi, eax
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xaa0], ax
lea eax, [esp + 0xaa2]
push eax
call fcn.0048fb10
add esp, 0xc
push 0
push 0
push 0x1004
push esi
call ebp
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.00477500
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b5728
push str.STRT
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
test eax, eax
jle 0x426431
lea esi, [edi + 0xa]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426425
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426412
push dword [esp + 0x14]
lea eax, [esp + 0xa9c]
push dword [esp + 0x14]
push str.unnamed
push 0x400
push eax
call fcn.0040a420
add esp, 0x14
lea eax, [esp + 0xa98]
push eax
push 1
push 0x40b
push dword [0x4e5c10]
call ebp
jmp case.0x426eb5.10677
mov eax, dword [0x4e4f3c]
mov dword [0x4e4f40], 1
cmp eax, 0x2e8
jle 0x426315
cmp eax, 0x2ea
jge 0x426315
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [0x4cb9a0], 1
push 0
push eax
mov dword [esp + 0xaa4], 0
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2808
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0xa98]
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push 0x1073
push 0x2808
push dword [0x4e6030]
mov dword [esp + 0x44], 0x400
call edi
push eax
call esi
cmp word [esp + 0xa98], 0
jne 0x4265ff
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b3f94
push str.STRT
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
lea esi, [edi + 0xa]
test eax, eax
jle 0x426582
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426576
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426563
push str.unnamed
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b5780
push str.STRT
call ebp
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x4265df
nop
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x4265d3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x4265c0
lea eax, [esp + 0x90]
push 0x30
push eax
push str.unnamed
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x426eb5.10677
push 0
push 0x42f4a0
push dword [0x4e6030]
push str.SURegEdit
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x426eb5.10677
mov eax, dword [0x4e4f3c]
mov dword [0x4e4f40], 1
push 0
add eax, 0xfffffd17
jne 0x426317
push 0x42f4a0
push dword [0x4e6030]
mov dword [0x4cb9a0], 0
push str.SURegEdit
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0x2808
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
call fcn.0042da60
jmp case.0x426eb5.10677
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x9a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x90]
push 0xa
push 0x64
push eax
push 0
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x90]
push 0x4e5e28
push eax
push str.Services
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x426eb5.10677
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x9a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x90]
push 0xa
push 0x64
push eax
push 1
jmp 0x4266af
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x9a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x90]
push 0xa
push 0x64
push eax
push 2
jmp 0x4266af
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x9a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x90]
push 0xa
push 0x64
push eax
push 3
jmp 0x4266af
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x9a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x90]
push 0xa
push 0x64
push eax
push 4
jmp 0x4266af
mov ecx, 1
call fcn.004784d0
jmp case.0x426eb5.10677
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x42db00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x426eb5.10677
xor edx, edx
call fcn.0042a900
jmp case.0x426eb5.10677
mov edx, 1
call fcn.0042a900
jmp case.0x426eb5.10677
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [esp + 0xa9c], 0
push 0
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2819
push dword [0x4e6030]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov ebx, eax
mov dword [esp + 0x20], 1
lea eax, [esp + 0xa98]
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0x1073
push 0x2819
push dword [0x4e6030]
call esi
push eax
call edi
cmp word [esp + 0xa98], 0
jne 0x42693b
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b3f94
push str.STRT
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
lea esi, [edi + 0xa]
test eax, eax
jle 0x4268cf
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x4268c3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x4268b0
push str.unnamed
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4708
push str.STRT
call ebp
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x42692f
nop dword [eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426923
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426910
lea eax, [esp + 0x1298]
jmp 0x4265e6
lea eax, [esp + 0x298]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x68], eax
lea eax, [esp + 0x54]
push eax
push ebx
push 0x1073
push 0x2819
push dword [0x4e6030]
mov dword [esp + 0x80], 0x104
call esi
push eax
call edi
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4710
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
lea esi, [edi + 0xa]
test eax, eax
jle 0x4269cf
nop dword [eax + eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x4269c3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x4269b0
push str.unnamed
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x94]
push eax
call ebp
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4738
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x426a4f
nop dword [eax + eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426a43
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426a30
push str.unnamed
lea eax, [esp + 0x94]
push eax
call ebp
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b32e4
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x426aaf
nop dword [eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426aa3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426a90
push 0x24
push str.unnamed
lea eax, [esp + 0x98]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x426eb5.10677
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je case.0x426eb5.10677
lea edx, [esp + 0xa98]
mov ecx, esi
call fcn.0042bcc0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x42ac20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x426eb5.10677
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [esp + 0xa9c], 0
push 0
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2819
push dword [0x4e6030]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov ebx, eax
mov dword [esp + 0x5c], 1
lea eax, [esp + 0xa98]
mov dword [esp + 0x6c], 0x400
mov dword [esp + 0x68], eax
lea eax, [esp + 0x54]
push eax
push ebx
push 0x1073
push 0x2819
push dword [0x4e6030]
call esi
push eax
call edi
cmp word [esp + 0xa98], 0
jne 0x426c6c
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b3f94
push str.STRT
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
lea esi, [edi + 0xa]
test eax, eax
jle 0x426c04
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426bf8
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426be5
push str.unnamed
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4708
push str.STRT
call ebp
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x426c60
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426c54
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426c41
lea eax, [esp + 0x298]
jmp 0x4265e6
lea eax, [esp + 0x1298]
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0x1073
push 0x2819
push dword [0x4e6030]
mov dword [esp + 0x44], 0x104
call esi
push eax
call edi
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4740
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push str.unnamed
call ebx
lea esi, [edi + 0xa]
test eax, eax
jle 0x426cff
nop dword [eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426cf3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426ce0
push str.unnamed
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
lea eax, [esp + 0x94]
push eax
call ebp
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b4850
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x426d7f
nop dword [eax + eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426d73
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426d60
push str.unnamed
lea eax, [esp + 0x94]
push eax
call ebp
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b32e4
push str.STRT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.unnamed
xor edi, edi
call ebx
test eax, eax
jle 0x426ddf
nop dword [eax]
cmp word [edi*2 + str.unnamed], 0x7e
jne 0x426dd3
mov word [edi*2 + str.unnamed], si
push str.unnamed
inc edi
call ebx
cmp edi, eax
jl 0x426dc0
push 0x24
push str.unnamed
lea eax, [esp + 0x98]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x426eb5.10677
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je case.0x426eb5.10677
lea edx, [esp + 0xa98]
mov ecx, esi
call fcn.0042bff0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x42ac20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x426eb5.10677
call fcn.0042bac0
jmp case.0x426eb5.10677
call fcn.0042b7a0
jmp case.0x426eb5.10677
mov ecx, 2
call fcn.0042c210
jmp case.0x426eb5.10677
mov ecx, 3
call fcn.0042c210
jmp case.0x426eb5.10677
mov ecx, 4
call fcn.0042c210
jmp case.0x426eb5.10677
push 5
push 0
push 0
push str.taskmgr.exe
jmp 0x426fcc
add ecx, 0xffffd650
cmp ecx, 0x16
ja case.0x426eb5.10677
movzx eax, byte [ecx + 0x427488]
jmp dword [eax*4 + 0x427458]
push 0x2808
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov ecx, eax
call fcn.00425ed0
jmp case.0x426eb5.10677
push 0x2808
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov ecx, eax
call fcn.00426050
jmp case.0x426eb5.10677
push 0x758
lea eax, [esp + 0x344]
mov ecx, 0x2a
mov esi, str.http:__www.google.com_cse_cxpartner_pub_0006844798601315_3Aqdlcnn_rumyieUTF_8q
lea edi, [esp + 0x29c]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0xa98], ax
push 0x7fe
push eax
lea eax, [esp + 0xaa2]
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2762
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0xa98]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x54]
push ecx
push eax
push 0x1073
push 0x2762
push dword [0x4e6030]
mov dword [esp + 0x80], 0x400
call edi
push eax
call esi
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x298]
push 5
push 0
push 0
push eax
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x426eb5.10677
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x2a0], ax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2762
push dword [0x4e6030]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov ebx, eax
mov dword [esp + 0x5c], 3
lea eax, [esp + 0x298]
mov dword [esp + 0x6c], 0x400
mov dword [esp + 0x68], eax
lea eax, [esp + 0x54]
push eax
push ebx
push 0x1073
push 0x2762
push dword [0x4e6030]
call esi
push eax
call edi
mov ax, word [esp + 0x298]
test ax, ax
je 0x427072
cmp ax, 0x5b
jne 0x4270a8
lea eax, [esp + 0x298]
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0x1073
push 0x2762
push dword [0x4e6030]
mov dword [esp + 0x44], 0x400
call esi
push eax
call edi
lea edx, [esp + 0x298]
mov ecx, edx
call fcn.0045e940
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xaa0], ax
lea eax, [esp + 0xaa2]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2a4]
add esp, 0xc
push eax
lea eax, [esp + 0xa9c]
push eax
call esi
push 0
lea eax, [esp + 0x29c]
push eax
push 0x400
push 0
lea eax, [esp + 0xaa8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x427125
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x29c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movaps xmm0, xmmword [0x4c77d0]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x4c
mov dword [esp + 0x28], str.properties
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x426eb5.10677
push 0x758
lea eax, [esp + 0x1344]
mov ecx, 0x2a
mov esi, str.http:__www.google.com_cse_cxpartner_pub_0006844798601315_3Aqdlcnn_rumyieUTF_8q
lea edi, [esp + 0x129c]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2819
push dword [0x4e6030]
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov ebp, eax
mov dword [esp + 0x5c], 6
lea eax, [esp + 0x298]
mov dword [esp + 0x6c], 0x400
mov dword [esp + 0x68], eax
lea eax, [esp + 0x54]
push eax
push ebp
push 0x1073
push 0x2819
push dword [0x4e6030]
call edi
push eax
call ebx
cmp word [esp + 0x298], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
je 0x427287
lea edx, [esp + 0x298]
mov ecx, edx
call fcn.0045e940
push 0x4b3500
push 0
lea eax, [esp + 0x2a0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
je 0x427266
add eax, 2
jmp 0x42726d
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x129c]
push eax
call esi
push 0x4b4068
lea eax, [esp + 0x129c]
push eax
call esi
lea eax, [esp + 0x298]
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebp
push 0x1073
push 0x2819
push dword [0x4e6030]
mov dword [esp + 0x44], 0x400
call edi
push eax
call ebx
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x129c]
push eax
call esi
push 0x4b4068
lea eax, [esp + 0x129c]
push eax
call esi
lea eax, [esp + 0x298]
mov dword [esp + 0x5c], 2
mov dword [esp + 0x68], eax
lea eax, [esp + 0x54]
push eax
push ebp
push 0x1073
push 0x2819
push dword [0x4e6030]
mov dword [esp + 0x80], 0x400
call edi
push eax
call ebx
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x129c]
push eax
call esi
lea eax, [esp + 0x1298]
jmp 0x426fc5
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x45aa90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x426eb5.10677
push 0x29c5
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 3
mov ecx, eax
call fcn.00426050
jmp case.0x426eb5.10677
push 0x29c5
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 3
mov ecx, eax
call fcn.00425ed0
jmp case.0x426eb5.10677
call fcn.0045ad40
jmp case.0x426eb5.10677
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x45ac40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x426eb5.10677
call fcn.0045b0a0
mov ecx, dword [esp + 0x1a9c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1a94
ret