Function at 0x401d2d
Capabilities:
Get common file path

Disassembly:
mov eax, 0x41ffb8
call fcn.00412bcc
mov eax, 0x1658
call fcn.00413020
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00404576
cmp eax, 3
jae 0x401d60
push str.Global437
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [esp + 0x167c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
test bl, 1
je 0x402495
test byte [edi], 1
jne 0x402495
lea eax, [esp + 0x1d4]
push str._:text:KERNEL32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
and dword [esp + 0x1670], 0
cmp dword [eax + 0x14], 0x10
jb 0x401da3
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [edi + 8], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x1d4]
call fcn.004015ab
test esi, esi
je 0x402495
push str._:hash:CreateFileA
push dword [edi + 8]
call fcn.004064a8
push str._:hash:CreateFileMappingA
push dword [edi + 8]
mov dword [edi + 0x54], eax
call fcn.004064a8
push str._:hash:CreateFileMappingW
push dword [edi + 8]
mov dword [edi + 0x58], eax
call fcn.004064a8
push str._:hash:CreateFileW
push dword [edi + 8]
mov dword [edi + 0x5c], eax
call fcn.004064a8
push str._:hash:CreateProcessA
push dword [edi + 8]
mov dword [edi + 0x60], eax
call fcn.004064a8
push str._:hash:CreateProcessW
push dword [edi + 8]
mov dword [edi + 0x64], eax
call fcn.004064a8
push str._:hash:CreateRemoteThread
push dword [edi + 8]
mov dword [edi + 0x68], eax
call fcn.004064a8
push str._:hash:CreateToolhelp32Snapshot
push dword [edi + 8]
mov dword [edi + 0x6c], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x70], eax
push str._:hash:ExpandEnvironmentStringsA
push dword [edi + 8]
call fcn.004064a8
push str._:hash:ExpandEnvironmentStringsW
push dword [edi + 8]
mov dword [edi + 0x74], eax
call fcn.004064a8
push str._:hash:FindFirstFileA
push dword [edi + 8]
mov dword [edi + 0x78], eax
call fcn.004064a8
push str._:hash:FindFirstFileW
push dword [edi + 8]
mov dword [edi + 0x7c], eax
call fcn.004064a8
push str._:hash:FindNextFileA
push dword [edi + 8]
mov dword [edi + 0x80], eax
call fcn.004064a8
push str._:hash:FindNextFileW
push dword [edi + 8]
mov dword [edi + 0x84], eax
call fcn.004064a8
push str._:hash:FlushInstructionCache
push dword [edi + 8]
mov dword [edi + 0x88], eax
call fcn.004064a8
push str._:hash:GetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x8c], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x90], eax
push str._:hash:GetCurrentConsoleFontEx
push dword [edi + 8]
call fcn.004064a8
push str._:hash:GetEnvironmentVariableA
push dword [edi + 8]
mov dword [edi + 0x94], eax
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x98], eax
call fcn.00404576
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, 3
jae 0x401f2e
push 0
push 1
push 1
push 0
call esi
test eax, eax
je 0x401f2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetEnvironmentVariableW
push dword [edi + 8]
call fcn.004064a8
push str._:hash:GetExitCodeProcess
push dword [edi + 8]
mov dword [edi + 0x9c], eax
call fcn.004064a8
push str._:hash:GetFullPathNameA
push dword [edi + 8]
mov dword [edi + 0xa0], eax
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0xa4], eax
call fcn.00404576
cmp eax, 3
jae 0x401f8b
push str.Local191
xor eax, eax
push eax
push eax
push eax
call esi
test eax, eax
je 0x401f8b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:GetFullPathNameW
push dword [edi + 8]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0xa8], eax
call fcn.00404576
cmp eax, 3
jae 0x401fbd
xor eax, eax
push eax
push eax
push eax
push eax
call esi
test eax, eax
je 0x401fbd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetLogicalDriveStringsA
push dword [edi + 8]
call fcn.004064a8
push str._:hash:GetLogicalDriveStringsW
push dword [edi + 8]
mov dword [edi + 0xac], eax
call fcn.004064a8
push str._:hash:GetModuleFileNameA
push dword [edi + 8]
mov dword [edi + 0xb0], eax
call fcn.004064a8
push str._:hash:GetModuleFileNameW
push dword [edi + 8]
mov dword [edi + 0xb4], eax
call fcn.004064a8
push str._:hash:GetModuleHandleA
push dword [edi + 8]
mov dword [edi + 0xb8], eax
call fcn.004064a8
push str._:hash:GetModuleHandleExA
push dword [edi + 8]
mov dword [edi + 0xbc], eax
call fcn.004064a8
add esp, 0x30
mov dword [edi + 0xc0], eax
call fcn.00404576
cmp eax, 3
jae 0x40204b
lea eax, [esp + 0x204]
push eax
push 0x104
call ebp
push str._:hash:GetModuleHandleExW
push dword [edi + 8]
call fcn.004064a8
push str._:hash:GetModuleHandleW
push dword [edi + 8]
mov dword [edi + 0xc4], eax
call fcn.004064a8
push str._:hash:GetSystemWow64DirectoryA
push dword [edi + 8]
mov dword [edi + 0xc8], eax
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0xcc], eax
call fcn.00404576
cmp eax, 3
jae 0x4020a6
push 0
push 1
push 1
push 0
call esi
test eax, eax
je 0x4020a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetSystemWow64DirectoryW
push dword [edi + 8]
call fcn.004064a8
push str._:hash:GetTickCount64
push dword [edi + 8]
mov dword [edi + 0xd0], eax
call fcn.004064a8
push str._:hash:GetVersionExA
push dword [edi + 8]
mov dword [edi + 0xd4], eax
call fcn.004064a8
push str._:hash:GetVersionExW
push dword [edi + 8]
mov dword [edi + 0xd8], eax
call fcn.004064a8
push str._:hash:GetVolumeInformationA
push dword [edi + 8]
mov dword [edi + 0xdc], eax
call fcn.004064a8
push str._:hash:GetVolumeInformationW
push dword [edi + 8]
mov dword [edi + 0xe0], eax
call fcn.004064a8
push str._:hash:IsBadReadPtr
push dword [edi + 8]
mov dword [edi + 0xe4], eax
call fcn.004064a8
push str._:hash:IsBadWritePtr
push dword [edi + 8]
mov dword [edi + 0xe8], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0xec], eax
push str._:hash:IsWow64Process
push dword [edi + 8]
call fcn.004064a8
push str._:hash:LoadLibraryA
push dword [edi + 8]
mov dword [edi + 0xf0], eax
call fcn.004064a8
push str._:hash:LoadLibraryW
push dword [edi + 8]
mov dword [edi + 0xf4], eax
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0xf8], eax
call fcn.00404576
cmp eax, 3
jae 0x402196
push str.Global206
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:MapViewOfFile
push dword [edi + 8]
call fcn.004064a8
push str._:hash:Module32First
push dword [edi + 8]
mov dword [edi + 0xfc], eax
call fcn.004064a8
push str._:hash:Module32FirstW
push dword [edi + 8]
mov dword [edi + 0x100], eax
call fcn.004064a8
push str._:hash:Module32Next
push dword [edi + 8]
mov dword [edi + 0x104], eax
call fcn.004064a8
push str._:hash:Module32NextW
push dword [edi + 8]
mov dword [edi + 0x108], eax
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x10c], eax
call fcn.00404576
cmp eax, 3
jae 0x40221a
push str.Local199
push 1
push 1
push 0
call esi
test eax, eax
je 0x40221a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:OpenFileMappingA
push dword [edi + 8]
call fcn.004064a8
push str._:hash:OpenFileMappingW
push dword [edi + 8]
mov dword [edi + 0x110], eax
call fcn.004064a8
push str._:hash:OpenProcess
push dword [edi + 8]
mov dword [edi + 0x114], eax
call fcn.004064a8
push str._:hash:OpenThread
push dword [edi + 8]
mov dword [edi + 0x118], eax
call fcn.004064a8
push str._:hash:Process32First
push dword [edi + 8]
mov dword [edi + 0x11c], eax
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x120], eax
call fcn.00404576
cmp eax, 3
jae 0x40229d
push str.Local200
xor eax, eax
push eax
push eax
push eax
call esi
test eax, eax
je 0x40229d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:Process32FirstW
push dword [edi + 8]
call fcn.004064a8
push str._:hash:Process32Next
push dword [edi + 8]
mov dword [edi + 0x124], eax
call fcn.004064a8
push str._:hash:Process32NextW
push dword [edi + 8]
mov dword [edi + 0x128], eax
call fcn.004064a8
push str._:hash:ProcessIdToSessionId
push dword [edi + 8]
mov dword [edi + 0x12c], eax
call fcn.004064a8
push str._:hash:QueryDosDeviceA
push dword [edi + 8]
mov dword [edi + 0x130], eax
call fcn.004064a8
push str._:hash:QueryDosDeviceW
push dword [edi + 8]
mov dword [edi + 0x134], eax
call fcn.004064a8
push str._:hash:ReadProcessMemory
push dword [edi + 8]
mov dword [edi + 0x138], eax
call fcn.004064a8
push str._:hash:SetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x13c], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x140], eax
push str._:hash:SetCurrentConsoleFontEx
push dword [edi + 8]
call fcn.004064a8
push str._:hash:TerminateProcess
push dword [edi + 8]
mov dword [edi + 0x144], eax
call fcn.004064a8
push str._:hash:VerifyVersionInfoA
push dword [edi + 8]
mov dword [edi + 0x148], eax
call fcn.004064a8
push str._:hash:VerifyVersionInfoW
push dword [edi + 8]
mov dword [edi + 0x14c], eax
call fcn.004064a8
push str._:hash:VerSetConditionMask
push dword [edi + 8]
mov dword [edi + 0x150], eax
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x154], eax
call fcn.00404576
cmp eax, 3
jae 0x4023bb
push str.Local201
xor eax, eax
push eax
push eax
push eax
call esi
test eax, eax
je 0x4023bb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:VirtualAlloc
push dword [edi + 8]
call fcn.004064a8
push str._:hash:VirtualAllocEx
push dword [edi + 8]
mov dword [edi + 0x158], eax
call fcn.004064a8
push str._:hash:VirtualProtect
push dword [edi + 8]
mov dword [edi + 0x15c], eax
call fcn.004064a8
push str._:hash:VirtualProtectEx
push dword [edi + 8]
mov dword [edi + 0x160], eax
call fcn.004064a8
push str._:hash:VirtualQuery
push dword [edi + 8]
mov dword [edi + 0x164], eax
call fcn.004064a8
push str._:hash:WriteProcessMemory
push dword [edi + 8]
mov dword [edi + 0x168], eax
call fcn.004064a8
push str._:hash:Wow64DisableWow64FsRedirection
push dword [edi + 8]
mov dword [edi + 0x16c], eax
call fcn.004064a8
push str._:hash:Wow64RevertWow64FsRedirection
push dword [edi + 8]
mov dword [edi + 0x170], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x174], eax
push str._:hash:WTSGetActiveConsoleSessionId
push dword [edi + 8]
call fcn.004064a8
or dword [edi], 1
pop ecx
pop ecx
mov dword [edi + 0x178], eax
call fcn.00404576
cmp eax, 3
jae 0x402495
push str.Global353
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x402495
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, 2
je 0x4029d4
test byte [edi], 2
jne 0x4029d4
lea eax, [esp + 0x15c]
push str._:text:ADVAPI32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 1
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0xc], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x15c]
call fcn.004015ab
test esi, esi
je 0x4029d4
call fcn.00404576
xor esi, esi
cmp eax, 3
jae 0x402508
push str.Global663
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:AccessCheck
push dword [edi + 0xc]
call fcn.004064a8
push str._:hash:AdjustTokenPrivileges
push dword [edi + 0xc]
mov dword [edi + 0x17c], eax
call fcn.004064a8
push str._:hash:AllocateAndInitializeSid
push dword [edi + 0xc]
mov dword [edi + 0x180], eax
call fcn.004064a8
push str._:hash:ChangeServiceConfigA
push dword [edi + 0xc]
mov dword [edi + 0x184], eax
call fcn.004064a8
push str._:hash:ChangeServiceConfigW
push dword [edi + 0xc]
mov dword [edi + 0x188], eax
call fcn.004064a8
push str._:hash:CheckTokenMembership
push dword [edi + 0xc]
mov dword [edi + 0x18c], eax
call fcn.004064a8
push str._:hash:CloseServiceHandle
push dword [edi + 0xc]
mov dword [edi + 0x190], eax
call fcn.004064a8
add esp, 0x38
mov dword [edi + 0x194], eax
call fcn.00404576
cmp eax, 3
jae 0x4025b1
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x4025b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:ControlService
push dword [edi + 0xc]
call fcn.004064a8
push str._:hash:ConvertSidToStringSidA
push dword [edi + 0xc]
mov dword [edi + 0x198], eax
call fcn.004064a8
push str._:hash:ConvertSidToStringSidW
push dword [edi + 0xc]
mov dword [edi + 0x19c], eax
call fcn.004064a8
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorA
push dword [edi + 0xc]
mov dword [edi + 0x1a0], eax
call fcn.004064a8
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorW
push dword [edi + 0xc]
mov dword [edi + 0x1a4], eax
call fcn.004064a8
push str._:hash:ConvertStringSidToSidA
push dword [edi + 0xc]
mov dword [edi + 0x1a8], eax
call fcn.004064a8
push str._:hash:ConvertStringSidToSidW
push dword [edi + 0xc]
mov dword [edi + 0x1ac], eax
call fcn.004064a8
push str._:hash:CreateProcessAsUserA
push dword [edi + 0xc]
mov dword [edi + 0x1b0], eax
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x1b4], eax
push str._:hash:CreateProcessAsUserW
push dword [edi + 0xc]
call fcn.004064a8
push str._:hash:CreateServiceA
push dword [edi + 0xc]
mov dword [edi + 0x1b8], eax
call fcn.004064a8
push str._:hash:CreateServiceW
push dword [edi + 0xc]
mov dword [edi + 0x1bc], eax
call fcn.004064a8
push str._:hash:DeleteService
push dword [edi + 0xc]
mov dword [edi + 0x1c0], eax
call fcn.004064a8
add esp, 0x20
mov dword [edi + 0x1c4], eax
call fcn.00404576
cmp eax, 3
jae 0x4026c1
push str.Global191
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4026c1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:DuplicateToken
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1c8], eax
push str._:hash:DuplicateTokenEx
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1cc], eax
push str._:hash:FreeSid
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1d0], eax
push str._:hash:GetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1d4], eax
push str._:hash:GetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1d8], eax
push str._:hash:GetSecurityInfo
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1dc], eax
push str._:hash:GetTokenInformation
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1e0], eax
push str._:hash:GetUserNameA
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x1e4], eax
push str._:hash:GetUserNameW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1e8], eax
push str._:hash:ImpersonateLoggedOnUser
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1ec], eax
push str._:hash:ImpersonateSelf
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1f0], eax
push str._:hash:InitializeSecurityDescriptor
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1f4], eax
push str._:hash:IsValidSid
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1f8], eax
push str._:hash:LookupAccountSidA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x1fc], eax
push str._:hash:LookupAccountSidW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x200], eax
push str._:hash:LookupPrivilegeValueA
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x204], eax
push str._:hash:LookupPrivilegeValueW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x208], eax
push str._:hash:OpenProcessToken
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x20c], eax
push str._:hash:OpenSCManagerA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x210], eax
push str._:hash:OpenSCManagerW
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x20
mov dword [edi + 0x214], eax
call fcn.00404576
cmp eax, 3
jae 0x40285f
lea eax, [esp + 0xe40]
push eax
push 0x104
call ebp
push str._:hash:OpenServiceA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x218], eax
push str._:hash:OpenServiceW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x21c], eax
push str._:hash:OpenThreadToken
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x220], eax
push str._:hash:QueryServiceStatus
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x224], eax
push str._:hash:RegisterServiceCtrlHandlerA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x228], eax
push str._:hash:RegisterServiceCtrlHandlerW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x22c], eax
push str._:hash:RegDeleteKeyExA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x230], eax
push str._:hash:RegDeleteKeyExW
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x234], eax
push str._:hash:RevertToSelf
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x238], eax
push str._:hash:SetEntriesInAclA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x23c], eax
push str._:hash:SetEntriesInAclW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x240], eax
push str._:hash:SetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x244], eax
push str._:hash:SetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x248], eax
push str._:hash:SetSecurityInfo
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x24c], eax
push str._:hash:SetServiceStatus
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x250], eax
push str._:hash:StartServiceA
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x254], eax
push str._:hash:StartServiceCtrlDispatcherA
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x258], eax
push str._:hash:StartServiceCtrlDispatcherW
push dword [edi + 0xc]
call fcn.004064a8
mov dword [edi + 0x25c], eax
push str._:hash:StartServiceW
push dword [edi + 0xc]
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0x260], eax
or dword [edi], 2
test bl, 0x10
je 0x402a78
test byte [edi], 0x10
jne 0x402a78
lea eax, [esp + 0x6c]
push str._:text:SECUR32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 2
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x28], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.004015ab
test esi, esi
je 0x402a78
push str._:hash:GetUserNameExA
push dword [edi + 0x28]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0x3c4], eax
call fcn.00404576
cmp eax, 3
jae 0x402a60
push str.Global605
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x402a60
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetUserNameExW
push dword [edi + 0x28]
call fcn.004064a8
pop ecx
mov dword [edi + 0x3c8], eax
or dword [edi], 0x10
pop ecx
mov eax, 0x400
test eax, ebx
je 0x402c1a
test dword [edi], eax
jne 0x402c1a
lea eax, [esp + 0x1bc]
push str._:text:WS2_32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 3
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x10], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x1bc]
call fcn.004015ab
test esi, esi
je 0x402c1a
push str._:hash:WSAStartup
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x264], eax
push str._:hash:WSACleanup
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x268], eax
push str._:hash:WSAGetLastError
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x26c], eax
push str._:hash:getaddrinfo
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x270], eax
push str._:hash:freeaddrinfo
push dword [edi + 0x10]
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x274], eax
call fcn.00404576
cmp eax, 3
jae 0x402b50
lea eax, [esp + 0x618]
push eax
push 0x104
call ebp
push str._:hash:socket
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x278], eax
push str._:hash:connect
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x27c], eax
push str._:hash:send
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x280], eax
push str._:hash:sendto
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x284], eax
push str._:hash:recv
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x288], eax
push str._:hash:select
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x28c], eax
push str._:hash:shutdown
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x290], eax
push str._:hash:closesocket
push dword [edi + 0x10]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x294], eax
push str._:hash:setsockopt
push dword [edi + 0x10]
call fcn.004064a8
mov dword [edi + 0x298], eax
push str._:hash:htons
push dword [edi + 0x10]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x29c], eax
or dword [edi], 0x400
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 0x800
test eax, ebx
je 0x402e30
test dword [edi], eax
jne 0x402e30
lea eax, [esp + 0x9c]
push str._:text:WININET.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 4
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x14], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x9c]
call fcn.004015ab
test esi, esi
je 0x402e30
push str._:hash:InternetOpenA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2a0], eax
push str._:hash:InternetOpenW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2a4], eax
push str._:hash:InternetConnectA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2a8], eax
push str._:hash:InternetConnectW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2ac], eax
push str._:hash:HttpOpenRequestA
push dword [edi + 0x14]
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x2b0], eax
call fcn.00404576
cmp eax, 3
jae 0x402cfc
lea eax, [esp + 0xa2c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str._:hash:HttpOpenRequestW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2b4], eax
push str._:hash:HttpSendRequestA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2b8], eax
push str._:hash:HttpSendRequestW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2bc], eax
push str._:hash:HttpQueryInfoA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2c0], eax
push str._:hash:HttpQueryInfoW
push dword [edi + 0x14]
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x2c4], eax
call fcn.00404576
cmp eax, 3
jae 0x402d7a
push str.832832
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402d7a
push eax
call ebp
push str._:hash:InternetCloseHandle
push dword [edi + 0x14]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0x2c8], eax
call fcn.00404576
cmp eax, 3
jae 0x402dac
lea eax, [esp + 0x1254]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str._:hash:InternetCrackUrlA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2cc], eax
push str._:hash:InternetCrackUrlW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2d0], eax
push str._:hash:InternetSetOptionA
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2d4], eax
push str._:hash:InternetSetOptionW
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2d8], eax
push str._:hash:InternetReadFile
push dword [edi + 0x14]
call fcn.004064a8
mov dword [edi + 0x2dc], eax
or dword [edi], 0x800
add esp, 0x28
call fcn.00404576
cmp eax, 3
jae 0x402e30
push str.8080
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402e30
push eax
call ebp
test bl, 4
je 0x40333b
test byte [edi], 4
jne 0x40333b
call fcn.00404576
cmp eax, 3
jae 0x402e5f
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x18c]
push str._:text:USER32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 5
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x20], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.004015ab
test esi, esi
je 0x40333b
push str._:hash:AppendMenuW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2e0], eax
push str._:hash:BringWindowToTop
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2e4], eax
push str._:hash:CallNextHookEx
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2e8], eax
push str._:hash:CheckMenuItem
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2ec], eax
push str._:hash:CloseDesktop
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2f0], eax
push str._:hash:CreateDesktopW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2f4], eax
push str._:hash:CreatePopupMenu
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x2f8], eax
push str._:hash:CreateWindowExW
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x2fc], eax
push str._:hash:DefWindowProcW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x300], eax
push str._:hash:DestroyWindow
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x304], eax
push str._:hash:DispatchMessageW
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0x308], eax
call fcn.00404576
cmp eax, 3
jae 0x402f9a
push str.440440
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402f9a
push eax
call ebp
push str._:hash:EnumWindows
push dword [edi + 0x20]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0x30c], eax
call fcn.00404576
xor esi, esi
cmp eax, 3
jae 0x402fd6
push str.Local224
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x402fd6
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:FindWindowA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x310], eax
push str._:hash:FindWindowW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x314], eax
push str._:hash:GetClientRect
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x318], eax
push str._:hash:GetCursorPos
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x31c], eax
push str._:hash:GetDesktopWindow
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x320], eax
push str._:hash:GetDlgItem
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x324], eax
push str._:hash:GetLastInputInfo
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x328], eax
push str._:hash:GetMessageW
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x32c], eax
push str._:hash:GetParent
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x330], eax
push str._:hash:GetSystemMetrics
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x334], eax
call fcn.00404576
cmp eax, 3
jae 0x4030b3
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:GetThreadDesktop
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x338], eax
push str._:hash:GetWindowRect
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x33c], eax
push str._:hash:GetWindowTextA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x340], eax
push str._:hash:GetWindowTextW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x344], eax
push str._:hash:GetWindowThreadProcessId
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x348], eax
push str._:hash:LoadIconW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x34c], eax
push str._:hash:MessageBoxA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x350], eax
push str._:hash:MessageBoxW
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x354], eax
push str._:hash:MsgWaitForMultipleObjects
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x358], eax
push str._:hash:PeekMessageW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x35c], eax
push str._:hash:PostMessageA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x360], eax
push str._:hash:PostMessageW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x364], eax
push str._:hash:PostQuitMessage
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x28
mov dword [edi + 0x368], eax
call fcn.00404576
cmp eax, 3
jae 0x4031cc
push str.437437
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4031cc
push eax
call ebp
push str._:hash:RedrawWindow
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x36c], eax
push str._:hash:RegisterClassExW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x370], eax
push str._:hash:RegisterWindowMessageW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x374], eax
push str._:hash:SendMessageA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x378], eax
push str._:hash:SendMessageW
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x37c], eax
push str._:hash:SetFocus
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x380], eax
push str._:hash:SetForegroundWindow
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x384], eax
push str._:hash:SetThreadDesktop
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x388], eax
push str._:hash:SetWindowPos
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x38c], eax
push str._:hash:SetWindowsHookExA
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x390], eax
push str._:hash:SetWindowsHookExW
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0x394], eax
call fcn.00404576
cmp eax, 3
jae 0x4032ba
push str.Global119
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:ShowWindow
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x398], eax
push str._:hash:TrackPopupMenu
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x39c], eax
push str._:hash:TranslateMessage
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x18
mov dword [edi + 0x3a0], eax
call fcn.00404576
cmp eax, 3
jae 0x40330f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:UnhookWindowsHookEx
push dword [edi + 0x20]
call fcn.004064a8
mov dword [edi + 0x3a4], eax
push str._:hash:UpdateWindow
push dword [edi + 0x20]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x3a8], eax
or dword [edi], 4
test bl, 8
je 0x403429
test byte [edi], 8
jne 0x403429
lea eax, [esp + 0xcc]
push str._:text:SHELL32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 6
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x24], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.004015ab
test esi, esi
je 0x403429
call fcn.00404576
cmp eax, 3
jae 0x4033b1
push str.352352
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4033b1
push eax
call ebp
push str._:hash:Shell_NotifyIconW
push dword [edi + 0x24]
call fcn.004064a8
mov dword [edi + 0x3ac], eax
push str._:hash:ShellExecuteExA
push dword [edi + 0x24]
call fcn.004064a8
mov dword [edi + 0x3b0], eax
push str._:hash:ShellExecuteExW
push dword [edi + 0x24]
call fcn.004064a8
mov dword [edi + 0x3b4], eax
push str._:hash:SHGetFolderPathA
push dword [edi + 0x24]
call fcn.004064a8
mov dword [edi + 0x3b8], eax
push str._:hash:SHGetFolderPathW
push dword [edi + 0x24]
call fcn.004064a8
mov dword [edi + 0x3bc], eax
push str._:hash:SHGetKnownFolderPath
push dword [edi + 0x24]
call fcn.004064a8
add esp, 0x30
mov dword [edi + 0x3c0], eax
or dword [edi], 8
test bl, 0x20
je 0x40348f
test byte [edi], 0x20
jne 0x40348f
lea eax, [esp + 0x1ec]
push str._:text:MSHTML.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 7
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x18], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x1ec]
call fcn.004015ab
test esi, esi
je 0x40348f
push str._:hash:ShowHTMLDialog
push dword [edi + 0x18]
call fcn.004064a8
pop ecx
mov dword [edi + 0x3cc], eax
or dword [edi], 0x20
pop ecx
test bl, 0x40
je 0x403509
test byte [edi], 0x40
jne 0x403509
lea eax, [esp + 0xfc]
push str._:text:URLMON.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 8
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x1c], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0xfc]
call fcn.004015ab
test esi, esi
je 0x403509
push str._:hash:CreateURLMoniker
push dword [edi + 0x1c]
call fcn.004064a8
mov dword [edi + 0x3d0], eax
push str._:hash:CreateURLMonikerEx
push dword [edi + 0x1c]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x3d4], eax
or dword [edi], 0x40
test bl, bl
jns 0x40357f
test byte [edi], 0x80
jne 0x40357f
lea eax, [esp + 0x24]
push str._:text:GDI32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 9
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x2c], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.004015ab
test esi, esi
je 0x40357f
push str._:hash:GetStockObject
push dword [edi + 0x2c]
call fcn.004064a8
mov dword [edi + 0x3d8], eax
push str._:hash:CreateFontW
push dword [edi + 0x2c]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x3dc], eax
or dword [edi], 0x80
mov ebp, 0x100
test ebp, ebx
je 0x40368f
test dword [edi], ebp
jne 0x40368f
lea eax, [esp + 0x12c]
push str._:text:OLE32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xa
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x30], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x12c]
call fcn.004015ab
test esi, esi
je 0x40368f
push str._:hash:CoCreateInstance
push dword [edi + 0x30]
call fcn.004064a8
mov dword [edi + 0x3e0], eax
push str._:hash:CoInitialize
push dword [edi + 0x30]
call fcn.004064a8
mov dword [edi + 0x3e4], eax
push str._:hash:CoInitializeEx
push dword [edi + 0x30]
call fcn.004064a8
mov dword [edi + 0x3e8], eax
push str._:hash:CoUninitialize
push dword [edi + 0x30]
call fcn.004064a8
mov dword [edi + 0x3ec], eax
push str._:hash:CoCreateGuid
push dword [edi + 0x30]
call fcn.004064a8
mov dword [edi + 0x3f0], eax
push str._:hash:CoTaskMemFree
push dword [edi + 0x30]
call fcn.004064a8
add esp, 0x30
mov dword [edi + 0x3f4], eax
call fcn.00404576
cmp eax, 3
jae 0x403678
push str.Global844
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403678
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:StringFromGUID2
push dword [edi + 0x30]
call fcn.004064a8
pop ecx
mov dword [edi + 0x3f8], eax
or dword [edi], ebp
pop ecx
mov eax, 0x200
test eax, ebx
je 0x4037a9
test dword [edi], eax
jne 0x4037a9
call fcn.00404576
xor ebp, ebp
cmp eax, 3
jae 0x4036bf
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x1a4]
push str._:text:OLEAUT32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xb
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x34], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x1a4]
call fcn.004015ab
test esi, esi
je 0x4037a9
call fcn.00404576
cmp eax, 3
jae 0x403728
push ebp
push 1
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x403728
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:VariantClear
push dword [edi + 0x34]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0x3fc], eax
call fcn.00404576
cmp eax, 3
jae 0x403754
push str.Global672
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:VariantInit
push dword [edi + 0x34]
call fcn.004064a8
mov dword [edi + 0x400], eax
push str._:hash:VariantChangeType
push dword [edi + 0x34]
call fcn.004064a8
mov dword [edi + 0x404], eax
push str._:hash:SysAllocString
push dword [edi + 0x34]
call fcn.004064a8
mov dword [edi + 0x408], eax
push str._:hash:SysFreeString
push dword [edi + 0x34]
call fcn.004064a8
add esp, 0x20
mov dword [edi + 0x40c], eax
or dword [edi], 0x200
mov ebp, 0x1000
test ebp, ebx
je 0x4038a1
test dword [edi], ebp
jne 0x4038a1
lea eax, [esp + 0x3c]
push str._:text:VERSION.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xc
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x38], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.004015ab
test esi, esi
je 0x4038a1
push str._:hash:GetFileVersionInfoSizeA
push dword [edi + 0x38]
call fcn.004064a8
mov dword [edi + 0x414], eax
push str._:hash:GetFileVersionInfoSizeW
push dword [edi + 0x38]
call fcn.004064a8
mov dword [edi + 0x418], eax
push str._:hash:GetFileVersionInfoA
push dword [edi + 0x38]
call fcn.004064a8
mov dword [edi + 0x41c], eax
push str._:hash:GetFileVersionInfoW
push dword [edi + 0x38]
call fcn.004064a8
add esp, 0x20
mov dword [edi + 0x420], eax
call fcn.00404576
cmp eax, 3
jae 0x403876
push str.Global785
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403876
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:VerQueryValueA
push dword [edi + 0x38]
call fcn.004064a8
mov dword [edi + 0x424], eax
push str._:hash:VerQueryValueW
push dword [edi + 0x38]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x428], eax
or dword [edi], ebp
mov esi, 0x2000
test esi, ebx
je 0x4039f8
test dword [edi], esi
jne 0x4039f8
lea eax, [esp + 0x54]
push str._:text:PSAPI.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xd
push eax
mov ecx, edi
call fcn.00403d3d
test eax, eax
mov dword [edi + 0x3c], eax
sete bl
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x54]
call fcn.004015ab
test bl, bl
je 0x403935
lea eax, [esp + 0x84]
push str._:text:KERNEL32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xe
push eax
mov ecx, edi
call fcn.00403d3d
mov dword [edi + 0x3c], eax
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x84]
call fcn.004015ab
cmp dword [edi + 0x3c], 0
je 0x4039f1
push str._:hash:EnumProcesses
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x448], eax
push str._:hash:EnumProcessModules
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x44c], eax
push str._:hash:GetProcessMemoryInfo
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x450], eax
push str._:hash:GetModuleBaseNameA
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x454], eax
push str._:hash:GetModuleBaseNameW
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x458], eax
push str._:hash:GetModuleFileNameExA
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x45c], eax
push str._:hash:GetModuleFileNameExW
push dword [edi + 0x3c]
call fcn.004064a8
mov dword [edi + 0x460], eax
push str._:hash:GetProcessImageFileNameA
push dword [edi + 0x3c]
call fcn.004064a8
add esp, 0x40
mov dword [edi + 0x464], eax
push str._:hash:GetProcessImageFileNameW
push dword [edi + 0x3c]
call fcn.004064a8
pop ecx
mov dword [edi + 0x468], eax
or dword [edi], esi
pop ecx
mov ebx, dword [esp + 0x167c]
mov ebp, 0x4000
test ebp, ebx
je 0x403a9e
test dword [edi], ebp
jne 0x403a9e
lea eax, [esp + 0xb4]
push str._:text:IPHLPAPI.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0xf
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x40], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.004015ab
test esi, esi
je 0x403a9e
push str._:hash:GetAdaptersInfo
push dword [edi + 0x40]
call fcn.004064a8
pop ecx
pop ecx
mov dword [edi + 0x410], eax
call fcn.00404576
cmp eax, 3
jae 0x403a7f
push str.Global326
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
or dword [edi], ebp
call fcn.00404576
cmp eax, 3
jae 0x403a9e
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ebp, 0x8000
test ebp, ebx
je 0x403b6e
test dword [edi], ebp
jne 0x403b6e
lea eax, [esp + 0xe4]
push str._:text:USERENV.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0x10
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x44], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0xe4]
call fcn.004015ab
test esi, esi
je 0x403b6e
push str._:hash:CreateEnvironmentBlock
push dword [edi + 0x44]
call fcn.004064a8
mov dword [edi + 0x42c], eax
push str._:hash:DestroyEnvironmentBlock
push dword [edi + 0x44]
call fcn.004064a8
mov dword [edi + 0x430], eax
push str._:hash:LoadUserProfileW
push dword [edi + 0x44]
call fcn.004064a8
mov dword [edi + 0x434], eax
push str._:hash:LoadUserProfileA
push dword [edi + 0x44]
call fcn.004064a8
mov dword [edi + 0x438], eax
push str._:hash:UnloadUserProfileW
push dword [edi + 0x44]
call fcn.004064a8
mov dword [edi + 0x43c], eax
push str._:hash:UnloadUserProfileA
push dword [edi + 0x44]
call fcn.004064a8
add esp, 0x30
mov dword [edi + 0x440], eax
or dword [edi], ebp
mov ebp, 0x10000
test ebp, ebx
je 0x403bd6
test dword [edi], ebp
jne 0x403bd6
lea eax, [esp + 0x114]
push str._:text:WTSAPI32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0x11
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x48], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x114]
call fcn.004015ab
test esi, esi
je 0x403bd6
push str._:hash:WTSQueryUserToken
push dword [edi + 0x48]
call fcn.004064a8
pop ecx
mov dword [edi + 0x444], eax
or dword [edi], ebp
pop ecx
mov ebp, 0x20000
test ebp, ebx
je 0x403c52
test dword [edi], ebp
jne 0x403c52
lea eax, [esp + 0x144]
push str._:text:NETAPI32.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0x12
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x4c], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x144]
call fcn.004015ab
test esi, esi
je 0x403c52
push str._:hash:NetUserGetInfo
push dword [edi + 0x4c]
call fcn.004064a8
mov dword [edi + 0x46c], eax
push str._:hash:NetApiBufferFree
push dword [edi + 0x4c]
call fcn.004064a8
add esp, 0x10
mov dword [edi + 0x470], eax
or dword [edi], ebp
mov ebp, 0x40000
test ebp, ebx
je 0x403d23
test dword [edi], ebp
jne 0x403d23
lea eax, [esp + 0x174]
push str._:text:IEFRAME.dll
push eax
call fcn.00405db8
pop ecx
pop ecx
mov dword [esp + 0x1670], 0x13
push eax
mov ecx, edi
call fcn.00403d3d
mov esi, eax
mov dword [edi + 0x50], esi
or dword [esp + 0x1670], 0xffffffff
lea ecx, [esp + 0x174]
call fcn.004015ab
test esi, esi
je 0x403d23
push str._:hash:IERegisterWritableRegistryKey
push dword [edi + 0x50]
call fcn.004064a8
mov dword [edi + 0x474], eax
push str._:hash:IERegisterWritableRegistryValue
push dword [edi + 0x50]
call fcn.004064a8
mov dword [edi + 0x478], eax
push str._:hash:IEGetWriteableHKCU
push dword [edi + 0x50]
call fcn.004064a8
mov dword [edi + 0x47c], eax
push str._:hash:IEIsProtectedModeProcess
push dword [edi + 0x50]
call fcn.004064a8
mov dword [edi + 0x480], eax
or dword [edi], ebp
add esp, 0x20
call fcn.00404576
cmp eax, 3
jae 0x403d23
push str.Global910
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403d23
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [edi]
mov ecx, dword [esp + 0x1668]
pop edi
pop esi
pop ebp
and eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4