Function at 0x419f90
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Create thread
Get session user name
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14c4
call fcn.0042f7c0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x513244], eax
call fcn.0040cf10
test al, al
je 0x419fc4
call fcn.004124e0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x419fe6
call edi
mov esi, dword [0x529228]
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
push dword [esi + 4]
push esi
call fcn.0041d3c0
mov edx, dword [0x52922c]
mov ecx, 0xffffffe
sub ecx, edx
mov edi, eax
cmp ecx, 1
jb 0x41b669
inc edx
lea ecx, [esp + 0x3e8]
mov dword [0x52922c], edx
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
call fcn.00419d10
mov esi, dword [0x513268]
push eax
push dword [esi + 4]
push esi
call fcn.0041d340
mov edx, dword [0x51326c]
mov ecx, 0x1cb189
sub ecx, edx
mov edi, eax
cmp ecx, 1
jb 0x41b673
inc edx
lea ecx, [esp + 0x3e8]
mov dword [0x51326c], edx
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
call fcn.0041b680
mov esi, dword [0x513268]
lea ecx, [esp + 0x90]
xor bl, bl
mov byte [esp + 0x30], 0
push 0x400
mov dword [esp + 0x40], ebx
mov esi, dword [esi]
mov dword [esp + 0x10], esi
mov dword [esp + 0x48], esi
call fcn.00413a90
mov edi, dword [esp + 0x90]
push 0x400
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esp + 0x5c]
xor eax, eax
mov dword [esp + 0xcc], 7
push dword [esp + 0x98]
lea ecx, [esp + 0xbc]
mov dword [esp + 0xcc], 0
push edi
mov word [esp + 0xc0], ax
call fcn.00418400
lea edi, [esi + 0x10]
lea eax, [esp + 0xb4]
cmp edi, eax
je 0x41a140
cmp dword [edi + 0x14], 8
jb 0x41a11e
push dword [edi]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov ecx, edi
mov word [edi], ax
lea eax, [esp + 0xb4]
push eax
call fcn.004145a0
cmp dword [esp + 0xc8], 8
jb 0x41a159
push dword [esp + 0xb4]
call fcn.00422587
add esp, 4
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x38], eax
push dword [eax]
lea eax, [esp + 0xcd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, 1
cmp dword [esp + 0x40], edi
jle 0x41a33d
mov ecx, dword [esp + 0x38]
lea eax, [ecx + 0x14]
mov dword [esp + 0x10], eax
lea ebx, [ecx + 0xc]
lea eax, [ecx + 0x10]
mov dword [esp + 0x34], eax
jmp 0x41a1b4
mov ecx, dword [esp + 0x38]
push str.__Admin
push dword [ecx + edi*4]
call fcn.00420235
add esp, 8
test eax, eax
mov eax, dword [esp + 0x38]
jne 0x41a22e
push dword [eax + edi*4 + 4]
push str.IsAutoStart
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [esp + 0x30]
test eax, eax
push dword [ebx]
movzx ecx, cl
mov eax, 1
cmove ecx, eax
push str.IsTask
mov dword [esp + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [esp + 0x3c]
test eax, eax
mov eax, 1
movzx ecx, cl
cmove ecx, eax
mov byte [0x513235], al
mov eax, dword [esp + 0x10]
add edi, 2
add dword [esp + 0x34], 8
add ebx, 8
mov dword [esp + 0x3c], ecx
add eax, 8
jmp 0x41a323
push str.__ForNetRes
push dword [eax + edi*4]
call fcn.00420235
add esp, 8
test eax, eax
mov eax, dword [esp + 0x38]
jne 0x41a2cd
push dword [eax + edi*4 + 4]
mov byte [0x513234], 1
push 0x51a7c0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebx]
push 0x521cf0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x34]
push dword [eax]
push str.IsAutoStart
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edx, dword [esp + 0x30]
test eax, eax
movzx ecx, dl
mov eax, 1
cmove ecx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], cl
push dword [eax]
push str.IsTask
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edx, dword [esp + 0x3c]
test eax, eax
mov eax, 1
movzx ecx, dl
cmove ecx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x34], 0x10
add edi, 4
add ebx, 0x10
mov byte [esp + 0x3c], cl
add eax, 0x10
jmp 0x41a323
push str.__Task
push dword [eax + edi*4]
call fcn.00420235
add esp, 8
test eax, eax
jne 0x41a2e8
mov byte [esp + 0x3c], 1
jmp 0x41a31f
mov eax, dword [esp + 0x38]
push str.__AutoStart
push dword [eax + edi*4]
call fcn.00420235
add esp, 8
test eax, eax
jne 0x41a307
mov byte [esp + 0x30], 1
jmp 0x41a31f
mov eax, dword [esp + 0x38]
push str.__Service
push dword [eax + edi*4]
call fcn.00420235
add esp, 8
test eax, eax
je 0x41a361
mov eax, dword [esp + 0x10]
add dword [esp + 0x34], 4
inc edi
add eax, 4
add ebx, 4
mov dword [esp + 0x10], eax
cmp edi, dword [esp + 0x40]
jl 0x41a1b0
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp byte [0x513235], 0
je 0x41a45c
call fcn.00412220
cmp eax, 2
jmp 0x41a464
mov ebx, dword [esp + 0x38]
push dword [ebx + edi*4 + 4]
call fcn.00423c92
add esp, 4
mov esi, eax
mov dword [esp + 0x44], esi
push dword [ebx + edi*4 + 8]
push 0x51a7c0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebx + edi*4 + 0xc]
push 0x521cf0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41a402
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
sete al
test al, al
je 0x41a402
call fcn.00411ab0
test al, al
jne 0x41a3e2
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x44]
jmp 0x41a395
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x90]
xor esi, esi
call fcn.00413b10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
xor edx, edx
call fcn.00411cd0
add esp, 4
mov byte [0x529224], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x44]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x90]
xor esi, esi
call fcn.00413b10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00412220
cmp eax, 1
jle 0x41a47f
lea ecx, [esp + 0x90]
xor esi, esi
call fcn.00413b10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50fec0
call fcn.0040ef50
mov ebx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0xb0], 0xf
xor edi, edi
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
mov edx, dword [ebx + edi*4]
cmp byte [edx], 0
jne 0x41a4c2
xor ecx, ecx
jmp 0x41a4db
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
jmp 0x41a4d0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a4d0
sub ecx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0xa4]
call fcn.00413ea0
inc edi
cmp edi, 0xa
jl 0x41a4b6
cmp dword [esp + 0xb0], 0x10
lea eax, [esp + 0x9c]
cmovae eax, dword [esp + 0x9c]
push eax
call fcn.00423c24
mov dword [esi + 0x8cc], eax
lea edx, [esp + 0x134]
xor eax, eax
mov dword [esp + 0x100], 7
add esp, 4
mov word [esp + 0xe8], ax
mov dword [esp + 0x140], eax
mov word [esp + 0x130], ax
lea eax, [esp + 0xe8]
mov dword [esp + 0xf8], 0
push eax
mov dword [esp + 0x148], 7
call fcn.00411cd0
mov eax, dword [esp + 0x34]
add esp, 4
mov ebx, dword [esp + 0x3c]
test al, al
jne 0x41a6ea
test bl, bl
jne 0x41a6ea
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xffffffffffffffff
push eax
mov word [esp + 0x20], ax
lea ecx, [esp + 0x20]
lea eax, [esp + 0xf0]
mov dword [esp + 0x30], 0
push eax
call fcn.00414690
mov edi, dword [esi + 0x8cc]
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x38]
push eax
call fcn.00414690
mov ecx, edi
call fcn.0040d240
add esp, 0x18
cmp dword [esp + 0x2c], 8
jb 0x41a5f1
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
mov eax, dword [esp + 0x30]
cmp byte [0x513235], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jne 0x41a6f9
test al, al
jne 0x41a702
test bl, bl
jne 0x41a702
cmp byte [0x513234], bl
jne 0x41a8b6
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x41a6f9
push str.__Admin
lea eax, [esp + 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str._IsNotAutoStart
lea eax, [esp + 0x3ec]
push eax
call edi
push str._IsNotTask
lea eax, [esp + 0x3ec]
push eax
call edi
push 0x38
lea eax, [esp + 0x1b4]
push 0
push eax
call fcn.0042b420
lea eax, [esp + 0xcdc]
mov dword [esp + 0x1b8], 0x3c
mov dword [esp + 0x1c8], eax
add esp, 0xc
lea eax, [esp + 0x3e8]
mov dword [esp + 0x1b0], 0
mov dword [esp + 0x1c0], eax
lea eax, [esi + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41a6b4
mov eax, dword [eax]
mov dword [esp + 0x1c4], eax
lea eax, [esp + 0x1ac]
push eax
mov dword [esp + 0x1cc], 5
mov dword [esp + 0x1bc], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41a6fe
xor esi, esi
jmp 0x41b62e
mov dword [esi + 0x8cc], 0
jmp 0x41a5f5
call fcn.00411a10
mov eax, dword [esp + 0x30]
cmp byte [0x513234], 0
jne 0x41a8b6
test al, al
jne 0x41a7dc
test bl, bl
jne 0x41a7dc
push 0x10
lea edx, [esp + 0x14]
mov ecx, 0x50ffe0
call fcn.0040ef50
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x8c], 0xf
xor edi, edi
mov dword [esp + 0x88], 0
mov byte [esp + 0x78], bl
mov edx, dword [esi + edi*4]
cmp byte [edx], 0
jne 0x41a75e
xor ecx, ecx
jmp 0x41a76c
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a763
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x80]
call fcn.00413ea0
inc edi
cmp edi, 0x10
jl 0x41a752
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x78]
add ecx, 0x8d0
cmp ecx, eax
je 0x41a79c
push 0xffffffffffffffff
push 0
push eax
call fcn.00413ff0
mov eax, dword [0x513268]
push 0x513258
push 0
mov eax, dword [eax + 4]
add eax, 8
push eax
push 0x41dbd0
push 0x61a8000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0x8c], 0x10
mov dword [0x513254], eax
jb 0x41a7dc
push dword [esp + 0x78]
call fcn.00422587
add esp, 4
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50fe90
call fcn.0040ef50
add esp, 4
xor esi, esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4]
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax*2 + 2]
push edi
call fcn.00420c62
add esp, 4
mov ebx, eax
push edi
push 0
push ebx
call fcn.0042b420
add esp, 0xc
shr edi, 1
push edi
push ebx
push 0xffffffffffffffff
push dword [esp + 0x40]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push 0x513290
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc esi
cmp esi, 0xa
jl 0x41a7f1
push 0x51a7c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x41a8a0
mov ecx, 0x513278
call fcn.0040e760
mov edx, dword [esp + 0x30]
push 0x51325c
push 0
push 0x513270
push 0x41e690
push 0x61a8000
mov byte [0x529225], dl
mov edx, dword [esp + 0x50]
push 0
mov byte [0x529226], dl
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x513260], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.1D6FC66E_D1F3_422C_8A53_C0BBCF3D900D
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x513238], eax
jmp 0x41a8ca
push str.FBB4BCC6_05C7_4ADD_B67B_A98A697323C1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x513230], eax
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50ff80
call fcn.0040ef50
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x174], 0xf
xor edi, edi
mov dword [esp + 0x170], 0
mov byte [esp + 0x160], 0
mov edx, dword [esi + edi*4]
cmp byte [edx], 0
jne 0x41a90d
xor ecx, ecx
jmp 0x41a91b
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a912
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x168]
call fcn.00413ea0
inc edi
cmp edi, 0xa
jl 0x41a901
sub esp, 0x18
mov dword [esp + 0x28], 0
mov edx, esp
lea edi, [esp + 0x28]
xor eax, eax
xor bl, bl
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x51a7c0], ax
jne 0x41a962
xor ecx, ecx
jmp 0x41a97f
mov ecx, 0x51a7c0
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a970
sub ecx, esi
sar ecx, 1
push ecx
push 0x51a7c0
mov ecx, edx
call fcn.00415c10
mov dl, bl
lea ecx, [esp + 0x30]
call fcn.00412840
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x41a9a2
mov eax, dword [eax]
mov edx, edi
mov ecx, eax
call fcn.00410fc0
cmp dword [esp + 0x2c], 0x10
mov esi, dword [esp + 0xc]
jb 0x41a9c2
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x20
je 0x41a9d8
xor esi, esi
jmp 0x41b622
sub esp, 0x18
xor eax, eax
mov edx, esp
xor bl, bl
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x51a7c0], ax
jne 0x41a9ff
xor ecx, ecx
jmp 0x41aa16
mov ecx, 0x51a7c0
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41aa07
sub ecx, edi
sar ecx, 1
push ecx
push 0x51a7c0
mov ecx, edx
call fcn.00415c10
mov dl, bl
lea ecx, [esp + 0x30]
call fcn.00412840
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x41aa39
mov eax, dword [eax]
push eax
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x2c], 0x10
jb 0x41aa57
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
cmp word [0x521cf0], 0
jne 0x41aa65
xor ecx, ecx
jmp 0x41aa7f
mov ecx, 0x521cf0
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41aa70
sub ecx, edx
sar ecx, 1
push ecx
push 0x521cf0
lea ecx, [esi + 0x858]
call fcn.00415c10
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50ffb0
call fcn.0040ef50
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x12c], 0xf
xor edi, edi
mov dword [esp + 0x128], 0
mov byte [esp + 0x118], 0
mov edx, dword [esi + edi*4]
cmp byte [edx], 0
jne 0x41aad3
xor ecx, ecx
jmp 0x41aae1
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41aad8
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x120]
call fcn.00413ea0
inc edi
cmp edi, 0xa
jl 0x41aac7
sub esp, 0x18
lea eax, [esp + 0x130]
mov ecx, esp
xor bl, bl
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], bl
call fcn.00413ff0
mov dl, bl
lea ecx, [esp + 0x30]
call fcn.00412900
mov ebx, dword [esp + 0x24]
mov edi, eax
add ebx, 0x828
add esp, 0x18
cmp ebx, edi
je 0x41aba2
cmp dword [ebx + 0x14], 8
jb 0x41ab4b
push dword [ebx]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp dword [edi + 0x14], 8
jae 0x41ab79
mov eax, dword [edi + 0x10]
inc eax
je 0x41ab83
add eax, eax
push eax
push edi
push ebx
call fcn.004205a0
add esp, 0xc
jmp 0x41ab83
mov eax, dword [edi]
mov dword [ebx], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [esp + 0x2c], 8
jb 0x41abb5
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50fef0
call fcn.0040ef50
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x114], 0xf
xor edi, edi
mov dword [esp + 0x110], 0
mov byte [esp + 0x100], 0
lea esp, [esp]
mov edx, dword [esi + edi*4]
cmp byte [edx], 0
jne 0x41abfc
xor ecx, ecx
jmp 0x41ac0a
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ac01
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x108]
call fcn.00413ea0
inc edi
cmp edi, 0xa
jl 0x41abf0
sub esp, 0x18
lea eax, [esp + 0x118]
mov ecx, esp
xor bl, bl
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], bl
call fcn.00413ff0
mov dl, bl
lea ecx, [esp + 0x30]
call fcn.00412900
mov ebx, dword [esp + 0x24]
mov edi, eax
add ebx, 0x840
add esp, 0x18
cmp ebx, edi
je 0x41accb
cmp dword [ebx + 0x14], 8
jb 0x41ac74
push dword [ebx]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp dword [edi + 0x14], 8
jae 0x41aca2
mov eax, dword [edi + 0x10]
inc eax
je 0x41acac
add eax, eax
push eax
push edi
push ebx
call fcn.004205a0
add esp, 0xc
jmp 0x41acac
mov eax, dword [edi]
mov dword [ebx], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [esp + 0x2c], 8
jb 0x41acde
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0xa
lea edx, [esp + 0x14]
mov ecx, 0x50ff20
call fcn.0040ef50
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x15c], 0xf
xor edi, edi
mov dword [esp + 0x158], 0
mov byte [esp + 0x148], 0
mov edx, dword [esi + edi*4]
cmp byte [edx], 0
jne 0x41ad21
xor ecx, ecx
jmp 0x41ad2f
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ad26
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x150]
call fcn.00413ea0
inc edi
cmp edi, 0xa
jl 0x41ad15
sub esp, 0x18
lea eax, [esp + 0x160]
mov ecx, esp
xor bl, bl
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], bl
call fcn.00413ff0
mov dl, bl
lea ecx, [esp + 0x30]
call fcn.00412900
mov esi, dword [esp + 0x24]
mov edi, eax
add esp, 0x18
lea ebx, [esi + 0x870]
cmp ebx, edi
je 0x41adf0
cmp dword [ebx + 0x14], 8
jb 0x41ad99
push dword [ebx]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp dword [edi + 0x14], 8
jae 0x41adc7
mov eax, dword [edi + 0x10]
inc eax
je 0x41add1
add eax, eax
push eax
push edi
push ebx
call fcn.004205a0
add esp, 0xc
jmp 0x41add1
mov eax, dword [edi]
mov dword [ebx], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [esp + 0x2c], 8
jb 0x41ae03
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0xb
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Windows_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
add esi, 0x888
push eax
mov ecx, esi
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41ae4f
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x27
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_Files__x86_Mozilla_Firefox_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41ae95
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x29
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_Files__x86_Internet_Explorer_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41aedb
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x1e
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_Files__x86_Google_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41af21
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x21
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_FilesMozilla_Firefox_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41af67
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x23
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_FilesInternet_Explorer_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41afad
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push 0x18
xor eax, eax
mov dword [esp + 0x30], 7
push str.C:Program_FilesGoogle_
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00413580
cmp dword [esp + 0x2c], 8
jb 0x41aff3
push dword [esp + 0x18]
call fcn.00422587
add esp, 4
push str.D:Windows_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea ecx, [esp + 0x44]
call fcn.00415200
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
push ecx
mov ecx, eax
call fcn.00415610
lea ecx, [eax + 0x880]
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_Files__x86_Mozilla_Firefox_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea ecx, [esp + 0x44]
call fcn.00413920
mov edi, eax
lea eax, [esp + 0x18]
push eax
lea ebx, [edi + 0x880]
mov ecx, ebx
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_Files__x86_Internet_Explorer_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_Files__x86_Google_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_FilesMozilla_Firefox_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_FilesInternet_Explorer_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
push str.D:Program_FilesGoogle_
lea ecx, [esp + 0x1c]
call fcn.00413100
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00413580
lea ecx, [esp + 0x18]
call fcn.00413210
lea esi, [edi + 0x868]
push 0
mov ecx, esi
call fcn.00413490
cmp word [eax], 0x2e
je 0x41b144
push esi
lea ecx, [esp + 0x1c]
call fcn.0041cdd0
add esp, 4
mov ecx, esi
push eax
call fcn.004131d0
lea ecx, [esp + 0x18]
call fcn.00413210
push ebx
lea ecx, [esp + 0x1c]
call fcn.00413560
mov ecx, eax
call fcn.0041c140
lea ecx, [esp + 0x18]
call fcn.00413600
push 0xa
lea edx, [esp + 0x10]
mov ecx, 0x50ff50
call fcn.0040ef50
add esp, 4
lea ecx, [esp + 0x194]
call fcn.00412c20
mov ebx, dword [esp + 0xc]
xor esi, esi
jmp 0x41b190
push dword [ebx + esi*4]
lea ecx, [esp + 0x198]
call fcn.00412de0
inc esi
cmp esi, 0xa
jl 0x41b190
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0x100
push eax
lea eax, [esp + 0x1ec]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0x18]
call fcn.00413930
sub esp, 0x18
mov ecx, esp
push 0x50438c
call fcn.00412c40
sub esp, 0x18
lea eax, [esp + 0x1c4]
mov ecx, esp
push eax
call fcn.00412bf0
lea ecx, [esp + 0x48]
call fcn.0040ecb0
add esp, 0x30
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
call fcn.0041c410
lea ecx, [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
call fcn.0041c420
push eax
lea ecx, [esp + 0x10]
call fcn.0041c450
test al, al
je 0x41b2f5
lea ebx, [ebx]
lea ecx, [esp + 0xc]
call fcn.0041c430
mov ecx, eax
call fcn.00412f40
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00412c40
xor dl, dl
lea ecx, [esp + 0x78]
call fcn.00412900
add esp, 0x18
lea ecx, [edi + 0x880]
push eax
call fcn.00413580
lea ecx, [esp + 0x60]
call fcn.00413210
lea eax, [esp + 0x1e8]
push eax
lea ecx, [esp + 0xd0]
call fcn.00413100
push eax
push 0x504390
lea ecx, [esp + 0x68]
call fcn.00413100
lea ecx, [edi + 0x880]
mov esi, eax
call fcn.00413660
dec eax
lea ecx, [edi + 0x880]
push eax
call fcn.004136a0
mov edx, esi
mov ecx, eax
call fcn.0040f1f0
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00413210
lea ecx, [esp + 0xcc]
call fcn.00413210
lea ecx, [esp + 0xc]
call fcn.0041c440
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041c420
push eax
lea ecx, [esp + 0x10]
call fcn.0041c450
test al, al
jne 0x41b230
lea eax, [esp + 0x130]
push eax
lea ecx, [edi + 0x880]
call fcn.004136c0
lea ecx, [esp + 0x44]
call fcn.0040ca70
sub esp, 0x18
lea eax, [edi + 0x850]
mov ecx, esp
push eax
call fcn.004130b0
call fcn.0040c740
add esp, 0x18
call fcn.0041c2f0
mov edx, str.I:5d2860c89d774.jpg
mov ecx, eax
call fcn.004111c0
mov ecx, dword [ebp + 8]
call fcn.0041ba10
mov ecx, dword [ebp + 8]
call fcn.0041ba80
test eax, eax
jne 0x41b356
xor esi, esi
jmp 0x41b5e9
mov eax, dword [0x51323c]
lea ecx, [esp + 0x60]
mov dword [edi + 0x8c0], 0
mov dword [edi], eax
call fcn.00413560
lea ecx, [esp + 0x60]
call fcn.00410a50
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x48]
call fcn.00413560
mov ecx, eax
call fcn.0041c140
lea ecx, [esp + 0x44]
call fcn.00413600
push 0x5043d4
lea ecx, [esp + 0x48]
call fcn.00413100
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x64]
call fcn.00413580
lea ecx, [esp + 0x44]
call fcn.00413210
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x64]
call fcn.00413640
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x64]
call fcn.00413650
push eax
lea ecx, [esp + 0x10]
call fcn.00413900
test al, al
je 0x41b48b
mov ebx, dword [esp + 0x34]
mov edi, edi
lea ecx, [esp + 0x10]
call fcn.0041f110
push eax
call fcn.0041c330
lea ecx, [esp + 0x3e8]
call fcn.00419d10
push eax
call fcn.0041c240
lea ecx, [esp + 0x3e8]
call fcn.0041b680
call fcn.0041c2f0
inc dword [edi + 0x8c0]
mov esi, eax
push ebx
mov ecx, esi
call fcn.0041b8b0
lea ecx, [esp + 0xc]
call fcn.0041c470
mov ecx, eax
call fcn.004134b0
push eax
lea ecx, [esi + 0x8a4]
call fcn.00413260
push esi
mov byte [esi + 0x8e0], 1
call fcn.0041c3d0
mov ecx, eax
call fcn.0041fa10
lea ecx, [esp + 0xc]
call fcn.004138d0
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x64]
call fcn.00413650
push eax
lea ecx, [esp + 0x10]
call fcn.00413900
test al, al
jne 0x41b3f0
mov eax, dword [0x51323c]
push 0x529238
mov dword [0x529238], eax
call fcn.0041fdc0
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x178]
push 0
push 0
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
test eax, eax
je 0x41b4ed
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x178]
push eax
call ebx
lea eax, [esp + 0x178]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x184]
push eax
call esi
test eax, eax
jne 0x41b4c5
mov eax, dword [0x513250]
mov ebx, dword [sym.imp.USER32.dll_PostThreadMessageW]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41b55b
push 0
push 0
push 0x12
push eax
call ebx
jmp 0x41b510
push 1
push 0
push 0
push 0
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
je 0x41b546
lea eax, [esp + 0xcc]
push eax
call edi
push 1
push 0
push 0
push 0
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
jne 0x41b526
push 0xa
push dword [0x513240]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41b510
mov eax, dword [0x51324c]
test eax, eax
je 0x41b5bb
push 0
push 0
push 0x12
push eax
call ebx
lea ecx, [ecx]
push 1
push 0
push 0
push 0
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
je 0x41b5a6
lea eax, [esp + 0xcc]
push eax
call edi
push 1
push 0
push 0
push 0
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
jne 0x41b586
push 0xa
push dword [0x513248]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41b570
cmp byte [0x513234], 0
mov eax, dword [0x513230]
jne 0x41b5ce
mov eax, dword [0x513238]
test eax, eax
je 0x41b5d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x180]
lea ecx, [esp + 0x60]
call fcn.00413600
lea ecx, [esp + 0x18]
call fcn.004139d0
lea ecx, [esp + 0x194]
call fcn.00412d50
lea ecx, [esp + 0x148]
call fcn.00412d50
lea ecx, [esp + 0x100]
call fcn.00412d50
lea ecx, [esp + 0x118]
call fcn.00412d50
lea ecx, [esp + 0x160]
call fcn.00412d50
lea ecx, [esp + 0x130]
call fcn.00413210
lea ecx, [esp + 0xe8]
call fcn.00413210
lea ecx, [esp + 0x9c]
call fcn.00412d50
lea ecx, [esp + 0x90]
call fcn.00413b10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.list_T__too_long
call fcn.0044f23e
push str.list_T__too_long
call fcn.0044f23e
int3