Function at 0x411cac
Capabilities:
Check if file exists
Create directory
Create process on windows
Create thread
Get file attributes
Read file via mapping
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb68
push ebx
push esi
push edi
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x4bc], 0
mov edi, 0x5f93e0
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
mov edi, 0x5f3f00
xor eax, eax
mov ecx, 0x1b
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0xb4bb40
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
mov edi, 0x5f9460
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
mov edi, 0x4ff6a0
xor eax, eax
mov ecx, 0x19c8
rep stosd dword es:[edi], eax
push str.SYSFER
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x462200], eax
call fcn.00428d67
cmp dword [0x46212c], 0
je 0x411d5e
mov dword [0x462200], 0x1234
mov byte [ebp - 0x6bc], 0
cmp dword [0x462284], 0
je 0x411d90
push 0x200
lea eax, [ebp - 0x6bc]
push eax
push str.SystemRoot_sysnative_sysfer.dll
call fcn.004280cc
add esp, 0xc
jmp 0x411da9
push 0x200
lea eax, [ebp - 0x6bc]
push eax
push str.SystemRoot_system32_sysfer.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x6bc]
test eax, eax
je 0x411e27
lea eax, [ebp - 0x6bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411e27
mov dword [ebp - 0x6c0], 0
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x6bc]
push eax
call fcn.00411a1e
add esp, 8
cmp eax, 0xd
jle 0x411e1d
mov dword [ebp - 0x4a0], 1
cmp dword [0x462200], 0
jne 0x411e18
mov dword [0x462200], 0x6464
jmp 0x411e27
mov dword [0x462200], 0
mov byte [ebp - 0x8c0], 0
push 0x200
lea eax, [ebp - 0x8c0]
push eax
push str.SystemRoot_syswow64cyinjct.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x8c0]
test eax, eax
je 0x411e72
lea eax, [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411e72
inc dword [0x462214]
push 0x200
lea eax, [ebp - 0x8c0]
push eax
push str.SystemRoot_syswow64cyvrtrap.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x8c0]
test eax, eax
je 0x411eb6
lea eax, [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411eb6
inc dword [0x462214]
push 0x200
lea eax, [ebp - 0x8c0]
push eax
push str.SystemRoot_syswow64cyvera.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x8c0]
test eax, eax
je 0x411efa
lea eax, [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411efa
inc dword [0x462214]
push 0x200
lea eax, [ebp - 0x8c0]
push eax
push str.SystemRoot_syswow64_ntnativeapi.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x8c0]
test eax, eax
je 0x411f3e
lea eax, [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411f3e
inc dword [0x462214]
cmp dword [ebp - 0x4a0], 0
jne 0x411fe9
mov byte [ebp - 0xac0], 0
push 0x200
lea eax, [ebp - 0xac0]
push eax
push str.SystemRoot_syswow64_sysfer.dll
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0xac0]
test eax, eax
je 0x411fe9
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411fe9
mov dword [ebp - 0xac4], 0
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xac0]
push eax
call fcn.00411a1e
add esp, 8
cmp eax, 0xd
jle 0x411fdf
mov dword [ebp - 0x4a0], 2
cmp dword [0x462200], 0
jne 0x411fda
mov dword [0x462200], 0x3232
jmp 0x411fe9
mov dword [0x462200], 0
cmp dword [0x462200], 0
je 0x412017
push 0
call fcn.00404e88
add esp, 4
cmp dword [0x46220c], 0
je 0x412017
mov dword [0x462200], 0
cmp dword [0x462210], 0
jne 0x41206a
cmp dword [0x45e03c], 0
je 0x412056
mov eax, dword [0x462210]
push eax
mov eax, dword [0x46220c]
push eax
mov eax, dword [0x46212c]
push eax
mov eax, dword [0x462200]
push eax
push str._r_nSysfer_WAS____X___key_switch___d___crit___d___path___d_
call fcn.00452380
add esp, 0x14
mov dword [0x462200], 0
mov dword [0x46212c], 0
cmp dword [0x45e03c], 0
je 0x4120a3
mov eax, dword [ebp - 0x4a0]
push eax
mov eax, dword [0x462210]
push eax
mov eax, dword [0x46220c]
push eax
mov eax, dword [0x46212c]
push eax
mov eax, dword [0x462200]
push eax
push str._r_nSysfer___X___key_switch___d___crit___d___path___d___ac_d_
call fcn.00452380
add esp, 0x18
cmp dword [ebp - 0x4a0], 0
je 0x4120ba
mov dword [0x462200], 1
cmp dword [0x45e03c], 0
je 0x4120da
mov eax, dword [0x462214]
push eax
push str._r_nCortex_PAN___d
call fcn.00452380
add esp, 8
call fcn.0044e961
mov dword [ebp - 0xacc], 0x64
mov eax, 0x984fc0
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov esi, str.GlobalSTLWA_NT_BASE64_ISW
lea edi, [ebp - 0xb30]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xb30]
push eax
mov eax, dword [ebp - 0xacc]
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x4621b4], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x4621b4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4621b8], eax
lea eax, [ebp - 0xac8]
push eax
push 0
push 0
push 0x44f417
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x45e03c], 0
je 0x412193
mov eax, dword [0x4621b8]
push eax
mov eax, dword [0x4621b4]
push eax
push str._r_nMapView___X__BUF__X_
call fcn.00452380
add esp, 0xc
cmp dword [0x4621b8], 0
je 0x4121bc
mov edx, dword [ebp - 0xacc]
mov edi, dword [0x4621b8]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
call fcn.00452990
add esp, 4
add eax, 0x3c
mov dword [0x462318], eax
cmp dword [0x45e03c], 0
je 0x4121fa
push 0x46d6dc
push str._n_n_S_n
call fcn.00452380
add esp, 8
push str._nSID_GetMe_To
call fcn.00452380
add esp, 4
push 0x46d798
push 0x46d7a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46207c], eax
push str.WTSGetActiveConsoleSessionId
push 0x46d7d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5ad4e4], eax
push 0x46d7dc
push 0x46d7f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462078], eax
call fcn.00413633
mov dword [0x462204], 0x79
cmp dword [0x45e03c], 0
je 0x412355
push 1
call fcn.00404e88
add esp, 4
call fcn.00413633
cmp dword [0x462078], 0
je 0x412355
mov dword [ebp - 0xb34], 9
mov dword [ebp - 0xb38], 0
lea eax, [ebp - 0xb34]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [0x462078]
cmp dword [0x462280], 0
je 0x4122ec
call dword [0x5ad4e4]
cmp eax, dword [ebp - 0xb34]
jne 0x4122e7
cmp dword [0x45e03c], 0
je 0x4122e7
push str._n_r_nDEBUG_IN_WINDOWS_VISTA_2008_WIN7_CONSOLE_SESSION_n_n
call fcn.00452380
add esp, 4
jmp 0x412355
cmp dword [ebp - 0xb34], 0
je 0x412348
cmp dword [ebp - 0xb38], 0
jne 0x412348
push str._n_n_n_nDEBUG_MODE_CAN_ONLY_BE_RUN_FROM_SERVER_KEYBOARD_n_n_n
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xb34]
push eax
push str.DEBUG_MODE_ONLY_POSSIBLE_IN_SESSION_0__CURRENTLY_RUNNING_SESSION__d
call fcn.00452380
add esp, 8
push 0x46d8b4
call fcn.00452380
add esp, 4
mov dword [0x4622c0], 0xffffffff
jmp 0x41362e
push str._n_r_nDEBUG_IN_SESSION_ZERO_n_n
call fcn.00452380
add esp, 4
mov edi, 0x99e5a0
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x5086e0
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, 0x481ca0
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, 0x984f20
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x49c], eax
mov ecx, 0x3e8
mov eax, dword [ebp - 0x49c]
sub edx, edx
div ecx
mov dword [ebp - 0x49c], eax
push 0
call fcn.00452990
add esp, 4
sub eax, dword [ebp - 0x49c]
mov dword [ebp - 0x49c], eax
push 0
call fcn.00452990
add esp, 4
mov dword [0x462308], eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00452eb0
add esp, 4
lea edi, [ebp - 0x498]
mov esi, eax
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
cmp dword [0x45e03c], 0
je 0x412484
cmp dword [ebp - 0x484], 0x63
jle 0x412440
mov eax, dword [ebp - 0x484]
sub eax, 0x64
mov dword [ebp - 0xb68], eax
jmp 0x41244c
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0x49c]
push eax
mov eax, dword [ebp - 0x494]
push eax
mov eax, dword [ebp - 0x490]
push eax
mov eax, dword [ebp - 0xb68]
push eax
mov eax, dword [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x488]
inc eax
push eax
push 0x46d8d4
call fcn.00452380
add esp, 0x1c
mov eax, dword [ebp - 0x49c]
mov dword [0x462304], eax
mov eax, dword [0x462304]
push eax
call fcn.00411b8f
add esp, 4
mov dword [0x462304], eax
cmp dword [0x462280], 0
jne 0x4124bc
cmp dword [0x4621fc], 0
je 0x4124db
cmp dword [0x45e03c], 0
je 0x4124d6
push str._nSkip_2min_n
call fcn.00452380
add esp, 4
jmp 0x41254c
cmp dword [0x45e03c], 0
je 0x4124f5
push str._n2Min_Wait_Check....
call fcn.00452380
add esp, 4
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x462304]
add ecx, 0x78
cmp eax, ecx
jae 0x412532
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4622c8], 0
je 0x41252d
jmp 0x412532
jmp 0x4124f5
cmp dword [0x45e03c], 0
je 0x41254c
push str._done_
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x484], 0x63
jle 0x41256c
mov eax, dword [ebp - 0x484]
sub eax, 0x64
mov byte [0x9a3720], al
jmp 0x412577
mov al, byte [ebp - 0x484]
mov byte [0x9a3720], al
mov eax, dword [ebp - 0x488]
inc eax
mov byte [0x9a3721], al
mov al, byte [ebp - 0x48c]
mov byte [0x9a3722], al
mov al, byte [ebp - 0x490]
mov byte [0x9a3723], al
mov al, byte [ebp - 0x494]
mov byte [0x9a3724], al
mov al, byte [ebp - 0x498]
mov byte [0x9a3725], al
mov al, byte [ebp - 0x480]
mov byte [0x9a3726], al
cmp dword [0x45e03c], 0
jne 0x4125cc
call fcn.00413633
call fcn.00413921
lea eax, [ebp - 0xb3c]
push eax
push 0
push 0
push 0x432780
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xb40], eax
cmp dword [0x45e03c], 0
je 0x41261b
cmp dword [ebp - 0xb40], 0
jne 0x41261b
push str._nError_Starting_Thread_BXU
call fcn.00452380
add esp, 4
call fcn.0042c12f
mov dword [0x46206c], eax
cmp dword [0x45e03c], 0
je 0x412645
mov eax, dword [0x46206c]
push eax
push str._r_nLOCAL_B_M_L___d
call fcn.00452380
add esp, 8
call fcn.004287b7
call fcn.00444210
mov eax, 0x5dfaa0
mov ecx, 0x5acf80
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ax, word [eax + 8]
mov word [ecx + 8], ax
push 0x5dfaa0
call fcn.0041190e
add esp, 4
cmp dword [0x45e03c], 0
je 0x4126a9
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [0x5dfaa0]
push eax
mov eax, dword [0x4622f0]
push eax
push str._r_nN_OFF___d___x____X
call fcn.00452380
add esp, 0x10
cmp dword [0x4622f0], 0
je 0x412990
push 0
call fcn.00452990
add esp, 4
add eax, 0x2d
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb4c], 0
lea eax, [ebp - 0xb4c]
push eax
call fcn.00405617
add esp, 4
cmp dword [ebp - 0xb4c], 0
je 0x412715
cmp dword [0x45e03c], 0
je 0x412710
mov eax, dword [ebp - 0xb4c]
push eax
push str._r_nDHCP_SERVICE_DISABLED___d_
call fcn.00452380
add esp, 8
jmp 0x412990
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00444210
push 0x5dfaa0
call fcn.0041190e
add esp, 4
cmp dword [0x4622f0], 0
jne 0x41278f
mov dword [0x4622f0], 0
mov eax, 0x5dfaa0
mov ecx, 0x5acf80
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ax, word [eax + 8]
mov word [ecx + 8], ax
cmp dword [0x45e03c], 0
je 0x41278a
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_nNIC_ONLINE___X_
call fcn.00452380
add esp, 8
jmp 0x412990
cmp dword [0x45e03c], 0
je 0x4127b3
mov eax, dword [ebp - 0xb44]
sub eax, 0x2d
push eax
push str._r_nDHCP_PAUSE___X_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0xb4c]
push eax
call fcn.00405617
add esp, 4
test eax, eax
jne 0x412816
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.00452990
add esp, 4
cmp eax, dword [ebp - 0xb44]
jbe 0x412811
cmp dword [0x45e03c], 0
je 0x41280c
mov eax, dword [ebp - 0xb44]
push eax
push str._r_ndTime_exit__DHCP_not_starting___X_
call fcn.00452380
add esp, 8
jmp 0x412990
jmp 0x4127b3
cmp dword [0x45e03c], 0
je 0x41283b
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_nDHCP_SERVICE_RUNNING___X_
call fcn.00452380
add esp, 8
call fcn.00444210
mov eax, 0x5dfaa0
mov ecx, 0x5acf80
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ax, word [eax + 8]
mov word [ecx + 8], ax
mov dword [ebp - 0xb48], 0
mov eax, 0x5dfaa0
test eax, eax
je 0x412898
cmp dword [0x5dfaa0], 0x100007f
je 0x412898
mov eax, dword [0x5dfaa0]
and eax, 0xfea9
cmp eax, 0xfea9
jne 0x412931
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0xb48]
call fcn.00444210
mov eax, 0x5dfaa0
test eax, eax
je 0x4128ea
cmp dword [0x5dfaa0], 0x100007f
je 0x4128ea
mov eax, dword [0x5dfaa0]
and eax, 0xfea9
cmp eax, 0xfea9
je 0x4128ea
jmp 0x412931
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xb48], 2
jle 0x41292c
cmp dword [0x45e03c], 0
je 0x412927
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_nDHCP_not_assigning_IP_address___X_
call fcn.00452380
add esp, 8
jmp 0x412931
jmp 0x412866
call fcn.00444210
mov eax, 0x5dfaa0
mov ecx, 0x5acf80
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ax, word [eax + 8]
mov word [ecx + 8], ax
push 0x5dfaa0
call fcn.0041190e
add esp, 4
cmp dword [0x45e03c], 0
je 0x412990
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [0x5dfaa0]
push eax
mov eax, dword [0x4622f0]
push eax
push str._r_n_2.0_N_OFF___d___x__t_X
call fcn.00452380
add esp, 0x10
mov esi, str.The_Application___s__has_been_idle_too_long__please_begin_using_it_or_exit_now.
mov edi, 0x5ad9c0
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, str.The_Application___s__will_now_be_terminated__your_unsaved_work_will_be_lost.
mov edi, 0x704e40
mov ecx, 0x13
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.You_are_already_using_this_application__unable_to_launch_an_additional_copy.
mov edi, 0x4818a0
mov ecx, 0x13
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.This_Bentley_Application___s__has_been_started_in_free_usage_mode___d_minutes_and__d_seconds_of_usage_remain_before_automatic_termination.
mov edi, 0x5fd660
mov ecx, 0x22
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.The_Bentley_Application___s__has__d_minutes_and__d_seconds_of_free_usage_remaining_before_automatic_termination.
mov edi, 0x5f94e0
mov ecx, 0x1c
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x46dc44
mov edi, 0x5aca80
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov esi, str.SofTrack_Server_Agent_Restarted___process__s_will_auto_terminate_in_5_minutes__please_save_and_exit.
mov edi, 0x481720
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Process__s_started_while_online__will_auto_terminate_in_5_minutes__please_save_and_exit.
mov edi, 0x5f5080
mov ecx, 0x16
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Please_note:_Process__s_will_be_automatically_terminated_at_11:59pm_today.
mov edi, 0x5ad8e0
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00428e0f
cmp dword [0x45e03c], 0
je 0x412a5f
mov eax, dword [0x462198]
push eax
mov eax, dword [0x46219c]
push eax
push str.SERVER_ADDR_IS_IP___d__X_
call fcn.00452380
add esp, 0xc
call fcn.0042827a
mov eax, dword [0x4622e8]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x5aca80
call fcn.0042b16c
add esp, 8
call fcn.0042894b
mov edi, 0x5ad3e0
xor eax, eax
mov ecx, 0x1b
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [0x5ad3e0], 0x25
mov byte [0x5ad3e1], 0x25
mov byte [0x5ad3e2], 0xcc
mov byte [0x5ad3e3], 0x25
mov eax, dword [0x462304]
mov dword [0x5ad3e4], eax
mov edi, 0x9854e0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [0x5ad3ec]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x5dfab0], 0xa9494d50
mov dword [0x462054], 0
mov dword [0x5f97c0], 0x409790
mov dword [0x462078], 0x409790
mov dword [0x5ad4e0], 0x409790
mov dword [0x5dfaac], 0x409790
mov dword [0x46209c], 0x409790
mov dword [0x4620a0], 0x409790
call fcn.0042fb6f
cmp dword [0x45e03c], 0
je 0x412b87
mov eax, str.IS_TERMINAL_SERVER
mov ecx, str.no_tse_present
xor edx, edx
cmp dword [0x462254], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._n_rTSE_Status___s___for_Msg_Send_
call fcn.00452380
add esp, 8
mov dword [0x462258], 0
cmp dword [0x462254], 0
je 0x412bc9
mov byte [0x508e60], 0
call fcn.00428387
mov dword [0x462258], 1
cmp dword [0x45e03c], 0
je 0x412bc9
push 0x508e60
push str._n_rTK_Path___s_
call fcn.00452380
add esp, 8
cmp dword [0x462120], 0
je 0x412bf0
cmp dword [0x45e03c], 0
je 0x412bf0
push str._n_rPOWER_WATCH_is_ON
call fcn.00452380
add esp, 4
push str.VirtualAllocEx
push 0x46de34
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462070], eax
mov eax, dword [0x462284]
push eax
call fcn.0043a0f4
add esp, 4
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x704c40
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0xb50], eax
cmp dword [ebp - 0xb50], 0
je 0x412c9e
dec dword [ebp - 0xb50]
mov eax, dword [ebp - 0xb50]
xor ecx, ecx
mov cl, byte [eax + 0x704c40]
cmp ecx, 0x5c
je 0x412c9e
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x46de40]
mov word [edi - 1], ax
mov edx, str.LWA.OFF_
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov al, byte [edx + 8]
mov byte [edi + 8], al
push 0
push 0x704c40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x412d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x412d2e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x704c40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x412d2e
cmp dword [0x45e03c], 0
je 0x412d2e
push 0x704c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nCM:ERROR__d_creating___s_
call fcn.00452380
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x412d59
push 0x704c40
push 0x704c40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
push str._r_nCM:OFFLINE_LOG_PATH___X___s_
call fcn.00452380
add esp, 0xc
cmp dword [0x4622f0], 0
je 0x412d6b
jmp 0x413032
cmp dword [0x462198], 0
je 0x412da7
mov dword [ebp - 0x4b8], 0
cmp dword [0x45e03c], 0
je 0x412da2
mov eax, dword [0x462198]
push eax
push str._n_rAlt_Server_Reach____complete__no_wait___X_
call fcn.00452380
add esp, 8
jmp 0x412e5b
push 0
call fcn.004364a2
add esp, 4
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xdd
je 0x412dd4
cmp dword [ebp - 0x4b8], 0x35
jne 0x412e5b
mov dword [0x46213c], 8
call fcn.00411313
xor eax, eax
mov ax, word [0x46231c]
test eax, eax
je 0x412dfd
call fcn.00411127
call fcn.00410dd4
mov dword [0x46213c], 0
xor eax, eax
mov ax, word [0x46231c]
test eax, eax
je 0x412e44
cmp dword [0x45e03c], 0
je 0x412e36
push 0xb4bbc0
push str._r_nUnable_to_reach_server___S____offline_mode_enabled__proceeding...
call fcn.00452380
add esp, 8
mov word [0x462324], 1
jmp 0x413065
push 0xb4bbc0
push str._n_rUnable_to_reach_server___S____aborting.
call fcn.00452380
add esp, 8
jmp 0x41362e
cmp dword [ebp - 0x4b8], 0
je 0x413032
mov dword [ebp - 0xb54], 0
cmp dword [0x462118], 0
jne 0x412e8c
cmp dword [0x4622a0], 0
je 0x412fb1
cmp dword [0x4622a8], 0
jne 0x412fb1
cmp dword [ebp - 0x4b8], 0
je 0x412fb1
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb58], 0
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb54], 1
cmp dword [0x45e03c], 0
je 0x412ee8
push str._n_rExWait_60
call fcn.00452380
add esp, 4
cmp dword [ebp - 0xb5c], 0x3c
jge 0x412f1d
inc dword [ebp - 0xb5c]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4622c8], 0
je 0x412f18
jmp 0x41362e
jmp 0x412ee8
inc dword [ebp - 0xb58]
push 0
call fcn.004364a2
add esp, 4
mov dword [ebp - 0x4b8], eax
cmp dword [0x4622c8], 0
je 0x412f45
jmp 0x41362e
cmp dword [ebp - 0xb58], 2
jle 0x412fac
cmp dword [0x462118], 0
jne 0x412fac
cmp dword [0x4622a0], 0
jne 0x412fac
mov dword [ebp - 0xb58], 0xfffffffd
cmp dword [0x462254], 0
je 0x412f90
cmp dword [0x462260], 0
je 0x412fac
push 0x40010
push 0x46df38
push str.Unable_to_contact_SofTrack_Server_Agent___Check_Configuration
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x412e72
cmp dword [ebp - 0xb54], 0
jne 0x413032
cmp dword [0x4622a8], 0
jne 0x413032
cmp dword [0x4621b4], 0xffffffff
je 0x413004
cmp dword [0x4621b8], 0
je 0x412ff8
mov eax, dword [0x4621b8]
mov byte [eax], 0x66
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4621b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x462008], 0
jne 0x41302d
push 0x40010
push str.SofTrack_Service_Message
push str.UNLOADING_NOW:_n_nUnable_to_contact_SofTrack_Server_Agent___Check_Configuration
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41362e
mov dword [0x46213c], 1
call fcn.00411313
xor eax, eax
mov ax, word [0x46231c]
test eax, eax
je 0x413056
call fcn.00411127
call fcn.00410dd4
mov dword [0x46213c], 0
push 0
call fcn.004151e1
add esp, 4
cmp dword [0x4622c8], 0
je 0x413081
jmp 0x41362e
cmp dword [0x45e03c], 0
je 0x4130a0
push 0x9854e0
push str._nENTER_DRIVER_CONTACT___s_:_n
call fcn.00452380
add esp, 8
call fcn.00416320
mov dword [0x4622c0], eax
cmp dword [0x4622c0], 0xffffffff
je 0x4130c5
mov eax, dword [0x4622c0]
push eax
call fcn.00413caf
add esp, 4
mov byte [0x99e960], 0x48
mov byte [0x99e961], 0x79
mov byte [0x99e962], 0x73
mov byte [0x99e963], 0x59
mov byte [0x99e964], 0x53
mov byte [0x99e965], 0x2e
mov byte [0x99e966], 0x45
mov byte [0x99e967], 0x78
mov byte [0x99e968], 0x45
mov byte [0x99e969], 0
mov edi, 0x99e920
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [0x99e920], 0x63
mov byte [0x99e921], 0x61
mov byte [0x99e922], 0x6c
mov byte [0x99e923], 0x61
mov byte [0x99e924], 0x63
mov byte [0x99e925], 0x63
mov byte [0x99e926], 0x2e
mov byte [0x99e927], 0x45
mov byte [0x99e928], 0x78
mov byte [0x99e929], 0x45
mov edi, 0x4ff660
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [0x4ff660], 0x6d
mov byte [0x4ff661], 0x73
mov byte [0x4ff662], 0x69
mov byte [0x4ff663], 0x65
mov byte [0x4ff664], 0x78
mov byte [0x4ff665], 0x65
mov byte [0x4ff666], 0x63
mov byte [0x4ff667], 0x2e
mov byte [0x4ff668], 0x65
mov byte [0x4ff669], 0x78
mov byte [0x4ff66a], 0x65
mov byte [0x4ff66b], 0x20
mov byte [0x4ff66c], 0x2f
mov byte [0x4ff66d], 0x76
mov edi, 0x4ff660
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [0x462220], eax
call fcn.0040ed89
call fcn.00414175
cmp dword [0x4622c8], 0
je 0x413207
jmp 0x41362e
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov word [ebp - 0x474], ax
push 0x46e020
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x474]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x4b4], 0
je 0x413289
cmp dword [0x45e03c], 0
je 0x413263
push str._nFound_NW_Client_32__attempting_to_load_partner_EXE
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4621ac], 1
mov dword [ebp - 0x49c], 1
jmp 0x4132b7
cmp dword [0x45e03c], 0
je 0x4132a3
push str._nDid_Not_Find_NW_Client_32
call fcn.00452380
add esp, 4
mov dword [ebp - 0x49c], 0
mov dword [0x462314], 0
cmp dword [ebp - 0x49c], 0
je 0x4132ce
mov dword [0x4622a4], 1
mov eax, dword [0x4622c0]
push eax
call fcn.00416bb2
add esp, 4
cmp dword [0x45e03c], 0
je 0x4132f6
push str._nrx015
call fcn.00452380
add esp, 4
cmp dword [0x4622c8], 0
je 0x41333b
push 0x10
push 0x46e08c
push str.SofTrack_Local_Agent_Initialization_Failed._n_nCode_0xH8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x45e03c], 0
je 0x413336
push str._n_rSHTD_001
call fcn.00452380
add esp, 4
jmp 0x41362e
cmp dword [ebp - 0x49c], 0
je 0x413559
push 0
call fcn.00409b16
add esp, 4
lea edi, [ebp - 0x470]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4b0]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [ebp - 0x440], 0
push 0x46e0dc
lea eax, [ebp - 0x428]
push eax
call fcn.004530c0
add esp, 8
push 0x5acb60
lea eax, [ebp - 0x428]
push eax
call fcn.00453080
add esp, 8
push 0x2030405
push 0x46e0f8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00453080
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x470]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
je 0x4134d6
cmp dword [0x4622c8], 0
jne 0x4134d6
cmp dword [0x45e03c], 0
je 0x413448
push str._n_rLoad_NW_Init_TDelay_60
call fcn.00452380
add esp, 4
cmp dword [0x46224c], 0
jne 0x413498
cmp dword [ebp - 0x42c], 0x258
jge 0x413498
mov eax, dword [0x4622c0]
push eax
call fcn.00413b0b
add esp, 4
cmp dword [0x4622c8], 0
je 0x413485
jmp 0x41362e
push 0x66
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x42c]
jmp 0x413448
cmp dword [0x45e03c], 0
je 0x4134d6
mov eax, dword [ebp - 0x42c]
push eax
push str._n_rTime_to_catch___d_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x42c], 0x258
jne 0x4134d6
push str._____Host_is_presumed_to_be_NT_200x__NW_outreach_failed
call fcn.00452380
add esp, 4
mov dword [0x462314], 0
cmp dword [0x45e03c], 0
je 0x413559
lea eax, [ebp - 0x428]
push eax
push str._nRun_32bit_NW..__S_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x4a4]
push eax
mov eax, dword [ebp - 0x4ac]
push eax
mov eax, dword [ebp - 0x4b0]
push eax
mov eax, dword [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x49c]
push eax
push str._nRun___x__GetLastErr__x__unique_id__x__process__x__Thread__x___x_
call fcn.00452380
add esp, 0x1c
lea eax, [ebp - 0x428]
push eax
push 0x46e1c8
call fcn.00452380
add esp, 8
push 0x46e1cc
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x49c], 0
jne 0x413594
mov dword [0x462314], 0
cmp dword [0x45e03c], 0
je 0x41358f
push 0x5acb60
push str._n1_Failed_to_Load_NetWare_handler__presuming___S__is_an_NT_Server
call fcn.00452380
add esp, 8
jmp 0x413624
cmp dword [0x45e03c], 0
je 0x4135ae
push str._n_r_nProceeding_with_NW_Partner_Load...
call fcn.00452380
add esp, 4
cmp dword [0x46224c], 0
je 0x413624
cmp dword [0x4622b0], 0
je 0x413624
lea eax, [ebp - 0xb60]
push eax
push 0
push 0
push 0x43599f
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xb64], eax
cmp dword [0x45e03c], 0
je 0x413624
cmp dword [ebp - 0xb64], 0
jne 0x413617
push str._nError_Starting_Thread_NDS_0
call fcn.00452380
add esp, 4
jmp 0x413624
push str._nSuccessfully_started_GetNDSName
call fcn.00452380
add esp, 4
mov dword [0x462140], 0
pop edi
pop esi
pop ebx
leave
ret