Function at 0x42d9a0
Capabilities:
Accept command line arguments
Check mutex on windows
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get comspec environment variable
Get file system object information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.0040b360
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xb10], 0
xor eax, eax
mov word [ebp - 0x698], ax
push 0x45e
push 0
lea ecx, [ebp - 0x696]
push ecx
call fcn.00401f10
add esp, 0xc
xor edx, edx
mov word [ebp - 0xb00], dx
push 0x45e
push 0
lea eax, [ebp - 0xafe]
push eax
call fcn.00401f10
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xd20], cx
push 0x1fe
push 0
lea edx, [ebp - 0xd1e]
push edx
call fcn.00401f10
add esp, 0xc
xor eax, eax
mov word [ebp - 0xf30], ax
push 0x1fe
push 0
lea ecx, [ebp - 0xf2e]
push ecx
call fcn.00401f10
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00401f10
add esp, 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0xd26]
call fcn.00401910
lea ecx, [ebp - 0xd25]
call fcn.00401910
mov dword [ebp - 0x220], str.ErrorInfo.log
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0xd24], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
push edx
call fcn.00413ec0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp - 0xf31]
call fcn.00401910
lea eax, [ebp - 0xf31]
push eax
call fcn.0040e3c0
lea ecx, [ebp - 0xf31]
call fcn.00401ab0
mov ecx, dword [ebp + 8]
mov dword [0x4569f8], ecx
push 0x118
push 0x457190
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 5]
call fcn.00401910
lea ecx, [ebp - 0x699]
call fcn.00401910
lea edx, [ebp - 5]
push edx
call fcn.0040bf60
mov dword [ebp - 4], eax
lea eax, [ebp - 0x699]
push eax
call fcn.0040fb70
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bf30
lea edx, [ebp - 0xb0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xb0c], 2
jle 0x42dd14
mov dword [ebp - 0xf38], 0xffffffff
lea eax, [ebp - 0x698]
mov dword [ebp - 0xf40], eax
mov dword [ebp - 0xf3c], 0
lea ecx, [ebp - 0xf41]
call fcn.00401910
mov dword [ebp - 0xb1c], 0x270f
mov dword [ebp - 0xb04], 0
jmp 0x42dbc2
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457190]
test eax, eax
je 0x42dc0f
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457190]
cmp edx, 0x5c
je 0x42dbfa
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457190]
cmp ecx, 0x2f
jne 0x42dc0d
mov edx, dword [ebp - 0xb04]
lea eax, [edx*2 + 0x457190]
mov dword [ebp - 0xf3c], eax
jmp 0x42dbb3
cmp dword [ebp - 0xf3c], 0
je 0x42dc31
xor ecx, ecx
mov edx, dword [ebp - 0xf3c]
mov word [edx], cx
mov eax, dword [ebp - 0xf3c]
add eax, 2
mov dword [0x43f798], eax
mov ecx, dword [ebp - 0xd2c]
mov edx, dword [ecx + 4]
push edx
call fcn.00403f2c
add esp, 4
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0xf40]
push eax
mov ecx, dword [ebp - 0xf38]
push ecx
lea edx, [ebp - 0xf41]
push edx
call fcn.0040d880
mov dword [ebp - 4], eax
lea eax, [ebp - 0xf38]
push eax
mov ecx, dword [ebp - 0xf40]
push ecx
lea edx, [ebp - 0xf41]
push edx
call fcn.0040c760
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xf38]
push ecx
push str._____d___d__r_n
mov edx, dword [ebp - 0xf40]
add edx, 0x27
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x439ef4
mov eax, dword [ebp - 0xf40]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x457190
push 0x439f1c
lea ecx, [ebp - 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xf40]
push edx
mov eax, dword [ebp - 0xf40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb00]
push ecx
call fcn.00401490
add esp, 0xc
lea ecx, [ebp - 0xf41]
call fcn.00401ab0
jmp 0x42ed24
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x456158], eax
cmp dword [0x456158], 0
jne 0x42dd4c
mov dword [ebp - 0xb1c], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
jmp 0x42ed24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
cmp dword [ebp - 0xb18], 0xb7
jne 0x42dd7d
mov dword [ebp - 0xb1c], 0x270d
mov dword [ebp - 0xb18], 0
jmp 0x42ed24
lea ecx, [ebp - 0x1168]
call fcn.0040bc40
push 1
lea ecx, [ebp - 0x1168]
call fcn.0040b960
test eax, eax
je 0x42ddb7
lea edx, [ebp - 0x1168]
push edx
call fcn.00412ca0
push 1
lea ecx, [ebp - 0x1168]
call fcn.0040b880
jmp 0x42deaa
mov dword [ebp - 0xb1c], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457190
push 0x439f5c
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
lea ecx, [ebp - 0x1168]
call fcn.0040bb70
push eax
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.00401490
add esp, 0xc
lea ecx, [ebp - 0x1168]
call fcn.0040bbb0
jmp 0x42ed24
lea ecx, [ebp - 0x1168]
call fcn.0040bbb0
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0xb04], 0
jmp 0x42deda
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457190]
test eax, eax
je 0x42df27
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457190]
cmp edx, 0x5c
je 0x42df12
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457190]
cmp ecx, 0x2f
jne 0x42df25
mov edx, dword [ebp - 0xb04]
lea eax, [edx*2 + 0x457190]
mov dword [ebp - 0x116c], eax
jmp 0x42decb
cmp dword [ebp - 0x116c], 0
je 0x42df49
xor ecx, ecx
mov edx, dword [ebp - 0x116c]
mov word [edx], cx
mov eax, dword [ebp - 0x116c]
add eax, 2
mov dword [0x43f798], eax
mov ecx, dword [0x43f798]
push ecx
push 0x439fc0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42df6e
mov dword [ebp - 0xb1c], 0x3df
jmp 0x42ed24
push str.parser_manifest.xml
push 0x457190
push 0x43a008
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str.regist.txt
push 0x457190
push 0x43a02c
lea eax, [ebp - 0xf30]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x210]
push edx
call section..text
add esp, 8
test eax, eax
jge 0x42dfd5
mov dword [ebp - 0xb1c], 0x3e0
jmp 0x42ed24
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0xf30]
push ecx
call section..text
add esp, 8
test eax, eax
jge 0x42e006
push 9
lea edx, [ebp - 0xf30]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0041a310
jmp 0x42e01b
push 1
lea ecx, [ebp - 0xf30]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0041a310
push str.parserchk.txt
push 0x457190
push 0x43a054
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x42e0a1
mov dword [0x456a20], 1
push str.parsernot.txt
push 0x457190
push 0x43a07c
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x42e0a1
mov dword [0x456a20], 2
push 0x457190
push str._sHTTP_Parser.chm
push 0x4573c0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x117c], 0
mov dword [ebp - 0x1170], 0
mov dword [ebp - 0x1174], 0
mov dword [ebp - 0x1178], 0
push str.BINTYPE
push 0x12d
mov eax, dword [0x4569f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 0
je 0x42e1ac
push 0x460
push 0
lea ecx, [ebp - 0x698]
push ecx
call fcn.00401f10
add esp, 0xc
cmp dword [ebp - 0x117c], 0
je 0x42e140
mov edx, dword [ebp - 0x117c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x117c], 0
je 0x42e160
mov ecx, dword [ebp - 0x117c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1170], 0
je 0x42e17c
mov eax, dword [ebp - 0x1170]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1178], eax
lea ecx, [ebp - 0x698]
push ecx
push str.logo.gif
mov edx, dword [ebp - 0x1174]
push edx
mov eax, dword [ebp - 0x1178]
push eax
call fcn.0041dd20
lea ecx, [ebp - 0x698]
push ecx
call fcn.00412c20
mov dword [0x4569fc], eax
cmp dword [ebp - 0x1170], 0
je 0x42e1c2
mov edx, dword [ebp - 0x1170]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x457190
push str._s_themes_b_good.bmp
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457190
push str._s_themes_b_bad.bmp
lea ecx, [ebp - 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457190
push str._s_themes_b_desktop.bmp
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x698]
push eax
call fcn.00412c20
mov dword [0x456a00], eax
lea ecx, [ebp - 0xb00]
push ecx
call fcn.00412c20
mov dword [0x456a04], eax
lea edx, [ebp - 0xd20]
push edx
call fcn.00412c20
mov dword [0x456a08], eax
mov dword [ebp - 0x1180], 0x900000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x456164], eax
cmp dword [0x456164], 0xffffffff
jne 0x42e365
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
mov dword [0x456164], 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457190
push 0x43a190
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
push str.Mail_Handle_Create_Error
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push 0x43a1d0
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.00401490
add esp, 0xc
jmp 0x42ed24
push str.PARSER_SHARED_MAPMEMORY
mov ecx, dword [ebp - 0x1180]
push ecx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x456168], eax
cmp dword [0x456168], 0
jne 0x42e479
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x220]
push eax
push 0x457190
push 0x43a24c
lea ecx, [ebp - 0xd20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xb18]
push edx
push 0x43a258
movzx eax, word [ebp - 0x224]
push eax
movzx ecx, word [ebp - 0x226]
push ecx
movzx edx, word [ebp - 0x228]
push edx
movzx eax, word [ebp - 0x22a]
push eax
movzx ecx, word [ebp - 0x22e]
push ecx
movzx edx, word [ebp - 0x230]
push edx
push 0x43a288
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xd24]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x698]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xd24]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xd20]
push edx
call fcn.00401490
add esp, 0xc
jmp 0x42ed24
mov eax, dword [ebp - 0x1180]
push eax
push 0
push 0
push 2
mov ecx, dword [0x456168]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x456170], eax
cmp dword [0x456170], 0
jne 0x42e58d
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x220]
push eax
push 0x457190
push 0x43a2d4
lea ecx, [ebp - 0xd20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0xb18]
push edx
push str.Map_Handle_Create_Error
movzx eax, word [ebp - 0x224]
push eax
movzx ecx, word [ebp - 0x226]
push ecx
movzx edx, word [ebp - 0x228]
push edx
movzx eax, word [ebp - 0x22a]
push eax
movzx ecx, word [ebp - 0x22e]
push ecx
movzx edx, word [ebp - 0x230]
push edx
push 0x43a310
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xd24]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x698]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xd24]
push eax
mov ecx, dword [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xd20]
push edx
call fcn.00401490
add esp, 0xc
jmp 0x42ed24
mov eax, dword [0x456170]
add eax, 0x100000
mov dword [0x4578a4], eax
mov dword [ebp - 0x1188], 8
mov dword [ebp - 0x1184], 0x3ff
lea ecx, [ebp - 0x1188]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x100
push 0x456d60
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x42e5e6
push str.cmd.exe
push 0x456d60
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x440d28
call fcn.00401f10
add esp, 0xc
push 0x43a37c
push 0x457190
push 0x43a398
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0x698]
push ecx
call section..text
add esp, 8
test eax, eax
jl 0x42e64c
push 0x440d28
push 0x5460
lea edx, [ebp - 0x698]
push edx
call fcn.00401240
add esp, 0xc
push 0x43f79c
push str.sysinfoview.xml
call fcn.00412c60
mov dword [0x456a0c], 1
lea eax, [ebp - 0xb08]
push eax
push 0
push 0
push 0x41ed00
push 0
push 0
call fcn.00403c90
add esp, 0x18
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x42e77c
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x220]
push edx
push 0x457190
push 0x43a3a4
lea eax, [ebp - 0xd20]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0xb18]
push ecx
push str.sessionSearchThread_Call_Error
movzx edx, word [ebp - 0x224]
push edx
movzx eax, word [ebp - 0x226]
push eax
movzx ecx, word [ebp - 0x228]
push ecx
movzx edx, word [ebp - 0x22a]
push edx
movzx eax, word [ebp - 0x22e]
push eax
movzx ecx, word [ebp - 0x230]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xd24]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x698]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xd24]
push edx
mov eax, dword [ebp - 0xd24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xd20]
push ecx
call fcn.00401490
add esp, 0xc
jmp 0x42ed24
call fcn.00413a40
push str._test.html
call fcn.00413260
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x42e9cb
mov dword [ebp - 0xb04], 0
jmp 0x42e7b9
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x42e7fa
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x42e7f8
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x21c], edx
jmp 0x42e7aa
cmp dword [ebp - 0x21c], 0
jne 0x42e80d
mov dword [ebp - 0x21c], 0x43a454
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42e845
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
movzx eax, word [edx + 0x440828]
test eax, eax
je 0x42e892
mov ecx, dword [ebp - 0xb14]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
add eax, 0x440828
push eax
call fcn.004015c0
add esp, 0xc
test eax, eax
jne 0x42e890
mov ecx, dword [ebp - 0xb04]
mov dword [0x456a10], ecx
jmp 0x42e892
jmp 0x42e836
cmp dword [0x456a10], 0xffffffff
jne 0x42e92e
mov dword [ebp - 0x21c], str.msedge.exe
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42e8e1
mov eax, dword [ebp - 0xb04]
add eax, 1
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
movzx edx, word [ecx + 0x440828]
test edx, edx
je 0x42e92e
mov eax, dword [ebp - 0xb14]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
add edx, 0x440828
push edx
call fcn.004015c0
add esp, 0xc
test eax, eax
jne 0x42e92c
mov eax, dword [ebp - 0xb04]
mov dword [0x456a10], eax
jmp 0x42e92e
jmp 0x42e8d2
cmp dword [0x456a10], 0xffffffff
jne 0x42e9cb
mov dword [ebp - 0x21c], str.iexplore.exe
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456a10], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x42e97d
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
movzx ecx, word [eax + 0x440828]
test ecx, ecx
je 0x42e9cb
mov edx, dword [ebp - 0xb14]
push edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
add ecx, 0x440828
push ecx
call fcn.004015c0
add esp, 0xc
test eax, eax
jne 0x42e9c9
mov edx, dword [ebp - 0xb04]
mov dword [0x456a10], edx
jmp 0x42e9cb
jmp 0x42e96e
push str.parsercommon.data
push 0x457190
push 0x43a4c4
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call section..text
add esp, 8
test eax, eax
jl 0x42ea4c
push 0x446188
push 0x310
lea eax, [ebp - 0x698]
push eax
call fcn.00401240
add esp, 0xc
test eax, eax
jl 0x42ea45
mov ecx, dword [0x446190]
mov dword [0x456a10], ecx
mov edx, dword [0x446194]
mov dword [0x43f770], edx
mov eax, dword [0x44618c]
mov dword [0x456a14], eax
jmp 0x42ea4c
mov byte [0x446188], 0
movzx ecx, byte [0x446188]
test ecx, ecx
jne 0x42eacc
mov byte [0x446188], 9
mov byte [0x446189], 9
mov byte [0x44618a], 3
mov byte [0x44618b], 3
mov edx, dword [0x456a14]
mov dword [0x44618c], edx
mov eax, dword [0x456a10]
mov dword [0x446190], eax
mov ecx, dword [0x43f770]
mov dword [0x446194], ecx
mov byte [0x446198], 0
mov byte [0x446199], 0
mov byte [0x44619a], 0
mov byte [0x44619c], 0
push 0
push 0x446188
push 0x310
lea edx, [ebp - 0x698]
push edx
call fcn.00401350
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x457840], eax
cmp dword [0x457840], 0
je 0x42eb4c
mov dword [ebp - 0x1448], 0x99
jmp 0x42eb05
mov eax, dword [ebp - 0x1448]
add eax, 1
mov dword [ebp - 0x1448], eax
cmp dword [ebp - 0x1448], 0xb5
jg 0x42eb4c
push 0
push 0x10
push 0x10
push 1
movzx ecx, word [ebp - 0x1448]
push ecx
mov edx, dword [0x4569f8]
push edx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x1444]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x457840]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x42eaf6
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov edx, dword [0x4569f8]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x45783c], eax
push 0x4000
push 0x2b4
lea eax, [ebp - 0x1440]
push eax
push 0
push 0x43a4d0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x457634], eax
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x1440]
push ecx
push 0
push 0x43a4d8
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x457838], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x42ebfb
push str.HtmlHelpW
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4578ac], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x42ec2c
push str.ImmAssociateContext
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4578a8], eax
push 0x8d
mov ecx, dword [0x4569f8]
push ecx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x456154], eax
push 0
push 0x429ab0
push 0
push 0x259
mov edx, dword [0x4569f8]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x4569f0], 0
mov dword [0x456a0c], 0
push 0x457190
push str._slist.txt
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45616c], 0
je 0x42ece0
push 0x1388
mov ecx, dword [0x45616c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x45616c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00418890
push str.sitelink.txt
push 0x457190
push str._s_s
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x440d28
push 0x5460
lea ecx, [ebp - 0x698]
push ecx
call fcn.00401350
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0x10
cmp dword [0x457844], 0
je 0x42ed44
mov edx, dword [0x457844]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x45783c], 0
je 0x42ed59
mov eax, dword [0x45783c]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x457840], 0
je 0x42ed6f
mov ecx, dword [0x457840]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x456170], 0
je 0x42ed85
mov edx, dword [0x456170]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x456168], 0
je 0x42ed9a
mov eax, dword [0x456168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456164], 0
je 0x42edb0
mov ecx, dword [0x456164]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456158], 0
je 0x42edc6
mov edx, dword [0x456158]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x1450], eax
cmp dword [ebp - 0x1450], 0x3df
jg 0x42ee00
cmp dword [ebp - 0x1450], 0x3df
je 0x42eeac
cmp dword [ebp - 0x1450], 0
je 0x42ee9e
jmp case.default.0x42ee92
cmp dword [ebp - 0x1450], 0x3e9
jg 0x42ee51
cmp dword [ebp - 0x1450], 0x3e9
je 0x42efb4
cmp dword [ebp - 0x1450], 0x3e0
je 0x42eee2
cmp dword [ebp - 0x1450], 0x3e1
je 0x42ef18
cmp dword [ebp - 0x1450], 0x3e2
je 0x42ef74
jmp case.default.0x42ee92
cmp dword [ebp - 0x1450], 0x270e
jg 0x42ee99
cmp dword [ebp - 0x1450], 0x270d
jge 0x42f13b
mov ecx, dword [ebp - 0x1450]
sub ecx, 0x3ea
mov dword [ebp - 0x1450], ecx
cmp dword [ebp - 0x1450], 3
ja case.default.0x42ee92
mov edx, dword [ebp - 0x1450]
jmp dword [edx*4 + 0x42f20c]
jmp case.default.0x42ee92
xor eax, eax
mov word [ebp - 0x698], ax
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42eecb
push 0x43a588
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42eedd
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42ef01
push 0x43a688
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42ef13
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42ef45
mov edx, dword [ebp - 0xb18]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x43a780
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x42ef65
mov edx, dword [ebp - 0xb18]
push edx
mov eax, dword [ebp - 4]
push eax
push str.OS_state_is_unstable___d_:__d_
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x218], 0x30
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42ef93
push 0x43a848
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42efa5
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x218], 0x30
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42efe3
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bca0
push eax
push 0x43a928
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f005
lea eax, [ebp - 0xd26]
push eax
call fcn.0040bca0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42f039
lea edx, [ebp - 0xd26]
push edx
call fcn.0040bca0
push eax
push 0x43ab28
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f05b
lea ecx, [ebp - 0xd26]
push ecx
call fcn.0040bca0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42f08f
lea eax, [ebp - 0xd26]
push eax
call fcn.0040bca0
push eax
push 0x43ad28
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f0b1
lea edx, [ebp - 0xd26]
push edx
call fcn.0040bca0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42f0dc
mov ecx, dword [ebp - 4]
push ecx
push 0x43af28
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f0f5
mov eax, dword [ebp - 4]
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42f120
mov edx, dword [ebp - 4]
push edx
push 0x43b128
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f139
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f195
push 0
call fcn.00413ec0
test eax, eax
je 0x42f164
mov eax, dword [ebp - 0xb18]
push eax
push 0x43b328
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42f180
mov edx, dword [ebp - 0xb18]
push edx
push str.Multiple_Programs_cannot_be_started.___d_
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x218], 0x30
jmp 0x42f195
xor ecx, ecx
mov word [ebp - 0x698], cx
movzx edx, word [ebp - 0x698]
test edx, edx
je 0x42f1c0
mov eax, dword [ebp - 0x218]
push eax
push str._notification_BOX
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0xb1c]
mov dword [ebp - 0x144c], edx
lea ecx, [ebp - 0x699]
call fcn.00401ab0
lea ecx, [ebp - 5]
call fcn.00401ab0
lea ecx, [ebp - 0xd25]
call fcn.00401ab0
lea ecx, [ebp - 0xd26]
call fcn.00401ab0
mov eax, dword [ebp - 0x144c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401ef4
mov esp, ebp
pop ebp
ret 0x10