Function at 0x41c240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60079a
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x69ee98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f0], 0
jmp 0x41c29a
jmp 0x41c29f
call 0x420070
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x234]
push eax
mov dword [0x6c7c3c], 0
mov dword [ebp - 0x234], 8
mov dword [ecx + 0x298], 0
mov dword [ebp - 0x230], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.0049acec
add esp, 4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.WINMM.dll_timeGetTime]
lea eax, [ebp - 0x1ec]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0041f9a0
push 0
call fcn.005e1064
push eax
call fcn.005e0c1f
add esp, 8
jmp 0x41c31f
call fcn.00485933
mov edi, eax
test edi, edi
je 0x41db07
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov eax, 0x674b38
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x22c]
test eax, 0xffff0000
jne 0x41c36c
movzx eax, ax
push eax
call fcn.004030c0
jmp 0x41c378
push 0x66
push 0x674b38
call fcn.004038a0
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x20c], eax
call fcn.00403750
mov edi, eax
add esp, 4
lea ecx, [edi + 0x10]
mov dword [ebp - 0x1f4], ecx
mov byte [ebp - 4], 5
xor edx, edx
mov ebx, 0x17
mov dword [ebp - 0x208], ebx
cmp dword [edi + 4], edx
jle 0x41c3e4
lea esp, [esp]
test edx, edx
js 0x41db1b
mov esi, dword [edi + 4]
cmp edx, esi
jg 0x41db1b
movzx eax, byte [ecx + edx]
inc edx
add ebx, eax
mov dword [ebp - 0x208], ebx
cmp edx, esi
jl 0x41c3c0
or ebx, 0xffffffff
mov byte [ebp - 4], 4
add ecx, 0xfffffff0
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41c40e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
cmp dword [ebp - 0x208], 0x4211
je 0x41c4ce
call fcn.00485933
mov edi, eax
test edi, edi
je 0x41db11
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x208], eax
push 0x32
push str.Detected_attempt_of_changing_unregistered_message_n
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 6
call fcn.004038a0
mov esi, dword [ebp - 0x208]
push 0x10
push str.Hacker_alert
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41c49a
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 4], 0xffffffff
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41dae9
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
jmp 0x41dae9
mov dword [ebp - 4], 3
jmp 0x41c5ff
jmp 0x41c604
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
mov dword [0x6a95ac], 0
push eax
push ecx
mov byte [ebp - 4], 0xb
call fcn.0041be80
mov dword [ebp - 4], 3
jmp 0x41c75f
lea eax, [ebp - 0x218]
or ebx, 0xffffffff
push eax
call fcn.0041faf0
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x218]
cmp dword [eax - 0xc], 0
jne 0x41c78a
mov byte [ebp - 4], 3
lea ecx, [eax - 0x10]
jmp 0x41d578
cmp dword [0x6a9644], 0
je 0x41c9af
mov eax, dword [0x6c7800]
cmp dword [eax - 4], 1
jle 0x41c7b4
push dword [eax - 0xc]
mov ecx, 0x6c7800
call fcn.004039f0
mov eax, dword [0x6c7800]
test eax, eax
jne 0x41c7bc
xor ecx, ecx
jmp 0x41c7d7
push dword [eax - 8]
push eax
call fcn.005dafda
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x41db1b
mov eax, dword [0x6c7800]
cmp ecx, dword [eax - 8]
jg 0x41db1b
mov dword [eax - 0xc], ecx
mov eax, dword [0x6c7800]
mov byte [ecx + eax], 0
mov eax, dword [0x6c7800]
mov esi, dword [0x6c7804]
add esi, 0xfffffff0
lea edx, [eax - 0x10]
cmp edx, esi
je 0x41c85c
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41c84e
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x41c84e
push edx
call fcn.00403750
add esp, 4
mov dword [ebp - 0x1f4], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41c844
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f4]
add eax, 0x10
mov dword [0x6c7804], eax
jmp 0x41c85c
push dword [eax - 0xc]
mov ecx, 0x6c7804
push eax
call fcn.004038a0
lea ecx, [ebp - 0x12c]
call fcn.00486e7e
push 0
push 0x8040
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12c]
push dword [0x6c7804]
call fcn.004874d0
test eax, eax
je 0x41c99b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00496a50
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
mov esi, dword [0x6c7804]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x41c90e
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41c900
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41c900
push edx
call fcn.00403750
add esp, 4
mov dword [ebp - 0x1f4], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41c8f6
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f4]
add eax, 0x10
mov dword [0x6c7804], eax
jmp 0x41c90e
push dword [ecx - 0xc]
push ecx
mov ecx, 0x6c7804
call fcn.004038a0
mov byte [ebp - 4], 0x11
mov eax, ebx
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41c93b
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [0x6c7804]
cmp dword [eax - 4], 1
jle 0x41c958
push dword [eax - 0xc]
mov ecx, 0x6c7804
call fcn.004039f0
mov eax, dword [0x6c7804]
test eax, eax
jne 0x41c960
xor ecx, ecx
jmp 0x41c97b
push dword [eax - 8]
push eax
call fcn.005dafda
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x41db1b
mov eax, dword [0x6c7804]
cmp ecx, dword [eax - 8]
jg 0x41db1b
mov dword [eax - 0xc], ecx
mov eax, dword [0x6c7804]
mov byte [ecx + eax], 0
lea ecx, [ebp - 0x12c]
call fcn.004871f0
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x10
call fcn.00486f10
jmp 0x41cb6a
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x204], 0x104
call fcn.00402dc0
push eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 0x13
push str.SOFTWAREUltra_Screen_Savers_
push eax
call fcn.00403fe0
push str.Settings
push eax
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 0x14
push eax
call fcn.00404190
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x1f4]
mov ecx, ebx
mov dword [ebp - 0x1f0], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41ca44
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x13
mov eax, ebx
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ca71
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x10
mov eax, ebx
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ca9e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
cmp dword [ebp - 0x1f0], 0
jne 0x41cb5e
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1f8]
push eax
push 0
push str.Data
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41cb5e
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41cae4
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
mov ecx, 0x6c7804
call fcn.004038a0
mov eax, dword [0x6c7804]
cmp dword [eax - 4], 1
jle 0x41cb1c
push dword [eax - 0xc]
mov ecx, 0x6c7804
call fcn.004039f0
mov eax, dword [0x6c7804]
test eax, eax
jne 0x41cb24
xor ecx, ecx
jmp 0x41cb3f
push dword [eax - 8]
push eax
call fcn.005dafda
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x41db1b
mov eax, dword [0x6c7804]
cmp ecx, dword [eax - 8]
jg 0x41db1b
mov dword [eax - 0xc], ecx
mov eax, dword [0x6c7804]
mov byte [ecx + eax], 0
mov dword [0x6a9644], 1
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5c
push dword [0x6c7804]
call fcn.005daaeb
mov ecx, eax
add esp, 8
mov eax, dword [0x6c7804]
test ecx, ecx
jne 0x41cb8a
or ecx, 0xffffffff
jmp 0x41cb8c
sub ecx, eax
mov eax, dword [eax - 0xc]
inc ecx
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x1f4]
mov ecx, 0x6c7804
push eax
call fcn.004031e0
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [0x6c7ab0]
lea esi, [eax - 0x10]
lea edi, [ecx - 0x10]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], edi
cmp esi, edi
je 0x41cc31
cmp dword [edi + 0xc], 0
jl 0x41cc23
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x41cc23
push esi
call fcn.00403750
add esp, 4
mov dword [ebp - 0x1f0], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41cc19
mov edi, dword [edi]
push dword [ebp - 0x21c]
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x224]
mov eax, dword [ebp - 0x1f0]
add eax, 0x10
mov dword [0x6c7ab0], eax
jmp 0x41cc31
push dword [eax - 0xc]
mov ecx, 0x6c7ab0
push eax
call fcn.004038a0
mov byte [ebp - 4], 0x10
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41cc55
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
push ecx
mov esi, esp
mov dword [ebp - 0x200], esi
mov eax, dword [0x6c7804]
add eax, 0xfffffff0
push eax
call fcn.00403750
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0041f020
add esp, 4
mov ecx, 0x6c7aac
call fcn.00403680
jmp 0x41cc8b
mov ecx, dword [ebp - 0x1fc]
mov eax, dword [ebp - 0x214]
mov dword [ecx + 0x260], 0
lea edx, [eax + 0xcc]
mov dword [ecx + 0x258], edx
lea ebx, [eax + 0x250]
mov dword [ebp - 0x1f8], edx
lea edx, [eax + 0x100]
mov dword [ecx + 0x25c], edx
mov dword [ebp - 0x224], edx
lea edx, [eax + 0x228]
add eax, 0x23c
mov dword [ecx + 0x264], edx
cmp dword [0x6a9644], 0
mov dword [ebp - 0x21c], eax
mov dword [ecx + 0x290], eax
setne al
movzx eax, al
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x200], esi
mov eax, dword [0x6c7804]
add eax, 0xfffffff0
mov dword [ebp - 0x1f4], edx
push eax
call fcn.00403750
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.004226b0
cmp eax, 0x3ea
je 0x41cfd5
mov eax, dword [0x6c7804]
mov ecx, 0x6c7804
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00404340
mov byte [ebp - 4], 0x16
mov ecx, dword [eax]
mov esi, dword [0x6c7804]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x41cdc4
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41cdb6
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41cdb6
push edx
call fcn.00403750
or ebx, 0xffffffff
mov dword [ebp - 0x1f0], eax
add esp, 4
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41cdac
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f0]
add eax, 0x10
mov dword [0x6c7804], eax
jmp 0x41cdc7
push dword [ecx - 0xc]
push ecx
mov ecx, 0x6c7804
call fcn.004038a0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x10
mov eax, ebx
mov ecx, dword [ebp - 0x204]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41cdf4
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
push 4
push str..dat
mov ecx, 0x6c7804
call fcn.00404470
cmp dword [0x6a9644], 0
setne al
movzx eax, al
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x200], esi
mov eax, dword [0x6c7804]
add eax, 0xfffffff0
push eax
call fcn.00403750
mov ecx, dword [ebp - 0x208]
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.004226b0
mov edi, eax
cmp edi, 0x3ea
je 0x41cfd5
call fcn.00485933
mov dword [ebp - 0x1f4], eax
test eax, eax
je 0x41db57
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x1f4]
call esi
add eax, 0x10
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 0x17
call fcn.00485933
mov dword [ebp - 0x1f4], eax
test eax, eax
je 0x41db4d
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x1f4]
call esi
add eax, 0x10
mov dword [ebp - 0x1f8], eax
push 0x271b
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x18
call fcn.004030c0
push 0x271c
lea ecx, [ebp - 0x1f8]
call fcn.004030c0
cmp edi, 0x3e9
jne 0x41cee9
mov eax, str.Damaged_screen_saver.
mov ecx, 0x15
jmp 0x41cf2f
cmp edi, 0x3f2
jne 0x41cefd
mov eax, str.Invalid_or_missing_Table_of_Contents.
mov ecx, 0x25
jmp 0x41cf2f
cmp edi, 0x3e8
jne 0x41cf11
mov eax, str.Cannot_find_data.
mov ecx, 0x11
jmp 0x41cf2f
cmp edi, 0x3ec
jne 0x41cf25
mov eax, str.No_data_found.
mov ecx, 0xe
jmp 0x41cf2f
mov eax, str.Unknown_reason.
mov ecx, 0xf
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.00404470
push 1
push 0x675a30
lea ecx, [ebp - 0x1f8]
call fcn.00404470
mov eax, dword [0x6c7804]
lea ecx, [ebp - 0x1f8]
push dword [eax - 0xc]
push eax
call fcn.00404470
push 1
push 0x675a30
lea ecx, [ebp - 0x1f8]
call fcn.00404470
mov edi, dword [ebp - 0x208]
mov esi, dword [ebp - 0x1f8]
push 0x10
push edi
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 0x17
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41cfb6
mov ebx, dword [esi]
push esi
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 0x10
lea ecx, [edi - 0x10]
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41d56b
mov edi, dword [ecx]
push ecx
jmp 0x41d55a
jmp 0x41cfda
mov ecx, dword [ebp - 0x214]
xor eax, eax
cmp dword [ecx + 0x13c], eax
mov ecx, dword [ebp - 0x1fc]
setg al
mov dword [ecx + 0x124], eax
mov edi, dword [ebp - 0x1f8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x41d0eb
push str.Untitled
push eax
call fcn.005e3136
add esp, 8
test eax, eax
je 0x41d0eb
mov ecx, dword [edi]
mov esi, dword [0x6c77fc]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x41d32b
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41d0d8
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41d0d8
push edx
call fcn.00403750
or ebx, 0xffffffff
mov dword [ebp - 0x1f0], eax
add esp, 4
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41d083
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f0]
add eax, 0x10
mov dword [0x6c77fc], eax
mov edi, dword [ebp - 0x1f8]
call fcn.00488503
mov eax, dword [eax + 4]
cmp dword [eax + 0x50], 0
je 0x41d0b2
call fcn.00488503
mov eax, dword [eax + 4]
push dword [eax + 0x50]
call fcn.005dafbf
add esp, 4
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x41d333
call fcn.00488503
push dword [edi]
mov esi, dword [eax + 4]
call fcn.005e42bb
add esp, 4
mov dword [esi + 0x50], eax
jmp 0x41d4ae
push dword [ecx - 0xc]
push ecx
mov ecx, 0x6c77fc
call fcn.004038a0
or ebx, 0xffffffff
jmp 0x41d08b
mov eax, dword [0x6c7ab0]
mov esi, dword [0x6c77fc]
add esi, 0xfffffff0
lea edx, [eax - 0x10]
cmp edx, esi
je 0x41d15e
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41d150
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x41d150
push edx
call fcn.00403750
or ebx, 0xffffffff
mov dword [ebp - 0x1f0], eax
add esp, 4
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41d146
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f0]
add eax, 0x10
mov dword [0x6c77fc], eax
jmp 0x41d161
push dword [eax - 0xc]
mov ecx, 0x6c77fc
push eax
call fcn.004038a0
or ebx, 0xffffffff
push 4
lea eax, [ebp - 0x200]
mov ecx, 0x6c77fc
push eax
call fcn.00406b40
mov byte [ebp - 4], 0x19
mov esi, 4
push str..exe
push dword [eax]
or esi, 1
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f0], esi
call fcn.005e3136
add esp, 8
test eax, eax
je 0x41d1d5
push 4
lea eax, [ebp - 0x204]
mov ecx, 0x6c77fc
push eax
call fcn.00406b40
push str..scr
or esi, 2
mov dword [ebp - 0x1fc], esi
push dword [eax]
call fcn.005e3136
add esp, 8
mov byte [ebp - 0x20d], 0
test eax, eax
jne 0x41d1dc
mov byte [ebp - 0x20d], 1
mov ecx, dword [ebp - 0x1fc]
test cl, 2
je 0x41d225
mov edx, dword [ebp - 0x204]
and ecx, 0xfffffffd
mov dword [ebp - 0x1fc], ecx
add edx, 0xfffffff0
mov dword [ebp - 0x1f0], ecx
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41d225
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp - 4], 0x10
test cl, 1
je 0x41d25a
mov ecx, dword [ebp - 0x200]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41d25a
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
cmp byte [ebp - 0x20d], 0
je 0x41d08b
mov eax, dword [0x6c77fc]
mov ecx, 0x6c77fc
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.00404340
mov byte [ebp - 4], 0x1a
mov ecx, dword [eax]
mov esi, dword [0x6c77fc]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x41d2f5
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41d2e7
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41d2e7
push edx
call fcn.00403750
add esp, 4
mov dword [ebp - 0x200], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41d2dd
mov edi, dword [esi]
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x200]
add eax, 0x10
mov dword [0x6c77fc], eax
jmp 0x41d2f5
push dword [ecx - 0xc]
push ecx
mov ecx, 0x6c77fc
call fcn.004038a0
mov byte [ebp - 4], 0x10
mov eax, ebx
mov ecx, dword [ebp - 0x1f0]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41d08b
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
jmp 0x41d08b
or ebx, 0xffffffff
jmp 0x41d091
mov edi, dword [ebp - 0x214]
mov eax, dword [edi + 0xf4]
cmp dword [eax - 0xc], 0
je 0x41d363
call fcn.00488503
push dword [edi + 0xf4]
mov esi, dword [eax + 4]
call fcn.005e42bb
add esp, 4
mov dword [esi + 0x50], eax
jmp 0x41d4b4
mov eax, dword [0x6c7ab0]
add eax, 0xfffffff0
push eax
call fcn.00403750
lea esi, [eax + 0x10]
mov dword [ebp - 0x1fc], esi
push 0x2e
push esi
mov byte [ebp - 4], 0x1b
call fcn.005daaeb
add esp, 0xc
test eax, eax
je 0x41d473
sub eax, esi
cmp eax, 0xffffffff
je 0x41d473
push 0x2e
push esi
call fcn.005daaeb
add esp, 8
test eax, eax
jne 0x41d3b0
or eax, 0xffffffff
jmp 0x41d3b2
sub eax, esi
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00404340
mov byte [ebp - 4], 0x1c
lea edi, [esi - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x200], edi
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x41d443
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x41d42e
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x41d42e
push edx
call fcn.00403750
add esp, 4
mov dword [ebp - 0x1f0], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x41d423
mov edi, dword [edi]
push dword [ebp - 0x200]
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1f0]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1fc], esi
jmp 0x41d443
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x1fc]
call fcn.004038a0
mov esi, dword [ebp - 0x1fc]
mov byte [ebp - 4], 0x1b
mov eax, ebx
mov ecx, dword [ebp - 0x204]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41d473
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x613aec]
mov ecx, ebx
call edi
or ebx, 0xffffffff
call fcn.00488503
push esi
mov edi, dword [eax + 4]
call fcn.005e42bb
mov dword [edi + 0x50], eax
add esp, 4
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41d4ae
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x214]
call fcn.00485933
mov dword [ebp - 0x200], eax
test eax, eax
je 0x41db57
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x200]
call esi
add eax, 0x10
mov dword [ebp - 0x204], eax
mov eax, str.Ultra_Screen_Saver_Maker_
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x204]
test eax, 0xffff0000
jne 0x41d506
movzx eax, ax
push eax
call fcn.004030c0
jmp 0x41d512
push 0x19
push str.Ultra_Screen_Saver_Maker_
call fcn.004038a0
mov byte [ebp - 4], 0x1e
mov ecx, edi
mov esi, dword [ebp - 0x204]
push esi
call fcn.004998b9
lea eax, [ebp - 0x200]
mov ecx, edi
push eax
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.0041e200
test al, al
jne 0x41d590
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41d56b
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x218]
add ecx, 0xfffffff0
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41c49a
mov edi, dword [ecx]
push ecx
jmp 0x41c489
mov byte [ebp - 4], 0x1f
mov eax, dword [0x6a95ac]
cmp eax, 1
jne 0x41d5b7
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
push dword [ebp - 0x220]
call fcn.0041e690
jmp 0x41da3c
cmp eax, 3
jne 0x41d810
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
test eax, eax
jne 0x41d5f8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.0048d47c
mov edi, eax
push 0xa58
mov dword [ebp - 0x228], edi
call fcn.00488616
add esp, 4
mov dword [ebp - 0x200], eax
mov byte [ebp - 4], 0x20
test eax, eax
je 0x41d633
push ecx
mov ecx, eax
call fcn.00412e80
mov ebx, eax
mov dword [ebp - 0x1fc], eax
jmp 0x41d63b
xor ebx, ebx
mov dword [ebp - 0x1fc], ebx
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 0x1f
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x224]
mov edx, dword [ebp - 0x1f8]
mov dword [ebx + 0x84], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebx + 0x88], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebx + 0x8c], eax
mov eax, dword [ebp - 0x208]
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x90], eax
call fcn.00485933
mov ebx, eax
test ebx, ebx
je 0x41db61
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x613aec]
mov ecx, ebx
call edi
add eax, 0x10
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x1f0]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push str.DrawWnd_rect:___d___d___d___d__n
push eax
call fcn.00407050
mov edi, dword [ebp - 0x1f0]
add esp, 0x18
push dword [edi - 8]
push edi
call fcn.005dafda
add esp, 8
test eax, eax
js 0x41db1b
cmp eax, dword [edi - 8]
jg 0x41db1b
mov dword [edi - 0xc], eax
mov byte [edi + eax], 0
call fcn.00485933
mov dword [ebp - 0x200], eax
test eax, eax
je 0x41db6b
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [0x613aec]
mov ecx, dword [ebp - 0x200]
call ebx
add eax, 0x10
mov dword [ebp - 0x220], eax
push 0x2716
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x22
call fcn.004030c0
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x128]
mov ebx, dword [ebp - 0x1fc]
push 0
push dword [ebp - 0x228]
mov ebx, dword [ebx]
push eax
push 0x52000000
push dword [ebp - 0x220]
mov ebx, dword [ebx + 0x168]
mov ecx, ebx
push 0
call dword [0x613aec]
mov ecx, dword [ebp - 0x1fc]
call ebx
mov byte [ebp - 4], 0x21
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x220]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41d7ce
mov eax, dword [ecx]
mov dword [ebp - 0x228], eax
push ecx
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x613aec]
mov ecx, dword [ebp - 0x228]
call ebx
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x214]
add edi, 0xfffffff0
mov eax, dword [ebp - 0x1fc]
mov byte [ebp - 4], 0x1f
mov dword [ecx + 0x20], eax
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41da3c
mov ebx, dword [edi]
push edi
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x613aec]
mov ecx, ebx
call edi
or ebx, 0xffffffff
jmp 0x41da3c
cmp eax, 4
je 0x41d889
cmp eax, 5
je 0x41d889
cmp eax, 6
je 0x41d889
cmp eax, 2
jne 0x41d8bd
push str.MPR.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41da3c
push str.PwdChangePasswordA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1f0], eax
test eax, eax
jne 0x41d860
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1f0]
push 0
push 0
push dword [ebp - 0x220]
mov ecx, eax
push str.SCRSAVE
call dword [0x613aec]
call dword [ebp - 0x1f0]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41da3c
call fcn.00407560
mov ecx, eax
cmp ecx, 1
jle 0x41d986
cmp dword [edi + 0x1fc], 0
lea eax, [edi + 0x1fc]
mov dword [ebp - 0x1f0], eax
je 0x41d991
push ecx
call fcn.0041db80
cmp eax, 4
jne 0x41d909
mov eax, ebx
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41d8e4
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov byte [ebp - 4], 3
mov eax, ebx
mov ecx, dword [ebp - 0x218]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41c49a
mov edi, dword [ecx]
push ecx
jmp 0x41c489
test eax, eax
jne 0x41d99d
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x158]
push eax
push 0x4074b0
push 0
push 0
mov dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x130], 1
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov eax, dword [ebp - 0x138]
mov dword [0x6c7c3c], eax
jmp 0x41d99d
mov eax, dword [ebp - 0x228]
add eax, 0x1fc
mov dword [ebp - 0x1f0], eax
mov dword [eax], 0
push 0xa68
call fcn.00488616
mov edi, eax
add esp, 4
mov dword [ebp - 0x228], edi
mov byte [ebp - 4], 0x24
test edi, edi
je 0x41d9d4
push ecx
mov ecx, edi
call fcn.00412e80
mov dword [edi], vtable.CSaverWnd.0
mov dword [edi + 0xa54], 0
jmp 0x41d9d6
xor edi, edi
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x1f0]
cmp dword [eax], 0
je 0x41d9f0
mov eax, dword [0x6c7c3c]
mov dword [edi + 0xa54], eax
mov eax, dword [ebp - 0x224]
mov ecx, edi
mov edx, dword [ebp - 0x1f8]
mov dword [edi + 0x84], eax
mov eax, dword [ebp - 0x21c]
mov dword [edi + 0x88], eax
mov eax, dword [ebp - 0x1f4]
mov dword [edi + 0x8c], eax
mov eax, dword [ebp - 0x208]
mov dword [edi + 0x80], edx
mov dword [edi + 0x90], eax
call fcn.004205e0
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 0x20], edi
mov eax, ebx
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41da63
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov byte [ebp - 4], 3
mov eax, ebx
mov ecx, dword [ebp - 0x218]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41da90
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 4], 0xffffffff
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41dabb
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, 1
jmp 0x41daeb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80070057
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
int3