Function at 0x416bb2
Capabilities:
Check if file exists
Create thread
Delete file
Get file attributes
Link many functions at runtime
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11cc
call fcn.00452960
push ebx
push esi
push edi
mov dword [ebp - 0x530], 0
mov dword [ebp - 4], 0
lea edi, [ebp - 0xc70]
xor eax, eax
mov ecx, 0x1ce
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x528], 0
push 0x4702bc
push 0x4702cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc70], eax
push 0x4702d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc74], eax
cmp dword [0x462260], 0
je 0x416e2b
push 0x100
lea eax, [ebp - 0xd90]
push eax
push 0x4702e4
call fcn.004280cc
add esp, 0xc
lea eax, [ebp - 0xdb4]
push eax
lea eax, [ebp - 0xd90]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0xc90], eax
cmp dword [0x45e03c], 0
je 0x416c8b
lea eax, [ebp - 0xd90]
push eax
push str._nNTOS:ImagePath___s_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0xc90], 0
je 0x416cb7
cmp dword [0x45e03c], 0
je 0x416cb2
push str._n_rProblem_getting_information_NTOS
call fcn.004535b0
add esp, 4
jmp 0x416da6
cmp dword [0x45e03c], 0
je 0x416ce1
lea eax, [ebp - 0xd98]
push eax
call fcn.00453370
add esp, 4
push eax
push str._n_rNTOS:Time_stamp_:__s
call fcn.00452380
add esp, 8
cmp dword [ebp - 0xd98], 0x410c0000
jle 0x416da6
cmp dword [0x462054], 0
je 0x416d46
cmp dword [0x45e03c], 0
je 0x416d21
push 0xc
call dword [0x462054]
push eax
push str._n_rNPFX____d_
call fcn.00452380
add esp, 8
push 0xc
call dword [0x462054]
test eax, eax
je 0x416d46
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x530]
mov dword [0x462288], eax
cmp dword [0x45e03c], 0
je 0x416d6d
mov eax, dword [0x46227c]
push eax
mov eax, dword [ebp - 0x530]
push eax
push str._n_rNTOS:FOUND_____SP2_or_post__d__NX___d_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0xd98], 0x45a08888
jle 0x416da6
mov dword [0x46228c], 1
push str._n_rNTBMAP_FOUND__pause_
call fcn.00452380
add esp, 4
call fcn.004352b7
push str._n_rNTBU_IO_X_n
call fcn.00452380
add esp, 4
cmp dword [0x462264], 0
je 0x416e2b
cmp dword [ebp - 0x530], 0
je 0x416e2b
call fcn.0041680d
mov dword [ebp - 0xc80], eax
cmp dword [ebp - 0xc80], 0
je 0x416e2b
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc80]
add eax, 0x900
mov dword [ebp - 0xc8c], eax
sub dword [ebp - 0xc74], 0x300
mov eax, dword [ebp - 0xc80]
cmp dword [ebp - 0xc8c], eax
jbe 0x416e2b
add dword [ebp - 0xc80], 4
mov eax, dword [ebp - 0xc80]
mov eax, dword [eax]
add dword [0x462e80], eax
jmp 0x416dff
cmp dword [0x45e03c], 0
je 0x416e52
mov eax, dword [0x462290]
push eax
mov eax, dword [ebp - 0xc74]
push eax
push str._n_rMHAN_K32_22_4___x____04X_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0xc74]
add eax, 0x2ff
mov dword [0x462090], eax
mov dword [ebp - 0xc74], fcn.00416bb2
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc68], eax
push 0x4703e0
push 0x4703e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.SetLastError
push 0x470404
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push 0x470410
push 0x470424
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.ExitProcess
push 0x47043c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push 0x470448
push 0x47045c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.ExitVDM
push 0x470470
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.CreateThread
push 0x47048c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.DispatchMessageW
push 0x4704ac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.GetForegroundWindow
push 0x4704c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.GetWindowThreadProcessId
push 0x4704ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.GetWindowTextA
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
mov al, byte [0x462260]
mov byte [ebp - 0xc37], al
cmp dword [0x462260], 0
je 0x417128
cmp dword [0x4622a4], 0
jne 0x417128
mov dword [0x462254], 1
mov byte [0x508e60], 0
call fcn.00428387
mov al, byte [0x462254]
mov byte [ebp - 0xc38], al
mov al, byte [0x462270]
mov byte [ebp - 0xc36], al
cmp dword [0x462268], 0
jne 0x417187
push str.CreateProcessA
push 0x47051c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
jmp 0x417191
mov dword [ebp - 0xc34], 0
cmp dword [0x462260], 0
je 0x4171fb
push str.GetModuleHandleW
push 0x47053c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
cmp dword [0x45e03c], 0
je 0x4171f6
mov eax, dword [ebp - 0xc78]
push eax
push str._n_rMHW___x__n
call fcn.00452380
add esp, 8
jmp 0x417205
mov dword [ebp - 0xc30], 0
push str.lstrlenW
push 0x470560
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.CopyFileExW
push 0x470578
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.MoveFileW
push 0x470590
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.MoveFileExW
push 0x4705a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.CreateFileW
push 0x4705c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.URLMON.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc7c], eax
push str.CreateURLMoniker
mov eax, dword [ebp - 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.CreateURLMonikerEx
mov eax, dword [ebp - 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
cmp dword [ebp - 0xc7c], 0
je 0x4173a7
mov eax, dword [ebp - 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0xc14]
push eax
mov eax, dword [ebp - 0xc18]
push eax
mov eax, dword [ebp - 0xc2c]
push eax
push str._n_r___x____x_____x_____
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0xdbc]
add eax, 4
mov dword [ebp - 0xdb8], eax
mov eax, dword [ebp - 0xdb8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0xdbc]
mov eax, dword [eax]
push eax
push str._n_r__LWS__x___x_
call fcn.00452380
add esp, 0xc
push str.LoadLibraryExW
push 0x47063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.FreeLibrary
push 0x470654
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.FreeLibraryAndExitThread
push 0x47067c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0xc00], 0
lea edi, [ebp - 0xae0]
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
cmp dword [0x46228c], 0
je 0x4174e6
mov byte [ebp - 0xad0], 0xc1
jmp 0x4174ed
mov byte [ebp - 0xad0], 0
push str.PrivCopyFileExW
push 0x470698
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.DeleteFileW
push 0x4706b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push str.CreateProcessAsUserW
push 0x4706d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xac4], eax
cmp dword [0x462254], 0
je 0x4175a8
mov esi, 0x5acfc0
lea edi, [ebp - 0xbf8]
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
jmp 0x4175af
mov byte [ebp - 0xbf8], 0
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0xfc0], eax
mov eax, 0x4706e0
mov ecx, 0x4706e4
mov edx, dword [ebp - 0xfc0]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x4706e8
lea eax, [ebp - 0xfbc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xfbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4176ed
mov eax, 0x4706fc
mov ecx, 0x470700
mov edx, dword [ebp - 0xfc0]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x470704
lea eax, [ebp - 0x11c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x11c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0xfc0], eax
cmp dword [0x45e03c], 0
je 0x4176a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xfc0]
push eax
lea eax, [ebp - 0x11c0]
push eax
push 0x470718
call fcn.00452380
add esp, 0x10
push 3
lea eax, [ebp - 0x11c0]
push eax
lea eax, [ebp - 0xfbc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0xfc0], eax
cmp dword [0x45e03c], 0
je 0x4176ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xfbc]
push eax
push 0x470730
call fcn.00452380
add esp, 0x10
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0xb84]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb84]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
xor ecx, ecx
mov cl, byte [ebp + eax - 0xb85]
cmp ecx, 0x5c
jne 0x417779
mov edx, 0x470744
lea edi, [ebp - 0xb84]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov al, byte [edx + 0xc]
mov byte [edi + 0xc], al
jmp 0x4177a6
mov edx, 0x470754
lea edi, [ebp - 0xb84]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov ax, word [edx + 0xc]
mov word [edi + 0xc], ax
lea eax, [ebp - 0xb84]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4177e2
cmp dword [0x45e03c], 0
je 0x4177dd
lea eax, [ebp - 0xb84]
push eax
push str._n_rFAIL_XPx32_LF_D__nDOES_NOT_EXIST__n____s__n
call fcn.00452380
add esp, 8
jmp 0x417880
mov dword [ebp - 0xc74], 0x1a1b1a1b
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xb94], eax
push str.LoadLibraryA
push 0x4707a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
push 0x4707b0
push 0x4707c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xc74]
mov eax, dword [eax]
mov dword [ebp - 0xc78], eax
cmp dword [0x45e03c], 0
je 0x417880
push str._r_nXP_setup_LWA32_11_22_14
call fcn.00452380
add esp, 4
cmp dword [0x4621ac], 0
je 0x417899
mov byte [ebp - 0xbf9], 0x3b
jmp 0x4178a0
mov byte [ebp - 0xbf9], 0
cmp dword [0x45e03c], 0
je 0x41793b
xor eax, eax
mov al, byte [ebp - 0xbf9]
push eax
push str._n_rNW_X_sl__10___x_
call fcn.00452380
add esp, 8
push str.CreateProcessW
push 0x47080c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
mov cl, byte [eax + 4]
push ecx
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
mov cl, byte [eax + 3]
push ecx
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
mov cl, byte [eax + 2]
push ecx
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
mov cl, byte [eax]
push ecx
mov eax, dword [ebp - 0xc74]
push eax
push str._n_r_X:_C_W__02x._02x._02x._02x._02x_
call fcn.00452380
add esp, 0x1c
push 0
lea eax, [ebp - 0xc88]
push eax
push 0x523
lea eax, [ebp - 0x528]
push eax
push 0x73a
lea eax, [ebp - 0xc70]
push eax
push 0xab350500
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov byte [ebp - 0xc70], 0xb1
mov dword [ebp - 0x528], 0xffffffff
push 0
lea eax, [ebp - 0xc88]
push eax
push 0x523
lea eax, [ebp - 0x528]
push eax
push 0x73a
lea eax, [ebp - 0xc70]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [ebp - 0x528], 0
jne 0x4179e8
call fcn.00414fae
push 0x10
push str.LOAD_ERROR_
push str.SofTrack_Local_Agent_Initialization_Failed._n_nCode_0xC1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xca
call fcn.00452410
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x528]
cmp eax, 1
jne 0x417a3f
xor eax, eax
mov al, byte [ebp - 0x527]
cmp eax, 2
jne 0x417a3f
xor eax, eax
mov al, byte [ebp - 0x526]
cmp eax, 3
jne 0x417a3f
xor eax, eax
mov al, byte [ebp - 0x525]
cmp eax, 4
jne 0x417a3f
mov dword [0x462250], 1
mov eax, dword [ebp - 0x524]
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [0x481d20]
cmp eax, 0x78
jne 0x417aaf
cmp dword [0x45e03c], 0
je 0x417a7f
push str._n_rSending_down_list_of_EXE_ok_to_create
call fcn.00452380
add esp, 4
mov eax, 0x481d20
add eax, 0x64
push eax
push 0x4708a8
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0xc88]
push eax
push 0x523
lea eax, [ebp - 0x528]
push eax
push 0x7d0
push 0x481d20
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
xor eax, eax
mov al, byte [0x480f40]
cmp eax, 0x79
jne 0x417b1f
cmp dword [0x45e03c], 0
je 0x417aef
push str._n_rSending_down_list_of_EXE_to_not_track_file_open_create
call fcn.00452380
add esp, 4
mov eax, 0x480f40
add eax, 0x64
push eax
push str._n_rList:_n_r_s
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0xc88]
push eax
push 0x523
lea eax, [ebp - 0x528]
push eax
push 0x7d0
push 0x480f40
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x417b46
mov eax, dword [0x462250]
push eax
mov eax, dword [ebp - 0x528]
push eax
push str._nDriver_Rev___x___d_
call fcn.00452380
add esp, 0xc
cmp dword [0x462284], 0
je 0x417c44
cmp dword [0x4621fc], 0
je 0x417c3f
cmp dword [0x462278], 0
je 0x417c17
push 0
push 0
call fcn.0042e65e
add esp, 8
test eax, eax
jne 0x417bfd
push str.cptlwa32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x417bf8
cmp dword [0x45e03c], 0
je 0x417bb9
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_nTRUE_TS_FIRST_START_SPPSVC_AND_WAIT_55_._X
call fcn.00452380
add esp, 8
push 0
push str.sppsvc
call fcn.0043865d
add esp, 8
push 0xd6d8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x45e03c], 0
je 0x417bf8
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_nTRUE_TS_START_COMPLETE_._X
call fcn.00452380
add esp, 8
jmp 0x417c17
cmp dword [0x45e03c], 0
je 0x417c17
push str._r_nTSA_630A:_PreL_skipped
call fcn.00452380
add esp, 4
call fcn.0043938a
lea eax, [ebp - 0x11c8]
push eax
push 0
push 0
push 0x416b8d
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x11cc], eax
jmp 0x417c63
cmp dword [0x462280], 0
jne 0x417c5e
cmp dword [0x4621fc], 0
je 0x417c63
call fcn.0043938a
mov dword [0x4621f4], 1
pop edi
pop esi
pop ebx
leave
ret