Function at 0x4088b4
Capabilities:
Capture screenshot
Check for foreground window switch
Check for unmoving mouse cursor
Check if file exists
Copy file
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Delete file
Delete registry key
Enumerate gui resources
Get common file path
Get file attributes
Get file size
Move file
Open clipboard
Print debug messages
Read clipboard data
Set file attributes
Set registry value
Shutdown system
Write and execute a file
Write clipboard data
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, 0x173b4
call fcn.00410c20
push ebx
mov ebx, dword [ebp + 0x7c]
push esi
push edi
mov edi, ecx
mov dword [ebp + 0x70], edi
jmp 0x4098a0
push str.showerror
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4088ee
mov dword [edi + 0x4010c], 1
push str.paramsfile
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x4098bb
push str.cmdwait
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408937
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jge 0x408937
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
mov dword [ebp + 0x7c], ebx
push str.loop
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408957
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x4098e9
push str.remote
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408977
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40995a
push str.multiremote
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408997
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40998c
push str.qboxcom
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4089f0
lea esi, [ebx + 2]
cmp esi, dword [edi + 0x40100]
jge 0x4089f0
push 0x24
mov eax, dword [edi + 0x40108]
mov ecx, esi
shl ecx, 0xc
add ecx, edi
inc ebx
shl ebx, 0xc
push ecx
add ebx, edi
push ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x409952
cmp esi, dword [edi + 0x40100]
mov dword [ebp + 0x7c], esi
jge 0x409952
mov ebx, esi
jmp 0x40989f
push str.qboxcomtop
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408a13
lea esi, [ebx + 2]
cmp esi, dword [edi + 0x40100]
jge 0x408a13
push 0x1024
jmp 0x4089b5
push str.infobox
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408a33
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x409a14
push str.qbox
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408a53
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x409a3c
push str.qboxtop
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408a73
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x409ab1
push str.exec2
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408a93
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x409ab8
push str.exec
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ab3
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x409ba5
push str.execmd
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ad3
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x409c38
push str.regsetval
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408bcb
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jge 0x408bcb
lea eax, [ebp + 0x6c]
push eax
lea edi, [ebx + 2]
lea eax, [ebp + 0x48]
shl edi, 0xc
add edi, dword [ebp + 0x70]
xor esi, esi
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x6c], esi
call fcn.0040e702
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
je 0x409ce4
cmp dword [ebp + 0x6c], esi
je 0x408b44
mov eax, dword [ebp + 0x6c]
or eax, 0x2001f
push eax
lea eax, [ebp + 0x48]
push eax
push 0x411f28
push dword [ebp + 0x48]
call fcn.0040e8d8
add esp, 0x10
mov edi, dword [ebp + 0x70]
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push 0x4131cc
push eax
mov dword [ebp + 0x4c], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x408b6a
mov dword [ebp + 0x58], 1
push str.EXPAND_SZ
push dword [ebp + 0x4c]
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x408b84
mov dword [ebp + 0x58], 2
cmp dword [ebp + 0x58], esi
jne 0x409cf6
push str.DWORD
push dword [ebp + 0x4c]
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
je 0x409d94
push str.BINARY
push dword [ebp + 0x4c]
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
je 0x409dbe
cmp dword [ebp + 0x6c], esi
je 0x408bcd
push dword [ebp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408bcd
xor esi, esi
push str.regdelval
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408bed
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x409e6e
push str.regdelkey
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408c0d
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x409f41
push str.regedit
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408c2d
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a02c
push str.inisetval
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408c4d
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jl 0x40a052
push str.inidelval
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408c6d
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40a081
push str.inidelsec
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408c8d
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a08d
push str.rasdialdlg
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408cad
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a09a
push str.inetdial
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ccd
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a12e
push str.rasdial
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ced
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a16e
push str.moverecyclebin
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408d0d
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a2b4
push str.emptybin
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40a303
push str.rashangup
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40a322
push str.exitwin
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408d57
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a391
push str.abortshutdown
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408d75
call fcn.00402423
test eax, eax
jne 0x40a458
push str.initshutdown
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408d93
call fcn.00402423
test eax, eax
jne 0x40a4a1
push str.cmdshortcut
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408db3
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a57e
push str.cmdshortcutkey
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408dd3
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40a590
push str.shortcut
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408df3
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40a5a2
push str.shexec
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408e13
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a5ae
push str.clonefiletime
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408e33
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a5ec
push str.setfiletime
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408e53
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a6bb
push str.setfilefoldertime
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408e73
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a6da
push str.setconsolemode
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408e93
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a6ff
push str.consolewrite
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408eb3
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a744
push str.setconsolecolor
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ed3
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a755
push str.debugwrite
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408ef3
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a78e
push str.setcursor
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408f13
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a7a0
push str.setcursorwin
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408f33
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a7c7
push str.restartexplorer
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40a812
push str.sendkeypress
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408f68
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40a81c
push str.sendkey
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408f88
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a94b
push str.sendmouse
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408fa8
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40a9e4
push str.movecursor
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408fc8
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40ab5f
push str.changebrightness
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x408fe8
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40ab98
push str.setbrightness
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409008
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40ac8c
push str.setprimarydisplay
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409028
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40ad1a
push str.setdisplay
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409048
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40ad75
push str.closeprocess
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409068
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40af13
push str.killprocess
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409088
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40af79
push str.memdump
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4090a8
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40afd5
push str.service
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4090c8
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40afe3
push 0x4136bc
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4090e8
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40b175
push str.lockws
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40b235
push 0x412bb8
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40911d
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40b263
push str.setdialuplogon
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40913d
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40b715
push str.script
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40915d
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40b75f
push str.mediaplay
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40917d
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40b7a2
push str.urlshortcut
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40919d
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40b8c0
push str.monitor
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4091bd
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40b99f
push str.screensaver
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40ba78
push str.screensavertimeout
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4091f2
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40ba95
push str.runassystem
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409212
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bab3
push str.runinteractive
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409232
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bb61
push str.runinteractivecmd
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409252
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bb79
push str.elevate
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409272
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bbe8
push str.elevatecmd
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409292
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bc46
push str.runas
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4092b2
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40bc9a
push str.standby
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40bdb3
push str.hibernate
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40bdd7
push str.compname
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4092fc
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bdf2
push str.cdrom
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409375
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jge 0x409375
push 7
pop ecx
xor eax, eax
mov byte [ebp + 4], 0
lea edi, [ebp + 5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.open
push dword [ebp + 0x70]
stosb byte es:[edi], al
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x409344
push str.Open
jmp 0x40935d
push str.close
push dword [ebp + 0x70]
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x409368
push str.Closed
lea eax, [ebp + 4]
push eax
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
cmp byte [ebp + 4], 0
jne 0x40be04
mov edi, dword [ebp + 0x70]
push str.beep
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409395
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40bf49
push str.wait
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4093b5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bf70
push str.suspendprocess
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4093d5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40bf83
push str.resumeprocess
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4093f5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c02e
push str.setprocesspriority
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409415
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c0c4
push str.setprocessaffinity
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409435
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c182
push str.waitprocess
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409455
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c24b
push str.setvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409475
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40c2fd
push str.changevolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409495
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40c3d7
push str.setsysvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4094b5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c40e
push str.changesysvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4094d5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c48c
push str.setsysvolume2
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4094f5
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c4f0
push str.changesysvolume2
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409515
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c560
push str.mutesysvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409535
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c5cb
push str.setappvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409555
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c635
push str.changeappvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409575
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c69f
push str.muteappvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409595
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c6f7
push str.mutesubunitvolume
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4095b5
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40c752
push str.setsubunitvolumedb
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4095d5
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40c81f
push str.setdefaultsounddevice
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4095f5
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40c8f2
push str.showsounddevices
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40c998
push str.regsvr
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40962a
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40c9a2
push 0x413b2c
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409677
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jge 0x409677
push str.install
lea eax, [ebx + 1]
push edi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x40], esi
call fcn.00405a62
test eax, eax
jne 0x40cad0
lea esi, [ebp + 0x34]
call fcn.00401a24
call fcn.00401a73
xor esi, esi
push str.shellrefresh
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40cb04
push str.convertimages
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4096ac
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40cb17
push str.convertimage
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4096cc
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40cc4b
push str.deskrefresh
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40cc99
push str.sysrefreshfont
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40cd80
push str.sysrefreshcolor
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40cd9b
push str.sysrefresh
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40cda8
push str.stdbeep
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40ce0f
push str.returnval
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409755
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40ce53
push 0x413c14
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409775
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jl 0x40ce65
push str.speak
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409795
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40ce74
push str.dlgany
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4097b5
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jl 0x40d068
push str.shellcopy
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x4097d5
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
jl 0x40d06f
push str.savescreenshot
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x4097f7
push str.savescreenshotfull
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409806
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40d135
push str.savescreenshotwin
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409826
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40d2fa
push str.filldelete
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x409846
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jl 0x40d431
push 0x413cb4
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x409952
mov eax, ebx
shl eax, 0xc
cmp byte [eax + edi], 0x3b
je 0x409952
push str.trayballoon
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40988a
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jl 0x40d63f
push str.help
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40d789
inc ebx
cmp ebx, dword [edi + 0x40100]
mov dword [ebp + 0x7c], ebx
jl 0x4088d3
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jge 0x4098af
lea ecx, [ebx + 3]
shl ecx, 0xc
add ecx, edi
push ecx
lea ecx, [ebx + 2]
shl ecx, 0xc
add ecx, edi
inc ebx
shl ebx, 0xc
push ecx
add ebx, edi
push ebx
push eax
mov esi, edi
call fcn.00408724
jmp 0x4098b1
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
mov dword [ebp + 0x58], eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
and dword [ebp + 0x7c], 0
cmp dword [ebp + 0x58], 0
mov dword [ebp + 0x60], eax
jbe 0x409952
lea esi, [edi + ebx*4 + 0x4000c]
mov eax, dword [ebp + 0x7c]
mov dword [edi + 0x40118], eax
mov eax, dword [edi + 0x402b4]
add eax, dword [esi]
xor ebx, ebx
push eax
mov ecx, edi
call fcn.00408833
mov eax, dword [ebp + 0x58]
dec eax
cmp dword [ebp + 0x7c], eax
je 0x409947
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x58]
jb 0x40991a
xor eax, eax
inc eax
jmp 0x4098b1
push str.copy
inc ebx
push edi
mov eax, ebx
xor esi, esi
call fcn.00405a62
test eax, eax
je 0x409970
inc esi
inc ebx
mov eax, dword [edi + ebx*4 + 0x40004]
add eax, dword [edi + 0x402b4]
push esi
shl ebx, 0xc
push eax
add ebx, edi
push ebx
call fcn.00408068
jmp 0x409952
push str.copy
inc ebx
push edi
mov eax, ebx
xor esi, esi
call fcn.00405a62
test eax, eax
je 0x4099a2
inc esi
inc ebx
xor eax, eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], eax
mov eax, ebx
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebp + 0x30]
mov dword [ebp + 0x40], 0x100
call fcn.00403049
test eax, eax
je 0x4099fc
mov eax, dword [edi + 0x402b4]
mov dword [edi + 0x4011c], ebx
mov ebx, dword [ebp + 0x30]
test ebx, ebx
mov dword [edi + 0x40120], eax
mov dword [edi + 0x40124], esi
jne 0x4099ef
mov ebx, 0x411f28
push 0x40830f
push edi
call fcn.004022c8
pop ecx
pop ecx
cmp dword [ebp + 0x30], 0
je 0x409952
push dword [ebp + 0x30]
call sub.msvcrt.dll_free
pop ecx
jmp 0x409952
lea eax, [ebx + 2]
shl eax, 0xc
push 0x40
add eax, edi
call fcn.004022ba
inc ebx
shl ebx, 0xc
push eax
add ebx, edi
push ebx
push dword [edi + 0x40108]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x409952
push 0x24
mov eax, dword [edi + 0x40108]
lea ecx, [ebx + 2]
shl ecx, 0xc
add ecx, edi
push ecx
lea ecx, [ebx + 1]
shl ecx, 0xc
add ecx, edi
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x409952
push 0xfff
lea eax, [ebp - 0x22db]
push 0
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
mov eax, dword [edi + ebx*4 + 0x4000c]
add eax, dword [edi + 0x402b4]
add esp, 0xc
push eax
push edi
lea eax, [ebp - 0x22dc]
call fcn.0040531a
push 5
lea eax, [ebp - 0x22dc]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
jmp 0x409952
push 0x1024
jmp 0x409a3e
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push str.hide
push eax
mov dword [ebp + 0x7c], 5
mov dword [ebp + 0x4c], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409ade
and dword [ebp + 0x7c], eax
push 0x412f08
push dword [ebp + 0x4c]
xor esi, esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409afa
mov dword [ebp + 0x7c], 3
push 0x412f0c
push dword [ebp + 0x4c]
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409b14
mov dword [ebp + 0x7c], 6
push 0xfff
lea eax, [ebp - 0x22db]
push esi
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
mov eax, dword [edi + ebx*4 + 0x4000c]
add eax, dword [edi + 0x402b4]
add esp, 0xc
push eax
push edi
lea eax, [ebp - 0x22dc]
call fcn.0040531a
push 0x40
lea eax, [ebp - 0x1c]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp + 0x34], esi
lea edi, [ebp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov ax, word [ebp + 0x7c]
mov word [ebp + 0x10], ax
add ebx, 2
lea eax, [ebp + 0x34]
push eax
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x22dc]
xor edi, edi
push eax
inc edi
push esi
mov dword [ebp - 0x20], 0x44
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov eax, edi
jmp 0x4098b1
lea eax, [ebx + 1]
shl eax, 0xc
lea esi, [eax + edi]
push str.hide
push esi
mov dword [ebp + 0x7c], 5
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409bc9
and dword [ebp + 0x7c], eax
push 0x412f08
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409be1
mov dword [ebp + 0x7c], 3
push 0x412f0c
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x409bf9
mov dword [ebp + 0x7c], 6
push 0xfff
lea eax, [ebp - 0x22db]
push 0
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
mov eax, dword [edi + ebx*4 + 0x40008]
add eax, dword [edi + 0x402b4]
add esp, 0xc
push eax
push edi
lea eax, [ebp - 0x22dc]
call fcn.0040531a
push dword [ebp + 0x7c]
jmp 0x409a9f
push 0xfff
xor esi, esi
lea eax, [ebp - 0x22db]
push esi
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
push 0x1063
lea eax, [ebp - 0x733f]
push esi
push eax
mov byte [ebp - 0x7340], 0
call sub.msvcrt.dll_memset
push 0x63
lea eax, [ebp - 0x3f]
push esi
push eax
mov byte [ebp - 0x40], 0
call sub.msvcrt.dll_memset
add esp, 0x24
call fcn.00402423
test eax, eax
lea eax, [ebp - 0x40]
je 0x409c92
push str.cmd.exe
jmp 0x409c97
push str.command.com
push eax
call sub.msvcrt.dll_strcpy
mov eax, dword [edi + ebx*4 + 0x40004]
add eax, dword [edi + 0x402b4]
pop ecx
pop ecx
push eax
push edi
lea eax, [ebp - 0x22dc]
call fcn.0040531a
lea eax, [ebp - 0x22dc]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7340]
push str._s__c__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
push esi
lea eax, [ebp - 0x7340]
jmp 0x409aa5
push str.The_specified_key_is_not_valid__
mov eax, dword [ebp + 0x70]
call fcn.004059bd
jmp 0x409952
push dword [ebp + 0x58]
lea eax, [ebx + 4]
shl eax, 0xc
add ebx, 3
add eax, edi
push eax
shl ebx, 0xc
add ebx, edi
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x48]
call fcn.0040e960
add esp, 0x14
test eax, eax
jne 0x409d7d
mov ebx, edi
mov eax, dword [ebx + 0x40108]
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
cmp dword [ebx + 0x4010c], esi
mov dword [ebx + 0x402c0], edi
je 0x409d7d
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp + 0x6c], esi
je 0x409952
push dword [ebp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409952
lea eax, [ebx + 4]
shl eax, 0xc
add eax, edi
call fcn.00402651
add ebx, 3
push eax
shl ebx, 0xc
add ebx, edi
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x48]
call fcn.0040e9a4
add esp, 0x10
jmp 0x409d19
add ebx, 4
lea eax, [ebp + 0x58]
shl ebx, 0xc
push eax
add ebx, edi
mov dword [ebp + 0x58], esi
call fcn.00402805
test eax, eax
pop ecx
mov dword [ebp + 0x60], eax
je 0x409e65
push dword [ebp + 0x58]
push eax
mov eax, dword [ebp + 0x7c]
add eax, 3
shl eax, 0xc
add eax, edi
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x48]
call fcn.0040e9f0
add esp, 0x14
test eax, eax
jne 0x409e5c
mov esi, edi
mov ebx, dword [esi + 0x40108]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
cmp dword [esi + 0x4010c], 0
mov dword [esi + 0x402c0], edi
je 0x409e5c
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp + 0x6c], 0
jmp 0x409d80
lea eax, [ebp + 0x7c]
push eax
lea edi, [ebx + 1]
lea eax, [ebp + 0x58]
shl edi, 0xc
add edi, dword [ebp + 0x70]
push eax
mov dword [ebp + 0x7c], esi
call fcn.0040e702
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x409ce4
cmp dword [ebp + 0x7c], esi
je 0x409eb5
mov eax, dword [ebp + 0x7c]
or eax, 0x2001f
push eax
lea eax, [ebp + 0x58]
push eax
push 0x411f28
push dword [ebp + 0x58]
call fcn.0040e8d8
add esp, 0x10
add ebx, 2
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
push ebx
push edi
push dword [ebp + 0x58]
call fcn.0040ea35
add esp, 0xc
test eax, eax
jne 0x409f30
mov ebx, dword [ebp + 0x70]
mov eax, dword [ebx + 0x40108]
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
cmp dword [ebx + 0x4010c], esi
mov dword [ebx + 0x402c0], edi
je 0x409f30
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp + 0x7c], esi
je 0x409952
push dword [ebp + 0x58]
jmp 0x409d89
lea eax, [ebp + 0x58]
push eax
lea edi, [ebx + 1]
mov ebx, dword [ebp + 0x70]
lea eax, [ebp + 0x7c]
shl edi, 0xc
push eax
add edi, ebx
mov dword [ebp + 0x58], esi
call fcn.0040e702
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x409f70
push str.The_specified_key_is_not_valid__
mov eax, ebx
jmp 0x409cec
cmp dword [ebp + 0x58], esi
je 0x409f92
mov eax, dword [ebp + 0x58]
or eax, 0x2001f
push eax
lea eax, [ebp + 0x7c]
push eax
push 0x411f28
push dword [ebp + 0x7c]
call fcn.0040e8d8
add esp, 0x10
push edi
push dword [ebp + 0x7c]
call fcn.0040ea76
test eax, eax
pop ecx
pop ecx
jbe 0x409faf
push str.Cannot_delete_the_key__because_it_contains_one_or_more_subkeys.
mov eax, ebx
call fcn.004059bd
jmp 0x40a01b
push edi
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40a01b
mov eax, dword [ebx + 0x40108]
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
cmp dword [ebx + 0x4010c], esi
mov dword [ebx + 0x402c0], edi
je 0x40a01b
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp + 0x58], esi
je 0x409952
push dword [ebp + 0x7c]
jmp 0x409d89
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
inc ebx
shl ebx, 0xc
add ebx, edi
push eax
push ebx
lea edi, [ebp + 0x38]
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x40], esi
call fcn.0040ee32
jmp 0x409952
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 4]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
push eax
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
jmp 0x409952
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
push esi
jmp 0x40a064
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
push esi
push esi
jmp 0x40a06d
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
call fcn.004022ba
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.004022ba
push eax
call fcn.0040da51
add esp, 0xc
test eax, eax
jne 0x409952
mov ebx, dword [edi + 0x40108]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp + 0x70]
add esp, 0x14
cmp dword [eax + 0x4010c], esi
mov dword [eax + 0x402c0], edi
je 0x409952
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push ebx
jmp 0x409a31
inc ebx
lea eax, [ebp + 0x7c]
push eax
shl ebx, 0xc
add ebx, edi
push ebx
push dword [edi + 0x40108]
call fcn.0040dab3
add esp, 0xc
cmp eax, 0xf0000
jne 0x40a15a
push str.The_dialing_function_is_not_available_in_your_system__
mov eax, edi
jmp 0x409cec
cmp eax, esi
je 0x409952
mov ecx, edi
call fcn.00405a52
jmp 0x409952
push 0x420
lea eax, [ebp - 0x9e8]
push esi
push eax
call sub.msvcrt.dll_memset
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
mov ebx, 0x100
lea edi, [ebp - 0x9e8]
mov dword [ebp + 0x58], esi
mov dword [ebp - 0x9ec], 0x41c
call fcn.0040223f
mov eax, dword [ebp + 0x7c]
mov esi, dword [ebp + 0x70]
add eax, 2
shl eax, 0xc
add eax, esi
add esp, 0x10
mov dword [ebp + 0x68], eax
call fcn.004022ba
mov dword [ebp + 0x60], eax
lea edi, [esi + 0x40128]
mov eax, edi
call fcn.0040e6f3
mov edi, dword [edi + 0x14]
test edi, edi
je 0x40a1e8
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x9ec]
push eax
push dword [ebp + 0x60]
call edi
mov edi, eax
jmp 0x40a1eb
or edi, 0xffffffff
test edi, edi
jne 0x40a29d
mov eax, dword [ebp + 0x7c]
add eax, 3
shl eax, 0xc
add eax, esi
cmp byte [eax], 0
je 0x40a210
push eax
lea edi, [ebp - 0x7e5]
call fcn.0040223f
pop ecx
mov eax, dword [ebp + 0x7c]
add eax, 4
shl eax, 0xc
add eax, esi
cmp byte [eax], 0
je 0x40a22d
push eax
lea edi, [ebp - 0x6e4]
call fcn.0040223f
pop ecx
mov eax, dword [ebp + 0x7c]
add eax, 5
shl eax, 0xc
add eax, esi
cmp byte [eax], 0
je 0x40a24d
push eax
push 0xf
pop ebx
lea edi, [ebp - 0x5e3]
call fcn.0040223f
pop ecx
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x9ec], 0x41c
call fcn.004022ba
mov ebx, eax
lea edi, [esi + 0x40128]
mov eax, edi
call fcn.0040e6f3
mov edi, dword [edi + 0x18]
test edi, edi
je 0x40a28b
lea eax, [ebp + 0x58]
push eax
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x9ec]
push eax
push ebx
push 0
call edi
jmp 0x40a28e
or eax, 0xffffffff
test eax, eax
je 0x409952
mov ecx, esi
jmp 0x40a164
push str.Unable_to_receive_dialup_information_of_the_specified_entry__
mov eax, esi
call fcn.004059bd
mov dword [esi + 0x402c0], edi
jmp 0x409952
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
inc ebx
mov dword [ebp - 0x98], esi
mov esi, dword [ebp + 0x70]
shl ebx, 0xc
lea eax, [ebp - 0x98]
add ebx, esi
push eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], ebx
mov word [ebp - 0x88], 0x4454
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [esi + 0x402c0], eax
jmp 0x409952
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jge 0x40a31f
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.0040f215
jmp 0x409a0e
push esi
jmp 0x40a315
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
jge 0x40a386
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
push edi
call fcn.00405b7d
cmp eax, esi
mov dword [ebp + 0x7c], eax
je 0x40a37c
lea ebx, [edi + 0x40128]
mov eax, ebx
call fcn.0040e6f3
mov ebx, dword [ebx + 0x10]
cmp ebx, esi
je 0x40a35c
push dword [ebp + 0x7c]
call ebx
jmp 0x40a35f
or eax, 0xffffffff
cmp eax, esi
mov eax, edi
je 0x40a36f
push str.Failed_to_hung_up_this_RAS_item
jmp 0x409cec
push dword [ebp + 0x7c]
call fcn.00405a7d
jmp 0x409952
push str.Cannot_find_the_specified_connection_name__
jmp 0x40a153
push edi
call fcn.00405ad7
jmp 0x409952
push str.logoff
lea eax, [ebx + 1]
push edi
mov dword [ebp + 0x7c], 1
call fcn.00405a62
test eax, eax
je 0x40a3af
mov dword [ebp + 0x7c], esi
jmp 0x40a41a
push str.poweroff
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40a3ca
mov dword [ebp + 0x7c], 8
jmp 0x40a3fe
push str.reboot
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40a3e5
mov dword [ebp + 0x7c], 2
jmp 0x40a3fe
push str.shutdown
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40a3fe
mov dword [ebp + 0x7c], 1
call fcn.00402423
test eax, eax
je 0x40a41a
push str.SeShutdownPrivilege
call fcn.0040d948
cmp eax, esi
pop ecx
jne 0x40a162
push str.force
add ebx, 2
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40a434
or dword [ebp + 0x7c], 4
jmp 0x40a449
push str.forceifhung
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40a449
or dword [ebp + 0x7c], 0x10
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40a0c7
push str.SeShutdownPrivilege
call fcn.0040d948
cmp eax, esi
pop ecx
jne 0x40a162
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
je 0x40a0cf
push str.AbortSystemShutdownA
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push esi
call eax
push ebx
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp + 0x7c], esi
jmp 0x40a0c9
push str.SeShutdownPrivilege
call fcn.0040d948
cmp eax, esi
pop ecx
jne 0x40a162
and dword [ebp + 0x68], 0
and dword [ebp + 0x7c], 0
push str.force
mov esi, edi
call fcn.00405984
test eax, eax
jl 0x40a4d3
mov dword [ebp + 0x68], 1
push str.reboot
mov esi, edi
call fcn.00405984
test eax, eax
jl 0x40a4ea
mov dword [ebp + 0x7c], 1
push dword [ebp + 0x7c]
lea eax, [ebx + 2]
push dword [ebp + 0x68]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
pop ecx
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.004022ba
push eax
call fcn.0040d9db
add esp, 0x10
test eax, eax
jne 0x409952
mov esi, dword [edi + 0x40108]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.004020ef
lea eax, [ebp - 0x9c8]
push eax
push edi
lea eax, [ebp - 0x12d8]
push str.Error__d:__s
push eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp + 0x70]
add esp, 0x14
cmp dword [eax + 0x4010c], 0
mov dword [eax + 0x402c0], edi
je 0x409952
push 0x30
push str.Error
lea eax, [ebp - 0x12d8]
push eax
push esi
jmp 0x409a31
push dword [edi + 0x402b4]
push ebx
push edi
call fcn.00407c42
jmp 0x409952
push dword [edi + 0x402b4]
push ebx
push edi
call fcn.00407b10
jmp 0x409952
push ebx
push edi
call fcn.00407d50
jmp 0x409952
push 5
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
push 0x411f28
push esi
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.004022ba
push eax
push dword [edi + 0x40108]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x409952
push str.Failed_to_execute_this_file__
jmp 0x40a153
xor eax, eax
mov dword [ebp + 0x54], esi
lea edi, [ebp + 0x58]
stosd dword es:[edi], eax
mov dword [ebp + 0x64], esi
lea edi, [ebp + 0x68]
stosd dword es:[edi], eax
mov dword [ebp + 0x5c], esi
lea edi, [ebp + 0x60]
stosd dword es:[edi], eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push eax
call fcn.00402174
mov edi, eax
cmp edi, esi
pop ecx
je 0x409952
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x54]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push edi
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 0x7c], esi
je 0x409952
or dword [ebp - 0xad8], 0xffffffff
add ebx, 2
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
lea eax, [ebp - 0xad8]
push ebx
mov byte [ebp - 0xad4], 0
mov byte [ebp - 0x70c], 0
mov byte [ebp - 0x850], 0
call fcn.004030a1
jmp 0x40a69c
test byte [ebp - 0x990], 0x10
jne 0x40a69c
push 1
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00402883
add esp, 0x14
lea eax, [ebp - 0xad8]
call fcn.004030d0
test eax, eax
jne 0x40a676
lea esi, [ebp - 0xad8]
call fcn.00403168
jmp 0x409952
mov dword [edi + 0x40104], ebx
inc ebx
shl ebx, 0xc
add ebx, edi
push edi
push ebx
mov dword [edi + 0x402b8], esi
call fcn.004024c1
pop ecx
jmp 0x409a0e
xor esi, esi
mov dword [edi + 0x40104], ebx
inc esi
inc ebx
shl ebx, 0xc
add ebx, edi
push edi
push ebx
mov dword [edi + 0x402b8], esi
call fcn.004024c1
pop ecx
pop ecx
mov eax, esi
jmp 0x4098b1
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push 0xfffffffffffffff5
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push str.kernel32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push str.SetConsoleDisplayMode
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, esi
je 0x409952
lea ecx, [ebp + 0x7c]
push ecx
push edi
push ebx
call eax
jmp 0x409952
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
call sub.msvcrt.dll_puts
jmp 0x409a0e
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
mov esi, eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
shl eax, 4
or eax, esi
movzx eax, ax
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTextAttribute]
jmp 0x409952
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x409952
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x409952
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
mov dword [ebp + 0x7c], eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
mov ebx, eax
mov dword [ebp + 0x34], esi
xor eax, eax
lea edi, [ebp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [ebp + 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x7c]
add eax, ebx
push eax
mov eax, dword [ebp + 0x34]
add eax, ecx
jmp 0x40a7bb
call fcn.00404738
jmp 0x409952
lea eax, [ebx + 1]
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x68], eax
jge 0x409952
shl eax, 0xc
add eax, edi
mov dword [ebp + 0x7c], eax
push 0x3f
xor esi, esi
lea eax, [ebp - 0xb7]
push esi
push eax
mov byte [ebp - 0xb8], 0
call sub.msvcrt.dll_memset
push 7
pop ecx
push esi
xor eax, eax
mov word [ebp + 4], si
lea edi, [ebp + 6]
rep stosd dword es:[edi], eax
push esi
push 0x4134dc
push dword [ebp + 0x7c]
stosw word es:[edi], ax
lea eax, [ebp - 0xb8]
push 0x3f
push eax
lea ebx, [ebp + 0x58]
mov dword [ebp + 0x58], esi
call fcn.00402ad0
add esp, 0x24
jmp 0x40a8bc
lea eax, [ebp - 0xb8]
call fcn.004067a7
test ax, ax
mov word [ebp + esi*2 + 4], ax
je 0x40a897
inc esi
cmp esi, 0xf
jge 0x40a8c0
push 0
push 0
push 0x4134dc
push dword [ebp + 0x7c]
lea eax, [ebp - 0xb8]
push 0x3f
push eax
lea ebx, [ebp + 0x58]
call fcn.00402ad0
add esp, 0x18
test eax, eax
jne 0x40a881
xor ebx, ebx
test esi, esi
jle 0x40a8f3
push 6
pop ecx
xor eax, eax
lea edi, [ebp + 0x2c]
rep stosd dword es:[edi], eax
mov cx, word [ebp + ebx*2 + 4]
and dword [ebp + 0x30], 0
mov word [ebp + 0x2c], cx
push 0x1c
lea ecx, [ebp + 0x28]
inc eax
push ecx
push eax
mov dword [ebp + 0x28], eax
call dword [sym.imp.USER32.dll_SendInput]
inc ebx
cmp ebx, esi
jl 0x40a8c6
lea ebx, [esi - 1]
test ebx, ebx
jl 0x40a92a
xor esi, esi
inc esi
push 6
pop ecx
xor eax, eax
lea edi, [ebp + 0x2c]
rep stosd dword es:[edi], eax
mov ax, word [ebp + ebx*2 + 4]
mov word [ebp + 0x2c], ax
push 0x1c
lea eax, [ebp + 0x28]
push eax
push esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x30], 2
call dword [sym.imp.USER32.dll_SendInput]
dec ebx
jns 0x40a8fd
inc dword [ebp + 0x68]
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x68]
add dword [ebp + 0x7c], 0x1000
cmp ecx, dword [eax + 0x40100]
jl 0x40a836
jmp 0x409952
push 0x34
lea eax, [ebp - 0x10]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebx + 1]
shl eax, 0xc
add esp, 0xc
add eax, edi
mov dword [ebp - 0x14], 1
call fcn.004067a7
push 7
pop ecx
mov word [ebp - 0x10], ax
lea esi, [ebp - 0x14]
lea edi, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push str.press
push dword [ebp + 0x70]
add ebx, 2
xor edi, edi
mov eax, ebx
mov dword [ebp + 0x10], 2
xor esi, esi
inc edi
call fcn.00405a62
test eax, eax
je 0x40a9a5
push 2
pop edi
jmp 0x40a9ce
push str.down
push dword [ebp + 0x70]
mov eax, ebx
call fcn.00405a62
test eax, eax
jne 0x40a9ce
push 0x412de4
push dword [ebp + 0x70]
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40a9ce
xor esi, esi
inc esi
imul esi, esi, 0x1c
push 0x1c
lea eax, [ebp + esi - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_SendInput]
jmp 0x409952
xor eax, eax
xor esi, esi
mov dword [ebp + 0x5c], esi
lea edi, [ebp + 0x60]
stosd dword es:[edi], eax
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x34
lea eax, [ebp - 0x10]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x5c]
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x60]
push 7
mov dword [ebp - 0x14], esi
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x8000
lea esi, [ebp - 0x14]
lea edi, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov esi, str.right
push esi
push dword [ebp + 0x70]
lea edi, [ebx + 1]
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40aa4d
or dword [ebp - 4], 8
or dword [ebp + 0x18], 0x10
jmp 0x40aae4
push esi
mov esi, dword [ebp + 0x70]
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40aa67
or dword [ebp - 4], 0x20
or dword [ebp + 0x18], 0x40
jmp 0x40aae4
push str.left
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40aa82
or dword [ebp - 4], 2
or dword [ebp + 0x18], 4
jmp 0x40aae4
push str.wheel
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40aaac
or dword [ebp - 4], 0x800
lea eax, [ebx + 2]
shl eax, 0xc
add eax, esi
call fcn.0040299d
mov dword [ebp - 8], eax
jmp 0x40aae4
push str.move
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40aae4
lea eax, [ebx + 2]
shl eax, 0xc
add eax, esi
mov dword [ebp - 4], 1
call fcn.0040299d
mov dword [ebp - 0x10], eax
lea eax, [ebx + 3]
shl eax, 0xc
add eax, esi
call fcn.0040299d
mov dword [ebp - 0xc], eax
push str.dblclick
push dword [ebp + 0x70]
xor edi, edi
add ebx, 2
inc edi
mov eax, ebx
xor esi, esi
mov dword [ebp + 0x7c], edi
call fcn.00405a62
test eax, eax
je 0x40ab0a
push 2
pop edi
mov dword [ebp + 0x7c], edi
jmp 0x40ab3c
push 0x412de4
push dword [ebp + 0x70]
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ab22
xor esi, esi
inc esi
jmp 0x40ab3c
push str.click
push dword [ebp + 0x70]
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ab3c
mov dword [ebp + 0x7c], 2
test edi, edi
jle 0x409952
imul esi, esi, 0x1c
lea esi, [ebp + esi - 0x14]
push 0x1c
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_SendInput]
dec edi
jne 0x40ab4b
jmp 0x409952
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, ebx
shl eax, 0xc
lea eax, [eax + edi + 0x1000]
call fcn.00402651
add dword [ebp + 0x5c], eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
add dword [ebp + 0x60], eax
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
jmp 0x40a7bc
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push str..LCD
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, esi
mov dword [ebp + 0x68], eax
je 0x409952
lea eax, [ebx + 2]
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x58], 3
jge 0x40abdb
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
pop ecx
mov dword [ebp + 0x58], eax
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
call sub.msvcrt.dll_atoi
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
pop ecx
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x6c], 1
mov eax, dword [ebp + 0x6c]
test dword [ebp + 0x58], eax
je 0x40ac71
xor eax, eax
push esi
lea edi, [ebp + 0x7d]
stosw word es:[edi], ax
mov al, byte [ebp + 0x6c]
mov byte [ebp + 0x7c], al
lea eax, [ebp + 0x48]
push eax
push 3
lea eax, [ebp + 0x7c]
push eax
push esi
push esi
push 0x230498
push dword [ebp + 0x68]
mov dword [ebp + 0x48], esi
call ebx
test eax, eax
je 0x40ac71
movzx ecx, byte [ebp + 0x7d]
movzx eax, byte [ebp + 0x7e]
add ecx, dword [ebp + 0x4c]
add eax, dword [ebp + 0x4c]
cmp ecx, esi
jge 0x40ac3f
xor ecx, ecx
push 0x64
pop edx
cmp ecx, edx
jle 0x40ac48
mov ecx, edx
cmp eax, esi
jge 0x40ac4e
xor eax, eax
cmp eax, edx
jle 0x40ac54
mov eax, edx
push esi
mov byte [ebp + 0x7e], al
lea eax, [ebp + 0x48]
push eax
push esi
push esi
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x23049c
push dword [ebp + 0x68]
mov byte [ebp + 0x7d], cl
call ebx
inc dword [ebp + 0x6c]
cmp dword [ebp + 0x6c], 2
jbe 0x40abf8
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x409952
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push str..LCD
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, esi
mov dword [ebp + 0x68], eax
je 0x409952
xor eax, eax
lea edi, [ebp + 0x7d]
stosw word es:[edi], ax
mov edi, dword [ebp + 0x70]
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
mov byte [ebp + 0x7c], 3
mov dword [ebp + 0x4c], eax
call sub.msvcrt.dll_atoi
push dword [ebp + 0x4c]
mov byte [ebp + 0x7d], al
call sub.msvcrt.dll_atoi
add ebx, 2
cmp ebx, dword [edi + 0x40100]
pop ecx
pop ecx
mov byte [ebp + 0x7e], al
jge 0x40acf7
shl ebx, 0xc
add ebx, edi
push ebx
call sub.msvcrt.dll_atoi
pop ecx
mov byte [ebp + 0x7c], al
push esi
lea eax, [ebp + 0x60]
push eax
push esi
push esi
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x23049c
push dword [ebp + 0x68]
mov dword [ebp + 0x60], esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
jmp 0x40ac7e
push 0x20
pop eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x1c], eax
lea eax, [ebp]
push eax
mov dword [ebp], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 4], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x18], esi
call fcn.004037f3
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
lea ebx, [ebp]
call fcn.00403a9f
test eax, eax
je 0x40ad5b
mov ecx, ebx
push ecx
mov ebx, eax
call fcn.00403b61
lea esi, [ebp + 0x14]
call fcn.0040e64d
cmp dword [ebp], 0
je 0x409952
push dword [ebp]
jmp 0x409a09
push 0xff
lea eax, [ebp - 0x1b7]
push esi
push eax
mov byte [ebp - 0x1b8], 0
call sub.msvcrt.dll_memset
mov eax, ebx
shl eax, 0xc
add edi, eax
push 8
mov dword [ebp + 0x7c], edi
push str.monitor:
add edi, 0x1000
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0x18
test eax, eax
jne 0x40adc8
lea eax, [ebp - 0x1b8]
push eax
mov eax, dword [ebp + 0x7c]
add eax, 0x1008
push eax
call fcn.00406c1c
inc ebx
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x78], 0
lea edi, [ebp - 0x77]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7c
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push esi
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0x70]
lea eax, [ebx + 1]
shl eax, 0xc
add eax, esi
push eax
mov word [ebp - 0x54], 0x9c
call sub.msvcrt.dll_atoi
mov dword [ebp - 0xc], eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, esi
push eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 8], eax
lea eax, [ebx + 3]
shl eax, 0xc
add eax, esi
push eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x10], eax
lea eax, [ebx + 4]
add esp, 0x18
cmp eax, dword [esi + 0x40100]
mov dword [ebp - 0x50], 0x1c0000
jge 0x40ae62
shl eax, 0xc
add eax, esi
mov edi, eax
push edi
call sub.msvcrt.dll_strlen
push eax
push edi
call fcn.00402604
add esp, 0xc
test eax, eax
je 0x40ae62
push edi
call sub.msvcrt.dll_atoi
or dword [ebp - 0x50], 0x400000
pop ecx
mov dword [ebp], eax
cmp dword [ebp - 0xc], 0x280
jb 0x40af07
cmp dword [ebp - 8], 0x1e0
jb 0x40af07
cmp dword [ebp - 0x10], 4
jb 0x40af07
push str._updatereg
xor ebx, ebx
call fcn.00405984
test eax, eax
jl 0x40aea8
push str._allusers
inc ebx
call fcn.00405984
test eax, eax
jl 0x40aea8
push 9
pop ebx
cmp byte [ebp - 0x1b8], 0
je 0x40aeed
push str.user32.dll
mov edi, 0xffff
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x40aee9
push str.ChangeDisplaySettingsExA
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40aee9
push 0
push ebx
push 0
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x1b8]
push ecx
call eax
mov edi, eax
mov eax, edi
jmp 0x40aef8
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
test eax, eax
je 0x409952
push str.Failed_to_change_the_display_setting__
jmp 0x40af0c
push str.Invalid_display_values__
mov eax, esi
jmp 0x409cec
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
jne 0x40af46
add eax, 0x1001
call fcn.00402651
push eax
call fcn.0040e339
test eax, eax
pop ecx
jne 0x409952
push str.Failed_to_close_the_specified_process__
jmp 0x40a153
call fcn.0040dc5d
test eax, eax
je 0x40af6f
push edi
push 0x406231
mov dword [edi + 0x40114], esi
mov dword [edi + 0x40104], ebx
call fcn.0040e059
cmp dword [edi + 0x40114], esi
pop ecx
jmp 0x40af35
push str.Failed_to_load_the_process_library__
jmp 0x40a153
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
jne 0x40afac
add eax, 0x1001
call fcn.00402651
push eax
call fcn.0040e384
test eax, eax
pop ecx
jne 0x409952
push str.Failed_to_kill_the_specified_process__
jmp 0x40a153
call fcn.0040dc5d
test eax, eax
je 0x40af6f
push edi
push 0x4061f1
mov dword [edi + 0x40110], esi
mov dword [edi + 0x40104], ebx
call fcn.0040e059
cmp dword [edi + 0x40110], esi
pop ecx
jmp 0x40af9b
mov eax, ebx
mov ecx, edi
call fcn.004065a1
jmp 0x409952
call fcn.0040eeb8
test eax, eax
jne 0x40aff6
push str.Unable_to_load_the_services_library__
jmp 0x40a153
lea eax, [ebx + 1]
inc ebx
push 2
shl ebx, 0xc
add ebx, edi
push 0x4130b4
push ebx
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x7c], esi
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40b025
mov dword [ebp + 0x68], ebx
mov ebx, dword [ebp + 0x58]
inc ebx
jmp 0x40b028
mov ebx, dword [ebp + 0x58]
push str.stop
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b042
mov dword [ebp + 0x7c], 1
jmp 0x40b0a8
push str.pause
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b05c
mov dword [ebp + 0x7c], 2
jmp 0x40b0a8
push str.continue
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b076
mov dword [ebp + 0x7c], 3
jmp 0x40b0a8
push str.start
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b090
mov dword [ebp + 0x7c], 0x101
jmp 0x40b0a8
push str.restart
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b0a8
mov dword [ebp + 0x7c], 0x102
push str.auto
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b0be
push 2
pop eax
jmp 0x40b111
push str.manual
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b0d3
push 3
jmp 0x40b0bb
push str.disabled
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b0e8
push 4
jmp 0x40b0bb
push str.boot
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b0fd
xor eax, eax
jmp 0x40b111
push str.system
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b131
xor eax, eax
inc eax
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
push dword [ebp + 0x68]
call fcn.0040efc5
add esp, 0xc
cmp eax, esi
je 0x40b131
mov ecx, edi
call fcn.00405a52
cmp dword [ebp + 0x7c], esi
je 0x40b156
push dword [ebp + 0x7c]
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
push dword [ebp + 0x68]
call fcn.0040f03e
add esp, 0xc
cmp eax, esi
je 0x40b156
mov ecx, edi
call fcn.00405a52
mov eax, dword [0x4163b8]
cmp eax, esi
je 0x409952
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [0x4163b8], esi
jmp 0x409952
push str.handle
lea esi, [ebx + 2]
push edi
mov eax, esi
call fcn.00405a62
test eax, eax
je 0x40b1a6
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
call fcn.00402651
lea ecx, [ebx + 4]
push ecx
push eax
lea eax, [ebx + 1]
push eax
mov ecx, edi
call fcn.00406f10
push str.active
push edi
mov eax, esi
call fcn.00405a62
test eax, eax
je 0x40b1cd
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [ebx + 3]
push ecx
push eax
lea eax, [ebx + 1]
push eax
mov ecx, edi
call fcn.00406f10
push str.foreground
push edi
mov eax, esi
call fcn.00405a62
test eax, eax
je 0x40b1f4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [ebx + 3]
push ecx
push eax
lea eax, [ebx + 1]
push eax
mov ecx, edi
call fcn.00406f10
push str.desktop
push edi
mov eax, esi
call fcn.00405a62
test eax, eax
je 0x40b21e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebx + 3]
push ecx
push eax
inc ebx
push ebx
mov ecx, edi
call fcn.00406f10
jmp 0x409952
push edi
push 0x40770b
mov dword [edi + 0x40104], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x409952
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp eax, esi
je 0x409952
push str.LockWorkStation
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, esi
je 0x409952
call eax
jmp 0x409952
push str.clear
lea eax, [ebx + 1]
push edi
call fcn.00405a62
test eax, eax
je 0x40b28f
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
call dword [sym.imp.USER32.dll_EmptyClipboard]
jmp 0x40b4ab
push 0x4136ec
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b2c3
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.00402d57
jmp 0x409a0e
push str.file
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
jne 0x40b515
push str.readfile
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
jne 0x40b515
push str.writefile
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b324
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
push esi
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.00402cb5
jmp 0x40a6d4
push str.writeufile
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b359
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
push esi
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.00402bde
jmp 0x40a6d4
push str.addfile
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b37e
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
push 1
jmp 0x40b311
push str.addufile
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b3a3
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
push 1
jmp 0x40b346
push str.copyimage
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b429
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b41c
add ebx, 2
lea eax, [ebp + 0x7c]
push eax
shl ebx, 0xc
add ebx, edi
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp + 0x7c], esi
call fcn.00401c9f
test eax, eax
jne 0x40b414
push dword [ebp + 0x7c]
lea eax, [ebp - 0xc]
call fcn.00402057
push dword [ebp + 0x7c]
lea eax, [ebp - 0xc]
call fcn.00401d64
lea eax, [ebp - 0xc]
call fcn.00401c89
lea esi, [ebp - 0xc]
call fcn.00401b93
jmp 0x409952
push str.saveimage
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b4b6
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409952
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, esi
mov dword [ebp + 0x7c], eax
je 0x40b4ab
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b4a3
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
push dword [ebp + 0x7c]
lea eax, [ebp - 0xc]
push eax
call fcn.00401f8a
lea eax, [ebp - 0xc]
call fcn.00401c89
lea esi, [ebp - 0xc]
call fcn.00401b93
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x409952
push str.loadclp
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40b4df
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.004018a1
jmp 0x40b50a
push str.saveclp
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x409952
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
call fcn.00401697
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409952
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x40], 0x1388
call fcn.00402174
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0x7c], eax
je 0x409952
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edi, [ebx + 0xa]
lea esi, [ebp + 0x38]
call fcn.00403227
mov esi, dword [ebp + 0x38]
push 9
lea eax, [esi + ebx]
push 0
push eax
mov dword [ebp + 0x60], eax
call sub.msvcrt.dll_memset
push ebx
push esi
push dword [ebp + 0x7c]
call fcn.004027e6
add esp, 0x18
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40b6fe
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov cl, byte [esi]
cmp cl, 0xff
jne 0x40b5d9
cmp byte [esi + 1], 0xfe
jne 0x40b5d9
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40b6f8
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
add esi, 2
push ebx
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
jmp 0x40b6f2
mov al, byte [esi + 1]
test al, al
jne 0x40b607
cmp byte [esi + 2], al
je 0x40b607
add ebx, 2
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40b6f8
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
jmp 0x40b5bf
cmp cl, 0xef
jne 0x40b6bb
cmp al, 0xbb
jne 0x40b6bb
cmp byte [esi + 2], 0xbf
jne 0x40b6bb
mov eax, dword [ebp + 0x38]
xor esi, esi
push esi
push esi
add ebx, 0xfffffffe
push ebx
add eax, 3
push eax
push esi
mov dword [ebp + 0x60], ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push 0xfde9
mov dword [ebp + 0x68], eax
call ebx
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], esi
lea edi, [eax + eax + 0xa]
lea esi, [ebp + 0x50]
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x58], 0x1388
call fcn.00403227
mov esi, dword [ebp + 0x7c]
mov edi, dword [ebp + 0x50]
push esi
push edi
push dword [ebp + 0x60]
push dword [ebp + 0x68]
push 0
push 0xfde9
call ebx
add esi, esi
push esi
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40b6ae
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test edi, edi
je 0x40b6f8
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x40b6f8
lea eax, [ebx + 1]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40b6f8
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x60]
add esp, 0xc
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp + 0x38], 0
je 0x409952
push dword [ebp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x409a0e
lea eax, [ebx + 4]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebx + 5]
shl eax, 0xc
add eax, edi
call fcn.004022ba
push eax
push edi
call fcn.00405d93
test eax, eax
je 0x409952
push str.Failed_to_set_the_logon_details_for_this_dialup_item__
jmp 0x40a153
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
mov ebx, 0x104
lea edi, [ebp - 0x1c0]
call fcn.0040223f
mov ecx, dword [ebp + 0x70]
add esp, 0x10
mov eax, edi
push eax
call fcn.00407f20
jmp 0x409952
mov esi, str.mediaplay
lea edi, [ebp - 0x1b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xf6
lea eax, [ebp - 0x1ae]
push 0
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, 0x3ff
push esi
xor edi, edi
lea eax, [ebp - 0xed7]
push edi
push eax
mov byte [ebp - 0xed8], 0
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x12d7]
push edi
push eax
mov byte [ebp - 0x12d8], 0
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x9c7]
push edi
push eax
mov byte [ebp - 0x9c8], 0
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0x70]
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, esi
push eax
lea eax, [ebp - 0xed8]
push str.open___s__type_mpegvideo_alias__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x40
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x12d8]
push str.play__s
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x9c8]
push str.close__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x18
push edi
push edi
push edi
mov edi, dword [sym.imp.WINMM.dll_mciSendStringA]
lea eax, [ebp - 0xed8]
push eax
call edi
mov dword [esi + 0x402c0], eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x12d8]
push eax
call edi
inc ebx
shl ebx, 0xc
add ebx, esi
push ebx
mov dword [esi + 0x402c0], eax
call sub.msvcrt.dll_atoi
cmp dword [esi + 0x402c0], 0
pop ecx
jne 0x40b8ad
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x9c8]
push eax
call edi
jmp 0x409952
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
push 0x104
lea eax, [ebp - 0xbdf]
push esi
push eax
mov byte [ebp - 0xbe0], 0
call sub.msvcrt.dll_memset
lea eax, [ebx + 2]
shl eax, 0xc
add edi, eax
push 5
push edi
push str._fav_
call sub.msvcrt.dll__strnicmp
add esp, 0x24
test eax, eax
jne 0x40b938
push 6
pop esi
lea edi, [ebp - 0x1c0]
call fcn.0040f238
mov ecx, dword [ebp + 0x70]
mov eax, ebx
shl eax, 0xc
lea eax, [eax + ecx + 0x2005]
cmp byte [eax], 0x5c
jne 0x40b94d
push eax
call fcn.004027b7
jmp 0x40b94c
push edi
mov ebx, 0x104
lea edi, [ebp - 0x1c0]
call fcn.0040223f
mov ebx, dword [ebp + 0x7c]
pop ecx
lea eax, [ebx + 3]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push eax
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0xbe0]
push eax
call fcn.0040354a
lea eax, [ebp - 0x1c0]
push eax
call fcn.00402441
inc ebx
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
lea eax, [ebp - 0xbe0]
push ebx
push eax
call fcn.0040349b
add esp, 0x18
test eax, eax
je 0x409952
push str.Failed_to_create_the_internet_shortcut__
jmp 0x409ce9
call fcn.004023ff
cmp dword [eax + 0x10], 2
jne 0x40b9c1
mov ecx, dword [eax + 4]
cmp ecx, 5
jne 0x40b9ba
cmp dword [eax + 8], 1
jae 0x40b9bc
cmp ecx, ecx
jbe 0x40b9c1
or esi, 0xffffffff
jmp 0x40b9c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push 0x413834
inc ebx
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b9df
push 2
jmp 0x40ba07
push 0x413838
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40b9f4
push 0xffffffffffffffff
jmp 0x40ba07
push 0x412ce0
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ba1a
push 1
push 0xf170
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40ba68
push str.async_off
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ba2f
push 2
jmp 0x40ba57
push str.async_on
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ba44
push 0xffffffffffffffff
jmp 0x40ba57
push str.async_low
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40ba68
push 1
push 0xf170
push 0x112
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x409952
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
push 0xf140
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x409952
inc ebx
push 3
shl ebx, 0xc
push esi
add ebx, edi
push ebx
call sub.msvcrt.dll_atoi
pop ecx
push eax
push 0xf
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x409952
push 0x104
lea eax, [ebp - 0xbdf]
push esi
push eax
mov byte [ebp - 0xbe0], 0
call sub.msvcrt.dll_memset
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x1c0]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
mov dword [esp], str.winlogon.exe
call sub.msvcrt.dll_strlen
lea eax, [esi + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x40bb3b
lea eax, [ebp - 0x1c0]
push str.winlogon.exe
push eax
lea eax, [ebp - 0xbe0]
call fcn.0040249d
pop ecx
pop ecx
jmp 0x40bb42
mov byte [ebp - 0xbe0], 0
mov eax, dword [edi + ebx*4 + 0x40004]
add eax, dword [edi + 0x402b4]
push eax
push edi
lea eax, [ebp - 0xbe0]
call fcn.004063fb
jmp 0x409952
mov eax, dword [edi + ebx*4 + 0x40004]
add eax, dword [edi + 0x402b4]
push eax
call fcn.00406271
jmp 0x409952
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x1c0]
push eax
call fcn.004028de
push 0xfff
lea eax, [ebp - 0x22db]
push esi
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
mov eax, dword [edi + ebx*4 + 0x40004]
add eax, dword [edi + 0x402b4]
push eax
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x22dc]
push str.__s___s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x2c
lea eax, [ebp - 0x22dc]
jmp 0x40bb6e
push 0x38
lea eax, [ebp - 0x14]
push esi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
mov dword [ebp - 8], eax
lea eax, [ebx + 2]
add esp, 0xc
cmp eax, dword [edi + 0x40100]
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0xc], str.RunAs
jge 0x40bc2d
mov eax, dword [edi + ebx*4 + 0x40008]
add eax, dword [edi + 0x402b4]
mov dword [ebp - 4], eax
jmp 0x40bc30
mov dword [ebp - 4], esi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp + 4], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x409952
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x1c0]
push eax
call fcn.004028de
push 0x38
lea eax, [ebp - 0x14]
push esi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x1c0]
mov dword [ebp - 8], eax
mov eax, dword [edi + ebx*4 + 0x40004]
add esp, 0x1c
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0xc], str.RunAs
jmp 0x40bc22
push 0xff
lea eax, [ebp - 0xbd7]
push esi
push eax
mov byte [ebp - 0xbd8], 0
call sub.msvcrt.dll_memset
push 0xff
lea eax, [ebp - 0x1b7]
push esi
push eax
mov dword [ebp + 0x68], esi
mov byte [ebp - 0x1b8], 0
call sub.msvcrt.dll_memset
inc ebx
shl ebx, 0xc
lea esi, [ebx + edi]
push esi
mov ebx, 0xff
lea edi, [ebp - 0x1b8]
call fcn.0040223f
mov eax, edi
push 0x40
push eax
call sub.msvcrt.dll_strchr
mov ebx, eax
mov eax, edi
push 0x5c
push eax
call sub.msvcrt.dll_strchr
xor edi, edi
add esp, 0x2c
cmp ebx, edi
jne 0x40bd25
cmp eax, edi
je 0x40bd1c
mov byte [eax], 0
inc eax
mov dword [ebp + 0x58], eax
lea eax, [ebp - 0x1b8]
mov dword [ebp + 0x68], eax
jmp 0x40bd28
lea eax, [ebp - 0xbd8]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x58], esi
push 0x1000
lea eax, [ebp - 0x22db]
push edi
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0x70]
mov esi, dword [ebp + 0x7c]
mov eax, dword [ebx + esi*4 + 0x4000c]
add eax, dword [ebx + 0x402b4]
add esp, 0xc
push eax
push ebx
lea eax, [ebp - 0x22dc]
call fcn.0040531a
push 0x40
lea eax, [ebp - 0x1c]
push edi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp + 0x34], edi
xor eax, eax
lea edi, [ebp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
add esi, 2
lea eax, [ebp - 0x22dc]
push eax
shl esi, 0xc
add esi, ebx
push esi
push dword [ebp + 0x68]
mov dword [ebp - 0x20], 0x44
push dword [ebp + 0x58]
call fcn.00404512
add esp, 0x24
mov dword [ebx + 0x402c0], eax
jmp 0x409952
push str.force
lea eax, [ebx + 1]
push edi
call fcn.00405a62
push str.SeShutdownPrivilege
call fcn.0040d948
push 1
call fcn.0040da21
jmp 0x40a6d4
push str.force
lea eax, [ebx + 1]
push edi
call fcn.00405a62
push str.SeShutdownPrivilege
call fcn.0040d948
push esi
jmp 0x40bdcd
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetComputerNameA]
jmp 0x40a0c7
xor eax, eax
push 7
pop ecx
mov byte [ebp - 0x98], 0
lea edi, [ebp - 0x97]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.CDAudio]
mov dword [ebp + 0x24], eax
mov eax, dword [0x413928]
mov dword [ebp + 0x28], eax
push 6
xor eax, eax
pop ecx
lea edi, [ebp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
add ebx, 2
cmp ebx, dword [eax + 0x40100]
jge 0x40be6d
shl ebx, 0xc
mov al, byte [ebx + eax]
mov byte [ebp - 0x98], al
lea eax, [ebp + 0x24]
push 0x41392c
push eax
mov byte [ebp - 0x97], 0x3a
mov byte [ebp - 0x96], 0
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
mov edi, 0xfe
push edi
lea eax, [ebp - 0x1b7]
push esi
push eax
mov byte [ebp - 0x1b8], 0
call sub.msvcrt.dll_memset
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x1b8]
push str.Set__s_Door__s
push eax
call sub.msvcrt.dll_sprintf
mov ebx, dword [sym.imp.WINMM.dll_mciSendStringA]
add esp, 0x1c
cmp byte [ebp - 0x98], 0
je 0x40bef2
push edi
lea eax, [ebp - 0xbd7]
push esi
push eax
mov byte [ebp - 0xbd8], 0
call sub.msvcrt.dll_memset
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xbd8]
push str.open__s_type_cdaudio_alias__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x1c
push esi
push esi
push esi
lea eax, [ebp - 0xbd8]
push eax
call ebx
push esi
push esi
push esi
lea eax, [ebp - 0x1b8]
push eax
call ebx
cmp byte [ebp - 0x98], 0
je 0x409952
push edi
lea eax, [ebp - 0xbd7]
push esi
push eax
mov byte [ebp - 0xbd8], 0
call sub.msvcrt.dll_memset
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0xbd8]
push str.close__s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x18
push esi
push esi
push esi
lea eax, [ebp - 0xbd8]
push eax
call ebx
jmp 0x409952
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
call dword [sym.imp.KERNEL32.DLL_Beep]
jmp 0x409952
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
jmp 0x40ba6d
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
mov dword [ebp + 0x7c], esi
jne 0x40bfa2
add eax, 0x1001
call fcn.00402651
jmp 0x40bfd7
call fcn.0040dc5d
test eax, eax
je 0x40bfdc
push 0x10c
lea eax, [edi + 0x401a4]
push esi
push eax
call sub.msvcrt.dll_memset
push edi
push 0x4061b6
mov dword [edi + 0x40104], ebx
call fcn.0040e059
mov eax, dword [edi + 0x401a4]
add esp, 0x14
mov dword [ebp + 0x7c], eax
jmp 0x40bfe8
push str.Failed_to_load_the_process_library__
mov eax, edi
call fcn.004059bd
cmp dword [ebp + 0x7c], esi
je 0x409952
push dword [ebp + 0x7c]
push esi
push 0x800
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x40c01d
call fcn.0040d818
mov eax, dword [0x4166e0]
cmp eax, esi
je 0x40c017
push ebx
call eax
push ebx
jmp 0x40ac81
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [edi + 0x402c0], eax
jmp 0x409952
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
mov dword [ebp + 0x7c], esi
jne 0x40c04d
add eax, 0x1001
call fcn.00402651
jmp 0x40c082
call fcn.0040dc5d
test eax, eax
je 0x40c087
push 0x10c
lea eax, [edi + 0x401a4]
push esi
push eax
call sub.msvcrt.dll_memset
push edi
push 0x4061b6
mov dword [edi + 0x40104], ebx
call fcn.0040e059
mov eax, dword [edi + 0x401a4]
add esp, 0x14
mov dword [ebp + 0x7c], eax
jmp 0x40c093
push str.Failed_to_load_the_process_library__
mov eax, edi
call fcn.004059bd
cmp dword [ebp + 0x7c], esi
je 0x409952
push dword [ebp + 0x7c]
push esi
push 0x800
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x40c01d
call fcn.0040d818
mov eax, dword [0x4166e4]
jmp 0x40c010
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
mov dword [ebp + 0x7c], esi
jne 0x40c0e3
add eax, 0x1001
call fcn.00402651
jmp 0x40c118
call fcn.0040dc5d
test eax, eax
je 0x40c11d
push 0x10c
lea eax, [edi + 0x401a4]
push esi
push eax
call sub.msvcrt.dll_memset
push edi
push 0x4061b6
mov dword [edi + 0x40104], ebx
call fcn.0040e059
mov eax, dword [edi + 0x401a4]
add esp, 0x14
mov dword [ebp + 0x7c], eax
jmp 0x40c129
push str.Failed_to_load_the_process_library__
mov eax, edi
call fcn.004059bd
add ebx, 2
shl ebx, 0xc
add ebx, edi
push str.normal
push ebx
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40c147
push 0x20
pop ebx
jmp 0x40c152
mov esi, ebx
call fcn.00406140
mov ebx, eax
xor esi, esi
cmp dword [ebp + 0x7c], esi
je 0x409952
push dword [ebp + 0x7c]
push esi
push 0x200
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x409952
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push edi
jmp 0x40ac81
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
mov dword [ebp + 0x68], esi
jne 0x40c1a1
add eax, 0x1001
call fcn.00402651
jmp 0x40c1d6
call fcn.0040dc5d
test eax, eax
je 0x40c1db
push 0x10c
lea eax, [edi + 0x401a4]
push esi
push eax
call sub.msvcrt.dll_memset
push edi
push 0x4061b6
mov dword [edi + 0x40104], ebx
call fcn.0040e059
mov eax, dword [edi + 0x401a4]
add esp, 0x14
mov dword [ebp + 0x68], eax
jmp 0x40c1e7
push str.Failed_to_load_the_process_library__
mov eax, edi
call fcn.004059bd
add ebx, 2
cmp ebx, dword [edi + 0x40100]
mov dword [ebp + 0x58], esi
jge 0x40c223
mov eax, ebx
shl eax, 0xc
add eax, edi
mov dword [ebp + 0x7c], eax
jmp 0x40c204
mov eax, dword [ebp + 0x7c]
call fcn.00402651
add dword [ebp + 0x7c], 0x1000
xor edx, edx
inc edx
mov ecx, eax
shl edx, cl
or dword [ebp + 0x58], edx
inc ebx
cmp ebx, dword [edi + 0x40100]
jl 0x40c201
push dword [ebp + 0x68]
push esi
push 0x200
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x409952
push dword [ebp + 0x58]
push edi
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
jmp 0x40c17c
mov eax, ebx
shl eax, 0xc
add eax, edi
cmp byte [eax + 0x1000], 0x2f
mov dword [ebp + 0x7c], esi
jne 0x40c26a
add eax, 0x1001
call fcn.00402651
jmp 0x40c29f
call fcn.0040dc5d
test eax, eax
je 0x40c2a4
push 0x10c
lea eax, [edi + 0x401a4]
push esi
push eax
call sub.msvcrt.dll_memset
push edi
push 0x4061b6
mov dword [edi + 0x40104], ebx
call fcn.0040e059
mov eax, dword [edi + 0x401a4]
add esp, 0x14
mov dword [ebp + 0x7c], eax
jmp 0x40c2b0
push str.Failed_to_load_the_process_library__
mov eax, edi
call fcn.004059bd
cmp dword [ebp + 0x7c], esi
je 0x409952
push dword [ebp + 0x7c]
push esi
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, esi
mov dword [ebp + 0x7c], eax
je 0x40c2e1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [edi + ebx*4 + 0x40008]
add eax, dword [edi + 0x402b4]
xor ebx, ebx
push eax
mov ecx, edi
call fcn.00408833
jmp 0x409952
call fcn.00402434
test eax, eax
je 0x40c398
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
mov esi, eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.00402651
test eax, eax
mov dword [ebp + 0x7c], eax
fild dword [ebp + 0x7c]
jge 0x40c33e
fadd qword [0x414460]
fmul qword [0x414458]
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
fstp dword [ebp + 0x5c]
call fcn.00402651
test eax, eax
mov dword [ebp + 0x7c], eax
fild dword [ebp + 0x7c]
jge 0x40c364
fadd qword [0x414460]
fmul qword [0x414458]
lea eax, [ebp + 0x5c]
push eax
push 2
neg esi
fstp dword [ebp + 0x60]
sbb esi, esi
push 1
dec esi
push 1
push esi
call fcn.0041070e
call fcn.0040ff93
call fcn.0041070e
mov esi, eax
call fcn.004106fa
jmp 0x40b50a
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
call fcn.00402651
movzx esi, ax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
shl esi, 0x10
call fcn.00402651
movzx eax, ax
or eax, esi
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
jmp 0x409952
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
call fcn.0040299d
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.0040299d
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
call fcn.00404cb8
add esp, 0xc
jmp 0x409952
call fcn.00402434
test eax, eax
lea eax, [ebx + 2]
je 0x40c42c
push 1
push 1
lea ecx, [ebx + 1]
push edi
call fcn.0040858d
jmp 0x409952
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x7c], 4
jge 0x40c44c
mov esi, eax
shl esi, 0xc
add esi, edi
call fcn.00404bd1
mov dword [ebp + 0x7c], eax
xor esi, esi
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jge 0x40c463
shl eax, 0xc
add eax, edi
call fcn.00402651
jmp 0x40c468
call fcn.00404bb7
push eax
lea eax, [ebx + 1]
shl eax, 0xc
push esi
add eax, edi
call fcn.00402651
push eax
push 1
push 1
mov eax, dword [ebp + 0x7c]
call fcn.004049b9
add esp, 0x14
jmp 0x409952
call fcn.00402434
test eax, eax
lea eax, [ebx + 2]
je 0x40c49e
push 1
push 2
jmp 0x40c41e
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x7c], 4
jge 0x40c4be
mov esi, eax
shl esi, 0xc
add esi, edi
call fcn.00404bd1
mov dword [ebp + 0x7c], eax
xor esi, esi
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jge 0x40c4d5
shl eax, 0xc
add eax, edi
call fcn.00402651
jmp 0x40c4da
call fcn.00404bb7
push eax
lea eax, [ebx + 1]
shl eax, 0xc
push esi
add eax, edi
call fcn.0040299d
push eax
push 1
push 2
jmp 0x40c47c
call fcn.00402434
test eax, eax
lea eax, [ebx + 3]
je 0x40c503
push 2
jmp 0x40c41c
cmp eax, dword [edi + 0x40100]
push 4
pop esi
jge 0x40c51c
mov esi, eax
shl esi, 0xc
add esi, edi
call fcn.00404bd1
mov esi, eax
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jge 0x40c533
shl eax, 0xc
add eax, edi
call fcn.00402651
jmp 0x40c538
call fcn.00404bb7
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.0040299d
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
push 2
push 1
mov eax, esi
jmp 0x40c47f
call fcn.00402434
test eax, eax
lea eax, [ebx + 3]
je 0x40c573
push 2
jmp 0x40c49a
cmp eax, dword [edi + 0x40100]
push 4
pop esi
jge 0x40c58c
mov esi, eax
shl esi, 0xc
add esi, edi
call fcn.00404bd1
mov esi, eax
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jge 0x40c5a3
shl eax, 0xc
add eax, edi
call fcn.00402651
jmp 0x40c5a8
call fcn.00404bb7
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
call fcn.0040299d
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.0040299d
push eax
push 2
push 2
jmp 0x40c559
call fcn.00402434
test eax, eax
lea eax, [ebx + 2]
je 0x40c5e0
push 1
push 3
jmp 0x40c41e
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x7c], 4
jge 0x40c600
mov esi, eax
shl esi, 0xc
add esi, edi
call fcn.00404bd1
mov dword [ebp + 0x7c], eax
xor esi, esi
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jge 0x40c617
shl eax, 0xc
add eax, edi
call fcn.00402651
jmp 0x40c61c
call fcn.00404bb7
push eax
lea eax, [ebx + 1]
shl eax, 0xc
push esi
add eax, edi
call fcn.0040299d
push eax
push 1
push 3
jmp 0x40c47c
mov eax, ebx
shl eax, 0xc
add eax, edi
lea ecx, [eax + 0x1000]
cmp byte [ecx], 0x2f
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x68], esi
jne 0x40c65d
add eax, 0x1001
call fcn.00402651
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], esi
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atof
fstp dword [ebp + 0x60]
add ebx, 3
cmp ebx, dword [edi + 0x40100]
pop ecx
mov eax, 0x411f28
jge 0x40c686
shl ebx, 0xc
add ebx, edi
mov eax, ebx
fld dword [ebp + 0x60]
push ecx
fstp dword [esp]
push 1
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
call fcn.00408392
jmp 0x409952
mov eax, ebx
shl eax, 0xc
add eax, edi
lea ecx, [eax + 0x1000]
cmp byte [ecx], 0x2f
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x68], esi
jne 0x40c6c7
add eax, 0x1001
call fcn.00402651
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], esi
lea eax, [ebx + 2]
shl eax, 0xc
lea esi, [eax + edi]
push esi
call sub.msvcrt.dll_atof
fstp dword [ebp + 0x60]
add ebx, 3
cmp ebx, dword [edi + 0x40100]
pop ecx
mov eax, 0x411f28
jge 0x40c6ec
mov eax, esi
fld dword [ebp + 0x60]
push ecx
fstp dword [esp]
push 2
jmp 0x40c68f
mov eax, ebx
shl eax, 0xc
add eax, edi
lea ecx, [eax + 0x1000]
cmp byte [ecx], 0x2f
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x68], esi
jne 0x40c71f
add eax, 0x1001
call fcn.00402651
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], esi
lea eax, [ebx + 2]
shl eax, 0xc
lea esi, [eax + edi]
push esi
call sub.msvcrt.dll_atof
fstp dword [ebp + 0x60]
add ebx, 3
cmp ebx, dword [edi + 0x40100]
pop ecx
mov eax, 0x411f28
jge 0x40c744
mov eax, esi
fld dword [ebp + 0x60]
push ecx
fstp dword [esp]
push 3
jmp 0x40c68f
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0040f52d
mov edi, eax
call fcn.0040f9c1
mov edi, 0x1fe
push edi
lea eax, [ebp - 0xcd6]
push esi
push eax
mov word [ebp - 0xcd8], si
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x2b6]
push esi
push eax
mov word [ebp - 0x2b8], si
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
add esp, 0x18
push 0xff
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push 0xffffffffffffffff
push eax
push esi
push esi
call edi
push 0xff
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push 0xffffffffffffffff
push eax
push esi
push esi
call edi
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xcd8]
push eax
call fcn.0040f52d
mov edi, eax
call fcn.0040fce5
cmp eax, esi
mov dword [ebp + 0x7c], eax
je 0x40b50a
add ebx, 3
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
push ebx
call sub.msvcrt.dll_atoi
pop ecx
push eax
call fcn.0041070e
mov edi, eax
mov eax, dword [ebp + 0x7c]
call fcn.0041062f
jmp 0x40b50a
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0040f52d
mov edi, eax
call fcn.0040f9c1
mov edi, 0x1fe
push edi
lea eax, [ebp - 0xcd6]
push esi
push eax
mov word [ebp - 0xcd8], si
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x2b6]
push esi
push eax
mov word [ebp - 0x2b8], si
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
add esp, 0x18
push 0xff
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebx + 1]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push 0xffffffffffffffff
push eax
push esi
push esi
call edi
push 0xff
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebx + 2]
shl eax, 0xc
add eax, dword [ebp + 0x70]
push 0xffffffffffffffff
push eax
push esi
push esi
call edi
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xcd8]
push eax
call fcn.0040f52d
mov edi, eax
call fcn.0040fce5
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x40b50a
add ebx, 3
shl ebx, 0xc
add ebx, dword [ebp + 0x70]
push ebx
call sub.msvcrt.dll_atof
fstp dword [ebp + 0x7c]
pop ecx
lea eax, [ebp + 0x7c]
push eax
call fcn.0041070e
mov edi, eax
mov eax, dword [ebp + 0x60]
call fcn.004106a2
jmp 0x40b50a
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x1fe
lea eax, [ebp - 0x2b6]
push esi
push eax
mov word [ebp - 0x2b8], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0xff
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebx + 1]
push 0xffffffffffffffff
shl eax, 0xc
add eax, edi
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0xd20]
call fcn.0040f4b4
add ebx, 2
cmp ebx, dword [edi + 0x40100]
mov dword [ebp + 0x7c], esi
jge 0x40c95c
shl ebx, 0xc
add ebx, edi
push ebx
call sub.msvcrt.dll_atoi
pop ecx
mov dword [ebp + 0x7c], eax
lea edi, [ebp - 0xd20]
call fcn.0040fb1c
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
push eax
call fcn.0040fd54
cmp eax, esi
je 0x40c982
push dword [ebp + 0x7c]
push eax
call fcn.0040fb80
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edi, [ebp - 0xd20]
call fcn.0040f509
jmp 0x409952
call fcn.004084a9
jmp 0x409952
push str.unreg
lea eax, [ebx + 1]
push edi
mov dword [ebp + 0x68], 1
call fcn.00405a62
test eax, eax
je 0x40c9be
mov dword [ebp + 0x68], esi
or dword [ebp + 0x7c], 0xffffffff
or dword [ebp - 0xad8], 0xffffffff
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
mov byte [ebp - 0xad4], 0
mov byte [ebp - 0x70c], 0
mov byte [ebp - 0x850], 0
jge 0x40c9f8
shl eax, 0xc
add eax, edi
push eax
call fcn.0040218d
pop ecx
mov dword [ebp + 0x7c], eax
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
lea eax, [ebp - 0xad8]
call fcn.004030a1
jmp 0x40caa5
test byte [ebp - 0x990], 0x10
jne 0x40caa5
push 0x3ff
lea eax, [ebp - 0x4b7]
push esi
push eax
mov byte [ebp - 0x4b8], 0
call sub.msvcrt.dll_memset
push dword [ebp + 0x68]
lea eax, [ebp - 0x850]
push eax
call fcn.00405072
add esp, 0x14
cmp eax, esi
jne 0x40ca5b
lea eax, [ebp - 0x850]
push eax
push str._s:_Succeed_r_n
jmp 0x40ca7f
cmp eax, 0xffffffff
jne 0x40ca6e
lea eax, [ebp - 0x850]
push eax
push str._s:_Failed_to_load_the_library_r_n
jmp 0x40ca7f
cmp eax, 0xfffffffe
jne 0x40ca8e
lea eax, [ebp - 0x850]
push eax
push str._s:_Failed_to_load_the_registration_function_r_n
lea eax, [ebp - 0x4b8]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
cmp dword [ebp + 0x7c], 0xffffffff
je 0x40caa5
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp + 0x7c]
call fcn.004021a6
pop ecx
pop ecx
lea eax, [ebp - 0xad8]
call fcn.004030d0
test eax, eax
jne 0x40ca11
cmp dword [ebp + 0x7c], 0xffffffff
je 0x40a6ab
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40a6ab
add ebx, 2
shl ebx, 0xc
add ebx, edi
push ebx
lea eax, [ebp + 0x34]
push eax
call fcn.00401aef
test eax, eax
jne 0x40caf2
push str.Failed_the_install_the_specified_assembly
mov eax, edi
call fcn.004059bd
lea esi, [ebp + 0x34]
call fcn.00401a24
call fcn.00401a73
jmp 0x409952
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x409952
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b41c
or dword [ebp - 0xad8], 0xffffffff
mov byte [ebp - 0xad4], al
mov byte [ebp - 0x70c], al
mov byte [ebp - 0x850], al
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
push eax
lea eax, [ebp - 0xad8]
call fcn.004030a1
lea eax, [ebp - 0xad8]
call fcn.004030d0
test eax, eax
je 0x40cc33
add ebx, 2
mov dword [ebp + 0x7c], ebx
test byte [ebp - 0x990], 0x10
jne 0x40cc20
push 0x104
lea eax, [ebp - 0x1bf]
push esi
push eax
mov byte [ebp - 0x1c0], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x1c0]
push eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x1c0]
push 0x2e
push eax
call sub.msvcrt.dll_strrchr
add esp, 0x1c
cmp eax, esi
je 0x40cc20
mov byte [eax], 0
mov eax, dword [ebp + 0x7c]
shl eax, 0xc
lea ebx, [eax + edi]
cmp byte [ebx], 0x2e
je 0x40cbfe
push 0x412330
lea edi, [ebp - 0x1c0]
call fcn.004027b7
pop ecx
push ebx
lea edi, [ebp - 0x1c0]
call fcn.004027b7
pop ecx
mov eax, edi
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0xc]
call fcn.00401fca
mov edi, dword [ebp + 0x70]
lea eax, [ebp - 0xad8]
call fcn.004030d0
test eax, eax
jne 0x40cb8e
lea eax, [ebp - 0xc]
call fcn.00401c89
lea esi, [ebp - 0xad8]
call fcn.00403168
jmp 0x40b41c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b41c
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
inc ebx
shl ebx, 0xc
push eax
add ebx, edi
push ebx
lea eax, [ebp - 0xc]
call fcn.00401fca
jmp 0x40b414
mov esi, str.Shell_Icon_BPP
lea edi, [ebp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp + 0x7c]
push eax
push 0x2001f
movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409952
mov esi, 0xff
push esi
mov byte [ebp - 0x1b8], al
lea eax, [ebp - 0x1b7]
push edi
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0xbd7]
push edi
push eax
mov byte [ebp - 0xbd8], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x7c]
mov eax, esi
call fcn.0040e919
lea eax, [ebp - 0x1b8]
push eax
call sub.msvcrt.dll_atoi
add esp, 0x28
cmp eax, edi
jle 0x40a024
push 0xa
lea ecx, [ebp - 0xbd8]
push ecx
inc eax
push eax
call sub.msvcrt.dll__itoa
push 1
lea eax, [ebp - 0xbd8]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x7c]
call fcn.0040e93c
add esp, 0x1c
push edi
push 0x7d0
push edi
push edi
push edi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push 1
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x7c]
call fcn.0040e93c
add esp, 0x10
jmp 0x40a024
push esi
push 0x1388
push esi
push esi
push esi
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x409952
push esi
push 0x1388
push esi
push esi
push esi
push 0x15
jmp 0x40cd8b
inc ebx
shl ebx, 0xc
add edi, ebx
cmp byte [edi], 0
je 0x40cdff
push 0x1000
lea eax, [ebp - 0x22db]
push esi
push eax
mov byte [ebp - 0x22dc], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x22dc]
push edi
push eax
call sub.msvcrt.dll_strcpy
mov al, byte [ebp - 0x22dc]
sub al, 0x61
add esp, 0x14
cmp al, 0x19
ja 0x40cdef
add byte [ebp - 0x22dc], 0xe0
push esi
push 0x7d0
push esi
lea eax, [ebp - 0x22dc]
push eax
jmp 0x40ce07
push esi
push 0x7d0
push esi
push esi
push esi
push 0x1a
jmp 0x40cd8b
or dword [ebp + 0x7c], 0xffffffff
call fcn.004023ff
cmp dword [eax + 0x10], 1
jne 0x40ce25
mov dword [ebp + 0x7c], 1
mov eax, dword [ebp + 0x7c]
lea ecx, [ebx + 1]
cmp ecx, dword [edi + 0x40100]
jge 0x40ce47
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.00402651
cmp eax, esi
jne 0x40ce47
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x409952
lea eax, [ebx + 1]
shl eax, 0xc
add eax, edi
call fcn.0040299d
jmp 0x40c023
push 0
push ebx
mov esi, edi
call fcn.00406ee8
jmp 0x409952
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 0x7c]
push eax
push 0x412458
push 0x17
push esi
push 0x412448
mov dword [ebp + 0x7c], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp + 0x7c], esi
je 0x40b50a
push 0x3ffe
lea eax, [ebp - 0x62da]
push esi
push eax
mov word [ebp - 0x62dc], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1fff
lea eax, [ebp - 0x62dc]
push eax
lea eax, [ebx + 2]
push 0xffffffffffffffff
shl eax, 0xc
add eax, edi
push eax
push esi
push esi
mov dword [ebp + 0x6c], esi
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push str.file
lea eax, [ebx + 1]
push edi
mov dword [ebp + 0x58], esi
call fcn.00405a62
test eax, eax
je 0x40cefa
mov dword [ebp + 0x58], 4
jmp 0x40cf13
push 0x413c20
push edi
lea eax, [ebx + 1]
call fcn.00405a62
test eax, eax
je 0x40cf13
mov dword [ebp + 0x58], 8
lea eax, [ebx + 3]
cmp eax, dword [edi + 0x40100]
jge 0x40cf39
shl eax, 0xc
add eax, edi
cmp byte [eax], 0
je 0x40cf39
push eax
call sub.msvcrt.dll_atoi
pop ecx
mov ecx, dword [ebp + 0x7c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x70]
lea eax, [ebx + 4]
cmp eax, dword [edi + 0x40100]
jge 0x40cf5f
shl eax, 0xc
add eax, edi
cmp byte [eax], 0
je 0x40cf5f
push eax
call sub.msvcrt.dll_atoi
pop ecx
mov ecx, dword [ebp + 0x7c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x78]
lea eax, [ebx + 5]
cmp eax, dword [edi + 0x40100]
jge 0x40d039
shl eax, 0xc
add eax, edi
cmp byte [eax], 0
mov dword [ebp + 0x60], eax
je 0x40d039
push 0x208
lea eax, [ebp - 0x2c2]
push esi
push eax
mov word [ebp - 0x2c4], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2c4]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x60]
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp + 0x6c]
push eax
push 0x413d14
push 0x17
push esi
push 0x41199c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp + 0x6c], esi
je 0x40d039
add ebx, 6
cmp ebx, dword [edi + 0x40100]
push 0x11
mov dword [ebp + 0x68], esi
pop ecx
jge 0x40cff4
shl ebx, 0xc
add edi, ebx
cmp byte [edi], 0
je 0x40cff4
push edi
call fcn.00403c90
pop ecx
mov ecx, eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x68]
call fcn.00404181
mov eax, dword [ebp + 0x6c]
pop ecx
mov ecx, dword [eax]
push 0xefffffff
push 0xffffffffffffffff
push dword [ebp + 0x68]
lea edx, [ebp - 0x2c4]
push 0x411dfc
push 3
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x6c]
push eax
call dword [ecx + 0x34]
push dword [ebp + 0x68]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push esi
push dword [ebp + 0x58]
lea edx, [ebp - 0x62dc]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x6c]
cmp eax, esi
je 0x40d05a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40b50a
push 1
jmp 0x40ce67
push 6
mov dword [ebp - 0x98], esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp + 0x7c], esi
mov esi, dword [ebp + 0x70]
lea edi, [ebx + 3]
jmp 0x40d0ea
push str.yestoall
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40d0a4
or dword [ebp + 0x7c], 0x10
push str.noerrorui
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40d0bc
or dword [ebp + 0x7c], 0x400
push str.silent
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40d0d1
or dword [ebp + 0x7c], 4
push str.nosecattr
push esi
mov eax, edi
call fcn.00405a62
test eax, eax
je 0x40d0e9
or dword [ebp + 0x7c], 0x800
inc edi
cmp edi, dword [esi + 0x40100]
jl 0x40d08f
lea eax, [ebx + 1]
shl eax, 0xc
add eax, esi
mov dword [ebp - 0x90], eax
mov ax, word [ebp + 0x7c]
add ebx, 2
shl ebx, 0xc
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x98]
add ebx, esi
push eax
mov dword [ebp - 0x94], 2
mov dword [ebp - 0x8c], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x409952
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b41c
push esi
call dword [sym.imp.USER32.dll_GetDC]
push 8
push eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x68], esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push str.savescreenshotfull
mov dword [ebp + 0x58], eax
push edi
mov eax, ebx
call fcn.00405a62
test eax, eax
je 0x40d1cd
push 0x4c
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4d
mov dword [ebp + 0x70], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4e
mov dword [ebp + 0x68], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
mov dword [ebp + 0x4c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp + 0x58], eax
lea eax, [ebx + 5]
cmp eax, dword [edi + 0x40100]
mov dword [ebp + 0x60], eax
jge 0x40d222
lea eax, [ebx + 2]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
mov dword [ebp + 0x70], eax
lea eax, [ebx + 3]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
mov dword [ebp + 0x68], eax
lea eax, [ebx + 4]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x60]
shl eax, 0xc
add eax, edi
push eax
call sub.msvcrt.dll_atoi
add esp, 0x10
mov dword [ebp + 0x58], eax
push dword [ebp + 0x58]
push dword [ebp + 0x4c]
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp + 0x7c]
mov dword [ebp + 0x48], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 0x48]
mov dword [ebp + 0x6c], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [ebp + 0x68]
mov dword [ebp + 0x60], eax
push dword [ebp + 0x70]
push dword [ebp + 0x7c]
push dword [ebp + 0x58]
push dword [ebp + 0x4c]
push esi
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.GDI32.dll_BitBlt]
inc ebx
shl ebx, 0xc
add edi, ebx
push str.clipboard
push edi
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x40d2c0
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40b414
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 0x48]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp + 0x60]
push dword [ebp + 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0x6c]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x40d2eb
push edi
push dword [ebp + 0x48]
lea eax, [ebp - 0xc]
push eax
call fcn.00401f8a
push dword [ebp + 0x60]
push dword [ebp + 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0x6c]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x48]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp + 0x7c]
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x40b414
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
call fcn.00401c4f
test eax, eax
jne 0x40b41c
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x34], esi
xor eax, eax
lea edi, [ebp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [ebp + 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp + 0x3c]
sub edi, dword [ebp + 0x34]
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0x38]
inc edi
inc eax
push eax
push edi
push dword [ebp + 0x6c]
mov dword [ebp + 0x68], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp + 0x6c]
mov dword [ebp + 0x58], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 0x58]
mov dword [ebp + 0x7c], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [ebp + 0x38]
mov dword [ebp + 0x60], eax
push dword [ebp + 0x34]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push edi
push esi
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp + 0x70]
inc ebx
shl ebx, 0xc
lea edi, [ebx + eax]
push str.clipboard
push edi
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x40d3fe
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40b414
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 0x58]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp + 0x60]
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x40d429
push edi
push dword [ebp + 0x58]
lea eax, [ebp - 0xc]
push eax
call fcn.00401f8a
push dword [ebp + 0x60]
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0x7c]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x58]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp + 0x6c]
jmp 0x40d2ee
or dword [ebp - 0x5c8], 0xffffffff
lea eax, [ebp + 4]
mov byte [ebp - 0x5c4], 0
mov byte [ebp - 0x1fc], 0
mov byte [ebp - 0x340], 0
call fcn.00402e40
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
lea eax, [ebp - 0x5c8]
call fcn.004030a1
jmp 0x40d481
test byte [ebp - 0x480], 0x10
jne 0x40d481
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp + 4]
call fcn.00402e88
lea eax, [ebp - 0x5c8]
call fcn.004030d0
test eax, eax
jne 0x40d469
cmp dword [ebp + 0x20], esi
mov dword [ebp + 0x6c], esi
jle 0x40d62c
mov eax, dword [ebp + 0x6c]
lea ecx, [ebp + 4]
call fcn.00402f50
cmp eax, esi
mov dword [ebp + 0x7c], 0x411f28
je 0x40d4b5
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d4d0
and eax, 0xfffffff8
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x58], eax
je 0x40d61d
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x58]
mov dword [ebp + 0x60], esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 0xffff
mov ebx, eax
lea eax, [ebp - 0x1733f]
push esi
push eax
mov byte [ebp - 0x17340], 0
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x60]
xor edx, edx
shld edx, ecx, 0x10
shr ebx, 0x10
mov eax, ebx
xor ebx, ebx
shl ecx, 0x10
or eax, ecx
or ebx, edx
add esp, 0xc
add eax, 1
adc ebx, esi
cmp ebx, esi
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x48], esi
jb 0x40d5a4
ja 0x40d54e
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x40d61d
inc dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
cmp eax, dword [ebp + 0x20]
jl 0x40d49c
lea esi, [ebp + 4]
call fcn.00402e62
lea esi, [ebp - 0x5c8]
jmp 0x40a6b1
push edi
call fcn.0040516e
push 0x3ff
lea eax, [ebp - 0x4b7]
push esi
push eax
mov dword [ebp + 0x6c], esi
mov byte [ebp - 0x4b8], 0
call sub.msvcrt.dll_memset
add ebx, 3
shl ebx, 0xc
add ebx, edi
push ebx
mov ebx, 0x3ff
lea edi, [ebp - 0x4b8]
call fcn.0040223f
mov eax, edi
push 0x2c
push eax
call sub.msvcrt.dll_strrchr
xor ebx, ebx
add esp, 0x18
xor ecx, ecx
cmp eax, ebx
je 0x40d69b
mov byte [eax], bl
inc eax
push eax
call sub.msvcrt.dll_atoi
pop ecx
mov ecx, eax
push 1
lea eax, [ebp + 0x6c]
push eax
push ebx
push ecx
lea eax, [ebp - 0x4b8]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
mov edi, dword [ebp + 0x70]
mov eax, dword [edi + 0x402b0]
push dword [ebp + 0x6c]
lea esi, [ebp + 0x2c]
mov dword [ebp + 0x2c], 0x414304
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], 0x41e
mov dword [ebp + 0x40], ebx
call fcn.0040f31f
mov esi, dword [ebp + 0x7c]
lea eax, [esi + 4]
shl eax, 0xc
add eax, edi
call fcn.00402651
push eax
mov dword [ebp + 0x7c], eax
lea eax, [esi + 1]
shl eax, 0xc
add esi, 2
add eax, edi
shl esi, 0xc
push eax
add esi, edi
push esi
mov esi, dword [ebp + 0x6c]
lea eax, [ebp + 0x2c]
call fcn.0040f430
push ebx
push dword [ebp + 0x7c]
push ebx
push dword [edi + 0x402b0]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x40d742
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
call esi
test eax, eax
jne 0x40d728
push ebx
push dword [edi + 0x402b0]
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebp + 0x2c]
call fcn.0040f39b
cmp dword [ebp + 0x6c], ebx
je 0x40d775
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_DestroyIcon]
lea esi, [ebp + 0x2c]
mov dword [ebp + 0x2c], 0x414304
call fcn.0040f39b
jmp 0x409952
push 0x3ff
lea eax, [ebp - 0x4b7]
push esi
push eax
mov byte [ebp - 0x4b8], 0
call sub.msvcrt.dll_memset
lea eax, [ebx + 1]
add esp, 0xc
cmp eax, dword [edi + 0x40100]
lea eax, [ebp - 0x4b8]
jge 0x40d7cd
inc ebx
shl ebx, 0xc
add ebx, edi
push ebx
push str.http:__nircmd.nirsoft.net__s.html
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
jmp 0x40d7da
push str.http:__nircmd.nirsoft.net
push eax
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x4b8]
push eax
call sub.msvcrt.dll__strlwr
pop ecx
push 5
push esi
push esi
lea eax, [ebp - 0x4b8]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x409952