Function at 0x423ca0
Capabilities:
Modify service
Persist via run registry key
Start service
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0x2c0]
sub esp, 0x340
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x2bc], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0x1b9]
push ebx
push eax
mov byte [ebp + 0x1b8], bl
call fcn.004464f0
push esi
lea eax, [ebp + 0xb5]
push ebx
push eax
mov byte [ebp + 0xb4], bl
call fcn.004464f0
push esi
lea eax, [ebp - 0x4f]
push ebx
push eax
mov byte [ebp - 0x50], bl
call fcn.004464f0
mov esi, dword [ebp + 0x2c8]
add esp, 0x24
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x2cc]
push ebx
imul edi, edi, 0xf54
push ebx
push dword [ebp + 0x2cc]
lea esi, [esi*4 + 0x473bec]
push dword [ebp + 0x2c8]
mov eax, dword [esi]
mov dword [ebp - 0x64], ebx
push dword [edi + eax + 0x50]
call fcn.00439ea7
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x423d4d
cmp byte [eax], bl
jne 0x423d7e
mov eax, dword [esi]
add eax, edi
push str.AutoRun
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x423d7e
mov eax, dword [0x473bbc]
cmp eax, ebx
je 0x423d77
push str.No_program_name_or_command_line_provided
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x424b3e
mov eax, dword [esi]
add eax, edi
push str.Send
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423e09
mov eax, dword [esi]
add eax, edi
push str.Command
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423e09
mov eax, dword [esi]
push ebx
push ebx
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
cmp dword [0x472468], ebx
jne 0x423ddf
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x472468], eax
push ebx
push dword [0x4775e4]
call fcn.0040109c
pop ecx
movzx eax, ax
push eax
push 0x111
push dword [0x472468]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
jmp 0x424b3e
mov eax, dword [esi]
add eax, edi
push 0x45e980
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423f3f
cmp dword [ebp + 0x2d0], ebx
jne 0x423e55
mov eax, dword [ebp + 0x2c8]
shl eax, 0x14
add eax, dword [ebp + 0x2cc]
push eax
push 0x280d8
push 0x111
push dword [0x472420]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x424b3e
mov eax, dword [esi]
lea eax, [edi + eax + 0x364]
mov byte [ebp + 0x1b8], bl
cmp eax, ebx
je 0x423ea5
push ebx
push ebx
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
push eax
call fcn.00439ea7
push 0x103
lea eax, [ebp + 0x1b8]
push eax
mov eax, dword [ebp + 0x2c8]
imul eax, eax, 0x104
add eax, 0x472858
push eax
push dword [0x4775e4]
call fcn.0040f245
mov eax, dword [esi]
push ebx
push ebx
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
mov eax, dword [esi]
push 1
lea eax, [edi + eax + 0x58]
push str.cdecl
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
push eax
push dword [0x4775e4]
lea eax, [ebp + 0x1b8]
push eax
call fcn.004205d6
mov esi, eax
cmp esi, 0x69f6f36
je 0x423d77
push esi
lea eax, [ebp - 0x50]
push 0x45aac0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
call fcn.00423053
xor eax, eax
inc eax
cmp esi, eax
jl 0x424b3e
mov eax, esi
jmp 0x424b3e
mov eax, dword [esi]
add eax, edi
push str.AutoRun
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x424222
lea eax, [edi + eax + 0x58]
push 0x45e974
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423fa3
push 4
lea eax, [ebp + 0x1b8]
push eax
push dword [0x4775e4]
call fcn.0040dac4
push dword [0x4775e4]
lea eax, [ebp + 0x1b8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
call fcn.0041e956
add esp, 0x10
jmp 0x423e01
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.Remove
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4240e2
mov dword [ebp - 0x54], ebx
xor eax, eax
cmp dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x54], 2
jge 0x4240ab
push 2
lea eax, [ebp + 0x1b8]
push eax
push dword [ebp - 0x58]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x60]
call fcn.0043ee19
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x42409f
lea eax, [ebp + 0xb4]
push eax
lea eax, [ebp + 0x1b8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x60]
call fcn.0041e8e4
lea eax, [ebp + 0x1b8]
push eax
push dword [0x4775e4]
call fcn.004010ff
add esp, 0x18
test eax, eax
jne 0x424065
lea eax, [ebp + 0xb4]
push eax
push dword [0x4775e4]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x424065
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push 0x45e938
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42409f
lea eax, [ebp + 0x1b8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x60]
call fcn.0041e9fb
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push 0x45e938
push eax
call fcn.004010ff
add esp, 0x14
test eax, eax
jne 0x42409c
push 0x63
pop eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
jmp 0x42409f
dec dword [ebp - 0x58]
inc dword [ebp - 0x58]
cmp dword [ebp - 0x5c], ebx
jne 0x423fd4
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 2
jl 0x423fc1
cmp dword [ebp - 0x54], 0x63
jge 0x423e01
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push 0x45e938
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x423e01
jmp 0x423d77
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.List
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423d77
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x42410d
push eax
call fcn.00445e06
pop ecx
push 1
push 0x100000
call fcn.004462a8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
mov dword [0x4775e4], eax
mov dword [ebp - 0x54], ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
xor eax, eax
cmp dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x54], 2
jge 0x4241ec
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff00
jge 0x4241ec
push 2
lea eax, [ebp + 0x1b8]
push eax
push dword [ebp - 0x58]
push edi
push dword [ebp - 0x60]
call fcn.0043ee19
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x4241e0
lea eax, [ebp + 0xb4]
push eax
lea eax, [ebp + 0x1b8]
push eax
push edi
push dword [ebp - 0x60]
call fcn.0041e8e4
mov eax, dword [0x4775e4]
add esp, 0x10
cmp eax, ebx
je 0x4241e0
lea ecx, [ebp + 0x1b8]
push ecx
push eax
call esi
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x4241e0
push 0x45ad70
push eax
call esi
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x4241e0
lea ecx, [ebp + 0xb4]
push ecx
push eax
call esi
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x4241e0
push 0x45b4c0
push eax
call esi
inc dword [ebp - 0x58]
cmp dword [ebp - 0x5c], ebx
jne 0x424141
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 2
jl 0x42412e
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x4775e4]
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
call fcn.00423053
jmp 0x423e01
add eax, edi
push str.KILL
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424288
push 2
push ebx
push ebx
push ebx
push 2
push dword [0x4775e4]
call fcn.00442bcb
cmp eax, ebx
jne 0x423e01
push 1
push ebx
push ebx
push ebx
push 2
push dword [0x4775e4]
call fcn.00442bcb
cmp eax, ebx
jne 0x423e01
push dword [0x4775e4]
push str.Unable_to_find_process__s
push dword [0x473bbc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x423d77
mov eax, dword [esi]
add eax, edi
push str.Control_Panel
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x424573
push str.System
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4242fa
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_sysdm.cpl
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
push str.Advanced
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42455d
push 0x45e8c8
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x42455d
mov eax, dword [esi]
push str.Add_Remove_Programs
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42431a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_appwiz.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Internet
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42433a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_inetcpl.cpl_0
jmp 0x424550
mov eax, dword [esi]
push str.Device_Manager
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42435a
push str.rundll32.exe_DevMgr.dll_DeviceManager_ExecuteA
jmp 0x424550
mov eax, dword [esi]
push str.Display
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42437a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_desk.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Time_Date
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42439a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_timedate.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Regional
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4243ba
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_intl.cpl_0
jmp 0x424550
mov eax, dword [esi]
push str.Keyboard
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4243da
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__1
jmp 0x424550
mov eax, dword [esi]
push str.Game_Controllers
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4243fa
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_joy.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Mouse
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42441a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__0
jmp 0x424550
mov eax, dword [esi]
push str.Power
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42443a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_powercfg.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Sounds
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42445a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_mmsys.cpl_0
jmp 0x424550
mov eax, dword [esi]
push str.Network
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42447a
push str.control.exe_netconnections
jmp 0x424550
mov eax, dword [esi]
push str.Ease_of_Access
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42449a
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_access.cpl
jmp 0x424550
mov eax, dword [esi]
push str.Admin
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4244ba
push str.control.exe_admintools
jmp 0x424550
mov eax, dword [esi]
push str.Phone
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4244d7
push str.control.exe_telephony
jmp 0x424550
mov eax, dword [esi]
push str.Scheduled
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4244f4
push str.control.exe_schedtasks
jmp 0x424550
mov eax, dword [esi]
push str.User
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424511
push str.control.exe_userpasswords
jmp 0x424550
mov eax, dword [esi]
push str.Fonts
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42452e
push str.control.exe_fonts
jmp 0x424550
mov eax, dword [esi]
push str.Appearance
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42454b
push str.control.exe_color
jmp 0x424550
push str.control.exe
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push ebx
push 1
lea eax, [ebp + 0x1b8]
push eax
call fcn.00441ec7
jmp 0x424b3e
add eax, edi
push str.Service
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42473d
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x5c], eax
cmp eax, ebx
jne 0x4245c4
push ebx
push 0x7ff
push dword [0x473bbc]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
jmp 0x423d77
mov eax, dword [esi]
add eax, edi
push str.Startup
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4245dd
push 2
jmp 0x4245df
push 0x30
push dword [0x4775e4]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x58], eax
cmp eax, ebx
jne 0x424627
push ebx
push 0x7ff
push dword [0x473bbc]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x423d77
mov eax, dword [esi]
add eax, edi
push str.Startup
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x4246bc
lea eax, [edi + eax + 0x364]
push str.Automatic
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424663
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
jmp 0x4246af
mov eax, dword [esi]
lea eax, [edi + eax + 0x364]
push str.Manual
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42468a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 3
jmp 0x4246af
mov eax, dword [esi]
lea eax, [edi + eax + 0x364]
push str.Disabled
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424704
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
jmp 0x424700
add eax, edi
push 0x45a05c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4246dc
push ebx
push ebx
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x424700
mov eax, dword [esi]
add eax, edi
push str.Stop
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424704
lea eax, [ebp - 0x80]
push eax
push 1
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, ebx
jne 0x424738
push ebx
push 0x7ff
push dword [0x473bbc]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x424b3e
xor ebx, ebx
inc ebx
jmp 0x424728
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100000
mov ecx, 0x1000
cmp eax, ecx
mov dword [ebp - 0x5c], eax
jle 0x42475c
mov ecx, eax
push 1
push ecx
call fcn.004462a8
pop ecx
pop ecx
mov dword [ebp - 0x54], eax
cmp eax, ebx
je 0x423d77
mov eax, dword [ebp + 0x2c8]
mov ecx, dword [ebp - 0x5c]
imul eax, eax, 0x104
add ecx, 0xfffffc00
push ecx
push dword [ebp - 0x54]
lea eax, [eax + 0x472858]
push eax
push dword [0x4775e4]
mov dword [ebp - 0x60], eax
call fcn.0040f245
mov eax, dword [esi]
add eax, edi
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4247c7
push str..EXE
push dword [ebp - 0x54]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42480e
push str..VXM
push dword [ebp - 0x54]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4248e1
mov eax, dword [esi]
add eax, edi
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4248e1
push str..EXE
push dword [ebp - 0x54]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4248e1
push dword [ebp - 0x54]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x424842
mov eax, dword [0x473bbc]
cmp eax, ebx
je 0x424833
push str.A_script_cannot_call_itself__it_would_cause_an_endless_loop_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x54]
call fcn.00445e06
mov eax, ebx
jmp 0x424b3d
mov eax, dword [ebp - 0x54]
cmp byte [eax], 0x22
je 0x424856
push 0x45aca0
push ebx
push eax
call fcn.0043feaa
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x54]
cmp byte [eax + ecx - 1], 0x22
je 0x424875
push 0x45aca0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x103
lea eax, [ebp + 0x1b8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1b8]
push 0x45aca0
push eax
call fcn.00445d80
pop ecx
test eax, eax
pop ecx
lea eax, [ebp + 0x1b8]
jne 0x4248c5
push 0x45aca0
push ebx
push eax
call fcn.0043feaa
push str.___r
lea eax, [ebp + 0x1b8]
jmp 0x4248ca
push str.__r
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1b8]
push eax
push ebx
push dword [ebp - 0x54]
call fcn.0043feaa
mov eax, dword [esi]
cmp dword [edi + eax + 0xf28], 1
jg 0x424947
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x103
jle 0x424905
mov eax, 0x103
jmp 0x42490f
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x54]
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 4
push 0x45e2fc
lea eax, [ebp + 0x2b6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp + 0x1b8]
push eax
push str.____Translated_run_buffer:___s_
call fcn.0042036e
pop ecx
pop ecx
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.Single
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4249da
mov eax, dword [esi]
add eax, edi
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4249da
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4249da
push 2
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x64], ebx
call fcn.00442bcb
test eax, eax
jne 0x4249b5
push 1
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x54]
call fcn.00442bcb
cmp dword [ebp - 0x64], ebx
je 0x4249da
push dword [ebp - 0x54]
push str.____Found_existing_program_already_running___Activating___s_
call fcn.0042036e
pop ecx
pop ecx
push ebx
push dword [ebp - 0x64]
call fcn.00440998
xor ebx, ebx
inc ebx
jmp 0x424833
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x424a4c
mov eax, dword [esi]
add eax, edi
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x424a4c
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424a34
push str.vTask.exe
push dword [ebp - 0x54]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x424a34
xor al, al
jmp 0x424a36
mov al, 1
push 1
movzx eax, al
push ebx
push eax
push dword [ebp - 0x54]
call fcn.00441ec7
mov ebx, eax
jmp 0x424b28
mov eax, dword [esi]
push ebx
push ebx
push dword [ebp + 0x2cc]
lea eax, [edi + eax + 0x15c]
push dword [ebp + 0x2c8]
push eax
call fcn.00439ea7
push ebx
push ebx
push dword [0x4775e4]
call fcn.00418a96
fldz
fucomp st(1)
add esp, 0xc
fnstsw ax
test ah, 0x44
jp 0x424a8c
fstp st(0)
fld qword [0x45e3c0]
push 1
call fcn.00448380
imul eax, eax, 0x3e8
push eax
mov eax, dword [esi]
lea eax, [edi + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push dword [ebp - 0x54]
call fcn.00441ec7
cmp eax, 0xffffcfc4
jne 0x424ae2
mov eax, dword [esi]
lea eax, [edi + eax + 0x15c]
push eax
push str.Program_still_running_after_timeout_limit_of__s_seconds
push dword [0x473bbc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x424b28
cmp eax, 0xffffcfc3
je 0x424b28
push eax
lea eax, [ebp + 0x1b8]
push 0x45aac0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x1b8]
push eax
push dword [ebp + 0x2cc]
push dword [ebp + 0x2c8]
call fcn.00423053
xor ebx, ebx
inc ebx
push dword [ebp - 0x54]
call fcn.00445e06
mov eax, ebx
sub eax, 0xffffcfc3
neg eax
sbb eax, eax
and eax, ebx
pop ecx
mov ecx, dword [ebp + 0x2bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x2c0
leave
ret 0xc