Function at 0x40145c
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ecx, 0xb
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xe8a]
mov esi, 0x42caea
push ebx
xor ebx, ebx
sub esp, 0xebc
mov eax, dword [0x429840]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xe12]
mov esi, str.SdbReadBinaryTag
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
add eax, 0x11355040
mov dword [0x42958c], eax
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x4014c3
sub eax, 0x30
cmp al, 9
jbe 0x4014c0
mov eax, dword [0x42958c]
add eax, 0x5089f50e
mov dword [0x429608], eax
jmp 0x4014c3
inc edx
jmp 0x4014a2
mov eax, dword [0x429608]
and dword [0x429840], 0x819efcd9
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
push eax
mov eax, dword [0x429528]
mov dword [esp], str.The_process_was_not_woken__and_the_message_was_not_delivered.
mov dword [esp + 4], eax
call fcn.00412770
mov byte [ebp + ebx - 0xb18], bl
inc ebx
cmp ebx, 0x100
jne 0x40149d
xor edi, edi
xor ebx, ebx
movzx esi, byte [ebp + ebx - 0xb18]
mov eax, ebx
mov edx, 0x42ad2c
and eax, 0xf
mov ecx, esi
add cl, byte [ebp + eax - 0xe12]
mov eax, ecx
add eax, edi
movzx edi, al
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x401533
inc edx
jmp 0x401527
mov eax, dword [0x429528]
xor eax, 0xe28f932
mov dword [0x429608], eax
call fcn.0040f4d4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x429528]
xor eax, 0x7f1adbb8
mov dword [ebp - 0xeac], eax
mov dword [0x429528], eax
mov al, byte [ebp + edi - 0xb18]
mov byte [ebp + ebx - 0xb18], al
mov eax, dword [ebp - 0xeac]
inc ebx
add eax, 0xccc8418
mov dword [0x429608], eax
mov eax, esi
mov byte [ebp + edi - 0xb18], al
cmp ebx, 0x100
jne 0x401505
xor eax, eax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0xeb0], 0x7d2
inc ecx
mov edi, 0x42ad2c
movzx ecx, cl
mov dl, byte [ebp + ecx - 0xb18]
lea ebx, [edx + esi]
movzx esi, bl
mov bl, byte [ebp + esi - 0xb18]
mov byte [ebp + ecx - 0xb18], bl
movzx ebx, byte [edi]
inc edi
test bl, bl
je 0x4015e4
add dword [ebp - 0xeb0], ebx
cmp dword [ebp - 0xeb0], 0xbc1
jbe 0x4015ca
mov byte [ebp + esi - 0xb18], dl
add dl, byte [ebp + ecx - 0xb18]
movzx edx, dl
mov dl, byte [ebp + edx - 0xb18]
xor dl, byte [eax + ebp - 0xe8a]
movzx edx, dl
mov word [ebp + eax*2 - 0xdc8], dx
inc eax
cmp eax, 0xb
jne 0x40159c
mov edx, dword [ebp - 0xeac]
lea edi, [ebp - 0xe01]
mov esi, 0x42cb06
mov word [ebp - 0xdb2], 0
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea edi, [ebp - 0xe7f]
mov esi, 0x42cb17
rep movsb byte es:[edi], byte [esi]
sub edx, 0x366dffe
xor eax, eax
mov dword [0x42958c], edx
cmp byte [eax + 0x42ad2c], 0
je 0x401686
inc eax
cmp eax, 0x2615
jne 0x401652
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.SdbTagIDToTagRef
call fcn.00410758
imul eax, dword [0x429528], 0x2ecac2aa
mov dword [0x429608], eax
imul eax, dword [0x429840], 0x4ccbd4d8
mov dword [0x429528], eax
mov eax, dword [0x429608]
xor eax, 0x73e047d7
mov dword [0x42958c], eax
call fcn.0040f4d4
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x4016f0
inc eax
cmp eax, 0x47d
jne 0x4016ab
mov dword [esp + 0xc], 0x42ad2c
mov eax, dword [0x42958c]
mov dword [esp + 4], str.Import_Redirection_Dll_Full_Path
mov dword [esp + 8], eax
mov dword [esp], 0x42ad2c
call fcn.00414cd0
mov eax, dword [0x42958c]
add eax, 0x5f9a0b12
mov dword [0x429528], eax
mov eax, dword [0x429608]
sub dword [0x429528], 0x3708e1c
add eax, 0x22fa6bd9
mov dword [0x429840], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x429608]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
xor eax, eax
mov byte [eax + ebp - 0xa18], al
inc eax
cmp eax, 0x100
jne 0x401720
xor edi, edi
xor ebx, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, edx
movzx esi, byte [ebp + ebx - 0xa18]
div ecx
mov eax, esi
add al, byte [ebp + edx - 0xe7f]
add eax, edi
movzx edi, al
mov eax, dword [0x42958c]
xor eax, 0x8aad6b0c
mov dword [0x429608], eax
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x401799
inc eax
cmp eax, 0x1b6f
jne 0x401765
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.An_invalid_allocation_instance_is_being_referenced.
call fcn.0040fbac
mov eax, dword [0x429608]
or eax, 0xcdc0afea
mov dword [0x429528], eax
mov eax, dword [0x429528]
mov ecx, 0x42ad2c
add eax, 0x74af0bda
mov dword [0x429528], eax
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x4017ba
inc ecx
jmp 0x4017ad
imul eax, eax, 0x40a37996
mov dword [0x429840], eax
call fcn.00412174
mov al, byte [ebp + edi - 0xa18]
mov byte [ebp + ebx - 0xa18], al
mov eax, esi
inc ebx
mov byte [ebp + edi - 0xa18], al
cmp ebx, 0x100
jne 0x401733
cmp byte [0x42ad2c], 0
je 0x401806
call fcn.0040f4d4
or dword [0x429840], 0xf53773ae
mov eax, dword [0x429840]
xor esi, esi
and eax, 0x4154bf7e
sub eax, 0x6d96dbbc
mov dword [0x429528], eax
mov dword [esp], str.Write_Protect_Error
call fcn.00414b84
mov eax, dword [0x429608]
mov edx, eax
sub eax, 0x33be053e
xor edx, 0x280901e7
mov dword [0x429840], eax
mov dword [0x42958c], edx
mov dword [esp + 8], 0x42c1d4
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.AslPathCombine_failed___x_
call fcn.0040f8a8
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0xa18]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0xa18]
mov byte [ebp + edx - 0xa18], bl
mov byte [ebp + ecx - 0xa18], al
add al, byte [ebp + edx - 0xa18]
movzx eax, al
mov al, byte [ebp + eax - 0xa18]
xor al, byte [esi + ebp - 0xe01]
movzx eax, al
mov word [ebp + esi*2 - 0xce8], ax
inc esi
cmp esi, 0x11
jne 0x401865
lea edi, [ebp - 0xe74]
mov esi, 0x42cb22
mov ecx, 0xb
mov word [ebp - 0xcc6], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc0e]
mov esi, str.The_attempted_operation_required_self_healing_to_be_enabled.
mov ecx, 0x3d
rep movsb byte es:[edi], byte [esi]
mov edx, 0x42ad2c
add dword [0x429608], 0x2fbbd1a
mov al, byte [edx]
test al, al
je 0x401910
sub eax, 0x30
cmp al, 9
jbe 0x40190d
mov eax, dword [0x429528]
add eax, 0x5693e687
mov dword [0x429608], eax
jmp 0x401910
inc edx
jmp 0x4018ef
mov eax, dword [0x429608]
add dword [0x42958c], 0xe34c73b
mov dword [esp], str.Cancel_Timeout
mov dword [esp + 4], eax
call fcn.00412770
xor eax, eax
mov byte [ebp + eax - 0x918], al
inc eax
cmp eax, 0x100
jne 0x401931
mov eax, dword [0x42958c]
mov ebx, 0x42ad2c
imul ecx, eax, 0x8a1e4c49
mov dword [0x429608], ecx
mov dl, byte [ebx]
test dl, dl
je 0x401975
sub edx, 0x30
cmp dl, 9
jbe 0x401972
or ecx, 0x8d529108
mov dword [0x429608], ecx
jmp 0x401975
inc ebx
jmp 0x401956
or eax, 0x34213f27
xor esi, esi
mov edi, 0x3c
mov dword [0x429840], eax
call fcn.00412d2c
mov eax, dword [0x429608]
xor ecx, ecx
xor eax, 0x5d01c154
mov dword [ebp - 0xeac], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x918]
div edi
movzx eax, byte [ebp + edx - 0xc0e]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x918]
mov byte [ebp + ecx - 0x918], al
inc ecx
mov byte [ebp + esi - 0x918], bl
cmp ecx, 0x100
jne 0x40199d
mov edi, dword [ebp - 0xeac]
mov byte [ebp - 0x819], al
xor ecx, ecx
xor edx, edx
mov byte [ebp + esi - 0x918], bl
xor esi, esi
mov dword [0x429528], edi
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x918]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x918]
mov byte [ebp + edx - 0x918], bl
mov byte [ebp + ecx - 0x918], al
add al, byte [ebp + edx - 0x918]
movzx eax, al
mov al, byte [ebp + eax - 0x918]
xor al, byte [esi + ebp - 0xe74]
movzx eax, al
mov word [ebp + esi*2 - 0xdb2], ax
inc esi
cmp esi, 0xb
jne 0x4019f9
lea edi, [ebp - 0xe3b]
mov esi, 0x42cb6a
mov ecx, 3
cmp byte [0x42ad2c], 0
mov word [ebp - 0xd9c], 0
rep movsd dword es:[edi], dword [esi]
je 0x401a7f
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.A_data_overrun_error_occurred.
call fcn.0040fbac
imul eax, dword [0x429608], 0xf5992886
lea edi, [ebp - 0xd28]
mov esi, str.Device_Insufficient_Resources
mov dword [0x429528], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str._languagelevel_where_pop_languagelevel_1_ifelse
call fcn.0040fbac
mov ecx, 8
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [eax + 0x42ad2c], 0
je 0x401ae2
inc eax
cmp eax, 0x1087
jne 0x401ab6
mov dword [esp], str.Short_names_are_not_enabled_on_this_volume.
call fcn.00414b84
imul eax, dword [0x429840], 0xef195f0
mov dword [0x429840], eax
mov eax, dword [0x429528]
xor ebx, ebx
sub eax, 0x622f88c6
mov dword [0x429608], eax
mov eax, dword [0x429840]
add eax, 0x74c32340
mov dword [0x42958c], eax
call fcn.0040f4d4
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [0x429608]
and eax, 0x5276a23e
mov dword [0x429528], eax
add eax, 0x7d92a6fd
mov dword [0x429840], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.ZwQuerySystemInformation_failed___x_
call fcn.0040fbac
mov byte [ebp + ebx - 0x818], bl
inc ebx
cmp ebx, 0x100
jne 0x401b0d
xor edi, edi
xor ecx, ecx
mov esi, 0x1f
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x818]
div esi
movzx eax, byte [ebp + edx - 0xd28]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x818]
mov byte [ebp + ecx - 0x818], al
inc ecx
mov byte [ebp + edi - 0x818], bl
cmp ecx, 0x100
jne 0x401b53
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x818]
mov byte [ebp - 0xeac], al
add eax, esi
movzx esi, al
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x401bdd
inc eax
cmp eax, 0x2637
jne 0x401bae
mov eax, dword [0x429528]
mov dword [esp], eax
call fcn.004131b4
imul eax, dword [0x429608], 0xfab8d77a
mov dword [0x429840], eax
jmp 0x401be4
cmp eax, 0x1041
jle 0x401bf1
mov eax, dword [0x42958c]
mov dword [esp], eax
call fcn.004131b4
mov eax, dword [0x429528]
xor eax, 0x1e5296ce
and eax, 0xf15e7790
mov dword [0x429840], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], 0x42c386
call fcn.0040fbac
mov al, byte [ebp + esi - 0x818]
mov byte [ebp + ebx - 0x818], al
mov al, byte [ebp - 0xeac]
mov byte [ebp + esi - 0x818], al
add al, byte [ebp + ebx - 0x818]
movzx eax, al
mov al, byte [ebp + eax - 0x818]
xor al, byte [ebp + edi - 0xe3b]
movzx eax, al
mov word [ebp + edi*2 - 0xd5a], ax
inc edi
cmp edi, 0xc
jne 0x401b96
lea edi, [ebp - 0xe2f]
mov esi, 0x42cb96
mov ecx, 0xd
mov word [ebp - 0xd42], 0
rep movsb byte es:[edi], byte [esi]
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x401ca2
sub eax, 0x30
cmp al, 9
jbe 0x401c9f
mov eax, dword [0x42958c]
and eax, 0x7219142e
mov dword [0x429608], eax
jmp 0x401ca2
inc edx
jmp 0x401c81
imul eax, dword [0x429528], 0x67f3a3c1
lea edi, [ebp - 0xc78]
mov esi, str.The_specified_disk_has_an_invalid_sector_size.
mov dword [0x429840], eax
mov eax, dword [0x42958c]
mov dword [esp], str.The_specified_log_entry_is_not_valid.
mov dword [esp + 4], eax
call fcn.00412770
mov dword [esp], 0x42ad2c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x2f
mov edx, 0x42ad2c
push eax
rep movsb byte es:[edi], byte [esi]
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x401cf7
inc edx
jmp 0x401ceb
imul eax, dword [0x42958c], 0x71439531
mov edx, dword [0x429608]
and edx, 0x1955dafd
mov dword [0x429840], eax
xor eax, eax
mov byte [ebp + eax - 0x718], al
inc eax
cmp eax, 0x100
jne 0x401d14
mov dword [0x429528], edx
xor edi, edi
xor ecx, ecx
mov esi, 0x2e
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x718]
div esi
movzx eax, byte [ebp + edx - 0xc78]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x718]
mov byte [ebp + ecx - 0x718], al
inc ecx
mov byte [ebp + edi - 0x718], bl
cmp ecx, 0x100
jne 0x401d32
mov edx, 0x42ad2c
mov ecx, 0x875
movzx eax, byte [edx]
inc edx
test al, al
je 0x401db4
add ecx, eax
cmp ecx, 0xb39
jbe 0x401d79
call fcn.0041479c
mov eax, dword [0x429528]
xor eax, 0x31fec8d9
mov dword [0x429840], eax
mov eax, dword [0x429608]
mov dword [esp], str.STATUS_ABIOS_INVALID_LID
mov dword [esp + 4], eax
call fcn.00412770
mov eax, dword [0x42958c]
lea edx, [eax - 0x1eb95e9f]
imul eax, eax, 0x7ab146a3
mov dword [0x429608], edx
mov dword [0x429840], eax
call fcn.0041479c
mov edx, 0x42ad2c
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x401de6
inc edx
jmp 0x401dda
xor edx, edx
xor edi, edi
xor esi, esi
or dword [0x42958c], 0x5da1f10f
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x718]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x718]
mov byte [ebp + esi - 0x718], al
mov eax, dword [0x429528]
mov byte [ebp + edi - 0x718], bl
or eax, 0xe260b8d
mov dword [0x429840], eax
mov eax, dword [0x429608]
add eax, 0x25ba398b
mov dword [0x429528], eax
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x401e60
inc eax
cmp eax, 0xaee
jne 0x401e3e
mov dword [ebp - 0xeac], edx
call fcn.00412174
mov edx, dword [ebp - 0xeac]
mov eax, dword [0x429840]
mov dword [ebp - 0xeac], edx
mov ecx, eax
add eax, 0x267d41f3
xor ecx, 0xad75f102
mov dword [0x429608], eax
mov dword [0x42958c], ecx
mov dword [esp + 4], 0x42ad2c
mov dword [esp], 0x42c450
call fcn.0040fbac
mov eax, dword [0x429840]
add bl, byte [ebp + esi - 0x718]
movzx ebx, bl
mov edx, dword [ebp - 0xeac]
add eax, 0x5f48bc56
mov cl, byte [ebp + ebx - 0x718]
mov dword [0x429840], eax
imul eax, eax, 0xf726de6
mov dword [0x429608], eax
mov eax, ecx
xor al, byte [ebp + edx - 0xe2f]
movzx eax, al
mov word [ebp + edx*2 - 0xd42], ax
inc edx
cmp edx, 0xd
jne 0x401dec
lea edi, [ebp - 0xe69]
mov esi, 0x42cbd2
mov ecx, 0xb
cmp byte [0x42ad2c], 0
mov word [ebp - 0xd28], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xcc6]
mov esi, 0x42cbdd
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
je 0x401f3f
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.The_maximum_named_pipe_instance_count_has_been_reached.
call fcn.00410758
mov eax, dword [0x42958c]
add eax, 0x4beaa889
mov dword [0x429528], eax
mov eax, dword [0x429528]
xor edx, edx
sub eax, 0x4a7104d9
cmp byte [edx + 0x42ad2c], 0
je 0x401f6f
inc edx
cmp edx, 0xad1
jne 0x401f4b
mov edi, dword [0x429608]
lea edx, [edi - 0x61cf5e61]
mov dword [0x429528], edx
imul eax, eax, 0x98623ed1
mov dword [0x42958c], eax
mov eax, dword [0x429528]
add eax, 0x210c0a5d
mov dword [0x429608], eax
mov dword [esp], str.ZwCreateSection_failed___x_
call fcn.00414b84
mov eax, dword [0x429840]
mov ecx, 0x42ad2c
lea edx, [eax + 0x2d432158]
mov dword [0x429528], edx
mov dl, byte [ecx]
test dl, dl
je 0x401fc8
sub edx, 0x30
cmp dl, 9
jbe 0x401fc5
add dword [0x429608], 0x62f28957
jmp 0x401fc8
inc ecx
jmp 0x401fab
add eax, 0x2c455fd7
mov dword [0x42958c], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], 0x42c524
call fcn.0040fbac
xor eax, eax
mov byte [ebp + eax - 0x618], al
inc eax
cmp eax, 0x100
jne 0x401fe8
mov eax, dword [0x429840]
xor esi, esi
xor ecx, ecx
mov edi, 0x21
and eax, 0xb206a79
mov dword [ebp - 0xeac], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x618]
div edi
movzx eax, byte [ebp + edx - 0xcc6]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x618]
mov byte [ebp + ecx - 0x618], al
inc ecx
mov byte [ebp + esi - 0x618], bl
cmp ecx, 0x100
jne 0x402010
mov eax, dword [ebp - 0xeac]
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [0x429528], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x402085
sub eax, 0x30
cmp al, 9
jbe 0x402082
or dword [0x429608], 0xe623bbc0
jmp 0x402085
inc edx
jmp 0x402069
mov eax, dword [0x429840]
and eax, 0x1a8ff1fc
mov dword [0x429528], eax
call fcn.00412174
lea eax, [esi + 1]
cmp byte [0x42ad2c], 0
movzx esi, al
je 0x4020bc
call fcn.00412174
imul eax, dword [0x429608], 0xdbfcb588
mov dword [0x429608], eax
mov eax, dword [0x429528]
add eax, 0x4da53616
mov dword [0x429840], eax
imul eax, eax, 0xa778c8a8
mov dword [0x42958c], eax
call fcn.0040f4d4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dl, byte [ebp + esi - 0x618]
lea eax, [edx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x618]
mov byte [ebp + esi - 0x618], al
mov byte [ebp + edi - 0x618], dl
add dl, byte [ebp + esi - 0x618]
movzx edx, dl
mov al, byte [ebp + edx - 0x618]
xor al, byte [ebp + ebx - 0xe69]
movzx eax, al
mov word [ebp + ebx*2 - 0xd9c], ax
inc ebx
cmp ebx, 0xb
jne 0x40205e
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [0x429840]
lea edi, [ebp - 0xe5e]
mov ecx, ebx
mov word [ebp - 0xd86], 0
mov esi, 0x42cbff
rep movsb byte es:[edi], byte [esi]
mov edx, eax
lea edi, [ebp - 0xbd1]
mov esi, str.The_attempted_operation_required_self_healing_to_be_enabled.
mov ecx, 0x3d
or edx, 0xbce930f7
rep movsb byte es:[edi], byte [esi]
mov dword [0x42958c], edx
imul edx, dword [0x429608], 0x600181f9
mov dword [0x429608], edx
xor edx, edx
mov byte [ebp + edx - 0x518], dl
inc edx
cmp edx, 0x100
jne 0x402185
sub eax, 0x5e50bde3
xor edi, edi
xor ecx, ecx
mov esi, 0x3c
mov dword [0x429528], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x518]
div esi
movzx eax, byte [ebp + edx - 0xbd1]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x518]
mov byte [ebp + ecx - 0x518], al
inc ecx
mov byte [ebp + edi - 0x518], bl
cmp ecx, 0x100
jne 0x4021a8
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
cmp byte [0x42ad2c], 0
movzx esi, al
je 0x402209
imul eax, dword [0x42958c], 0x4fdbd1f
mov dword [0x429840], eax
mov dword [ebp - 0xeac], edx
mov dword [esp], str.The_requested_error_data_is_not_available_on_the_server.
call fcn.00414b84
mov eax, dword [0x42958c]
add eax, 0x2e9bbd64
mov ecx, eax
mov dword [0x429528], eax
and ecx, 0x31c3d9fe
mov dword [0x429840], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_OpenIcon]
push eax
mov bl, byte [ebp + esi - 0x518]
imul eax, dword [0x429608], 0xd121ed4f
mov dword [0x429528], eax
lea eax, [ebx + edi]
mov dword [esp], str.An_addressing_error_occurred_in_the_RPC_server.
movzx edi, al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x42ad2c
push eax
mov edx, dword [ebp - 0xeac]
mov al, byte [ecx]
test al, al
je 0x402298
sub eax, 0x30
cmp al, 9
jbe 0x402295
mov eax, dword [0x429528]
xor eax, 0x81e28696
mov dword [0x429608], eax
jmp 0x402298
inc ecx
jmp 0x402277
mov eax, dword [0x42958c]
or eax, 0x2db17a01
mov dword [0x429840], eax
mov al, byte [ebp + edi - 0x518]
mov byte [ebp + esi - 0x518], al
mov byte [ebp + edi - 0x518], bl
add bl, byte [ebp + esi - 0x518]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x518]
xor al, byte [ebp + edx - 0xe5e]
movzx eax, al
mov word [ebp + edx*2 - 0xd86], ax
inc edx
cmp edx, 0xb
jne 0x4021eb
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x40230f
sub eax, 0x30
cmp al, 9
jbe 0x40230c
mov eax, dword [0x429608]
xor eax, 0x5cd7a4a
mov dword [0x42958c], eax
jmp 0x40230f
inc edx
jmp 0x4022ee
mov eax, dword [0x429608]
sub eax, 0x78fea5b6
mov dword [0x429840], eax
mov dword [esp + 8], str.Built_in_EMF_Codec
mov dword [esp + 4], 0x42ad2c
mov dword [esp], 0x42c62c
call fcn.0040f8a8
mov edx, 0x42ad2c
mov ecx, 0x9e4
movzx eax, byte [edx]
inc edx
test al, al
je 0x402365
add ecx, eax
cmp ecx, 0xa74
jbe 0x402344
add dword [0x429840], 0x67c995ba
call fcn.0041479c
mov eax, dword [0x42958c]
lea edi, [ebp - 0xe9e]
mov esi, 0x42cc0a
or eax, 0x5cf28bfc
mov dword [0x429840], eax
mov eax, dword [0x429608]
add eax, 0x24ef20de
mov dword [0x42958c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov word [ebp - 0xd70], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0xa
mov edx, 0x42ad2c
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x7e2
movzx eax, byte [edx]
inc edx
test al, al
je 0x4023ef
add ecx, eax
cmp ecx, 0xf33
jbe 0x4023b4
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.Verifying_Disk
call fcn.00410758
mov eax, dword [0x42958c]
and eax, 0x40d29c0f
mov dword [0x429608], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x429608]
lea edi, [ebp - 0xb57]
mov edx, eax
sub eax, 0x19c653c3
mov dword [0x429608], eax
mov eax, dword [0x42958c]
and edx, 0x1ce801f4
mov dword [0x429528], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
imul eax, eax, 0x39a83942
push esi
mov esi, str.WER_Heap:_u:_ERROR_Exception_while_checking_for_Corrupted_heap
mov dword [0x429840], eax
mov dword [esp], eax
call fcn.004131b4
mov ecx, 0x3f
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x418], al
inc eax
cmp eax, 0x100
jne 0x402442
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
xor ebx, ebx
cmp byte [0x42ad2c], 0
je 0x402488
mov eax, dword [0x429840]
mov dword [esp], str.Not_enough_resources_are_available_to_complete_this_operation.
mov dword [esp + 4], eax
call fcn.00412770
imul eax, dword [0x429840], 0x744a3480
mov dword [0x429528], eax
mov eax, dword [0x429528]
mov edx, eax
imul eax, eax, 0x68fa789d
or edx, 0xd8d1fb0b
mov dword [0x429608], edx
mov dword [0x429840], eax
mov dword [esp + 4], eax
mov dword [esp], str.LanmanNt
call fcn.00412770
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x4024e2
sub eax, 0x30
cmp al, 9
jbe 0x4024df
imul eax, dword [0x429608], 0xb70b3635
mov dword [0x429528], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x4024e2
inc edx
jmp 0x4024bb
mov eax, dword [0x429608]
mov edi, 0x3e
add eax, 0x3f8165d2
mov dword [0x429840], eax
call fcn.00412174
mov eax, dword [0x429840]
xor edx, edx
mov cl, byte [ebp + ebx - 0x418]
sub eax, 0x5820593d
mov dword [0x429608], eax
mov eax, ebx
div edi
mov al, byte [ebp + edx - 0xb57]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ebx - 0x418], al
inc ebx
mov byte [ebp + esi - 0x418], cl
cmp ebx, 0x100
jne 0x40245b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, 0x42ad2c
mov al, byte [ecx]
test al, al
je 0x402573
sub eax, 0x30
cmp al, 9
jbe 0x402570
imul eax, dword [0x429608], 0x3434439b
mov dword [0x429840], eax
jmp 0x402573
inc ecx
jmp 0x402552
mov eax, dword [0x42958c]
inc ebx
movzx ebx, bl
and eax, 0x1a8fad40
mov dword [0x429608], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.Trace_database:_failed_to_release_segment__p
call fcn.00410758
mov eax, dword [0x429840]
mov ecx, 0x42ad2c
mov edx, eax
mov dword [ebp - 0xeb0], eax
mov al, byte [ebp + ebx - 0x418]
and edx, 0xad0212ff
mov dword [0x42958c], edx
mov byte [ebp - 0xeac], al
add eax, edi
movzx edi, al
mov al, byte [ecx]
test al, al
je 0x4025eb
sub eax, 0x30
cmp al, 9
jbe 0x4025e8
imul eax, dword [ebp - 0xeb0], 0x1b8b50c0
mov dword [0x429608], eax
jmp 0x4025eb
inc ecx
jmp 0x4025ca
lea eax, [edx + 0x4a099603]
mov dword [0x429840], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.Network_interface_does_not_support_this_media_type.
call fcn.0040fbac
mov al, byte [ebp + edi - 0x418]
mov byte [ebp + ebx - 0x418], al
mov al, byte [ebp - 0xeac]
mov byte [ebp + edi - 0x418], al
mov eax, dword [0x42958c]
or eax, 0x907670a4
mov dword [0x429608], eax
mov al, byte [ebp - 0xeac]
add al, byte [ebp + ebx - 0x418]
movzx eax, al
mov al, byte [ebp + eax - 0x418]
xor al, byte [ebp + esi - 0xe9e]
movzx eax, al
mov word [ebp + esi*2 - 0xdf0], ax
inc esi
cmp esi, 0xa
jne 0x40254d
mov eax, dword [0x429528]
mov ecx, 0x42ad2c
mov word [ebp - 0xddc], 0
mov edx, eax
or edx, 0x66635c25
mov dword [0x429608], edx
mov dl, byte [ecx]
test dl, dl
je 0x4026ad
sub edx, 0x30
cmp dl, 9
jbe 0x4026aa
mov edi, dword [0x429840]
lea edx, [edi - 0x7792a73b]
mov dword [0x429608], edx
jmp 0x4026ad
inc ecx
jmp 0x402688
add eax, 0x1bdba469
mov dword [0x429840], eax
call fcn.00412174
mov edx, 0x42ad2c
mov ecx, 0x1858
movzx eax, byte [edx]
inc edx
test al, al
je 0x4026fe
add ecx, eax
cmp ecx, 0x2123
jbe 0x4026c6
mov eax, dword [0x429528]
mov dword [esp], str.STATUS_WAIT_1
mov dword [esp + 4], eax
call fcn.00412770
imul eax, dword [0x429528], 0x8ee44002
mov dword [0x429608], eax
jmp 0x40270d
mov eax, dword [0x429528]
or eax, 0xc4f0d707
mov dword [0x42958c], eax
mov eax, dword [0x429608]
lea edi, [ebp - 0xe53]
mov esi, 0x42cc53
add eax, 0x6537cc10
mov dword [0x429840], eax
call fcn.0040f4d4
mov ecx, 0xb
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc49]
mov esi, str.Network_interface_is_not_ready_to_complete_this_operation.
mov ecx, 0x3b
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x402747
mov dword [esp], 0xc35
xor edi, edi
mov esi, 0x3a
call dword [sym.imp.USER32.dll_IsWindow]
xor ecx, ecx
sub eax, 0x664d6116
push ebx
or eax, 0x8936ffa0
mov dword [0x42958c], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x318]
div esi
movzx eax, byte [ebp + edx - 0xc49]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov byte [ebp + edi - 0x318], bl
cmp ecx, 0x100
jne 0x40277c
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
cmp byte [0x42ad2c], 0
movzx esi, al
mov bl, byte [ebp + esi - 0x318]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + esi - 0x318], al
mov byte [ebp + edi - 0x318], bl
je 0x4027fa
and dword [0x42958c], 0xd1e3153c
imul eax, dword [0x429528], 0x9341a5c6
mov dword [ebp - 0xeac], edx
mov dword [0x429608], eax
call fcn.0040f4d4
mov edx, dword [ebp - 0xeac]
add bl, byte [ebp + esi - 0x318]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
xor al, byte [ebp + edx - 0xe53]
movzx eax, al
mov word [ebp + edx*2 - 0xd70], ax
inc edx
cmp edx, 0xb
jne 0x4027bf
lea edi, [ebp - 0xd08]
mov esi, str.An_RPC_protocol_error_occurred.
mov ecx, 8
cmp byte [0x42ad2c], 0
mov word [ebp - 0xd5a], 0
mov dword [ebp - 0xea6], 0xd5844860
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xea2], 0x92f73aab
je 0x4028ae
mov dword [esp + 0xc], 0x42ad2c
mov eax, dword [0x42958c]
mov dword [esp + 4], str.SdbReadQWORDTag
mov dword [esp + 8], eax
mov dword [esp], 0x42ad2c
call fcn.00414cd0
sub dword [0x42958c], 0x51adea92
mov eax, dword [0x429840]
mov ecx, 0x42ad2c
mov ebx, 0xdd4
imul edx, dword [0x42958c], 0x20b6a7d7
mov dword [0x42958c], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4028df
add ebx, edx
cmp ebx, 0x1d2a
jbe 0x4028cd
xor eax, 0x9486850f
cmp byte [0x42ad2c], 0
mov dword [0x429608], eax
je 0x4028fc
sub eax, 0x2127a3bb
mov dword [0x429840], eax
mov eax, dword [0x429840]
add eax, 0x160ed57
mov dword [0x429528], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.The_specified_number_of_plexes_is_invalid.
call fcn.00410758
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x402955
sub eax, 0x30
cmp al, 9
jbe 0x402952
mov eax, dword [0x42958c]
sub eax, 0x43f1ff66
mov dword [0x429840], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x456f
mov dword [0x42958c], eax
jmp 0x402955
inc edx
jmp 0x402924
mov edx, dword [0x429608]
mov ecx, 0x42ad2c
lea eax, [edx + 0x46be0f2f]
mov dword [0x429528], eax
mov al, byte [ecx]
test al, al
je 0x402989
sub eax, 0x30
cmp al, 9
jbe 0x402986
add edx, 0x4d97ca74
mov dword [0x429608], edx
jmp 0x402989
inc ecx
jmp 0x40296b
sub dword [0x42958c], 0x2b32439
call fcn.00412174
mov edx, dword [0x429528]
mov eax, dword [0x42958c]
lea ebx, [edx + 0x23de3fd8]
lea ecx, [edx + 0x576a72a4]
xor edx, edx
mov byte [edx + ebp - 0x218], dl
inc edx
cmp edx, 0x100
je 0x4029c5
mov eax, ebx
jmp 0x4029b1
mov edx, eax
xor eax, 0xa258ce1c
mov dword [0x429608], ecx
xor esi, esi
xor edx, 0x1f1cca0e
mov dword [0x429528], eax
mov dword [0x429840], edx
mov dword [0x42958c], ebx
xor ebx, ebx
mov ecx, 0x1f
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x218]
div ecx
mov eax, edi
add al, byte [ebp + edx - 0xd08]
mov edx, 0x42ad2c
add eax, esi
movzx esi, al
imul eax, dword [0x429528], 0x9f1c326f
mov dword [0x429528], eax
mov al, byte [edx]
test al, al
je 0x402a43
sub eax, 0x30
cmp al, 9
jbe 0x402a40
mov eax, dword [0x42958c]
and eax, 0x87e6538d
mov dword [0x429608], eax
jmp 0x402a43
inc edx
jmp 0x402a22
mov eax, dword [0x42958c]
sub eax, 0x79355bad
mov dword [0x42958c], eax
mov dword [esp + 4], eax
mov dword [esp], str.261019185142Z0
call fcn.00412770
cmp byte [0x42ad2c], 0
je 0x402a7a
mov eax, dword [0x42958c]
or eax, 0x497a3ec6
mov dword [0x429528], eax
mov eax, dword [0x429840]
add dword [0x429528], 0x3e44b1b1
mov edx, eax
or edx, 0x58a652c
mov dword [0x429608], edx
mov dword [esp + 4], eax
mov dword [esp], str.A_fatal_error_has_occurred
call fcn.00412770
mov al, byte [ebp + esi - 0x218]
mov edx, 0x42ad2c
mov byte [ebp + ebx - 0x218], al
mov al, byte [edx]
test al, al
je 0x402adb
sub eax, 0x30
cmp al, 9
jbe 0x402ad8
imul eax, dword [0x429608], 0x11d89577
mov dword [0x429528], eax
jmp 0x402adb
inc edx
jmp 0x402aba
mov eax, dword [0x42958c]
inc ebx
mov edx, eax
add eax, 0x64d5f987
mov dword [0x42958c], eax
xor edx, 0x62f01907
mov eax, edi
mov dword [0x429608], edx
mov byte [ebp + esi - 0x218], al
cmp ebx, 0x100
jne 0x4029ed
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0xea6]
movzx eax, al
mov word [ebp + esi*2 - 0xe22], ax
inc esi
cmp esi, 8
jne 0x402b14
mov word [ebp - 0xe12], 0
lea edi, [ebp - 0xe94]
mov esi, 0x42ccb9
xor ebx, ebx
imul eax, dword [0x429528], 0xfbb9e58b
mov ecx, 0xa
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb94]
mov esi, str.The_attempted_operation_required_self_healing_to_be_enabled.
mov ecx, 0x3d
rep movsb byte es:[edi], byte [esi]
mov dword [0x42958c], eax
mov eax, dword [0x429840]
mov edx, eax
xor eax, 0xbd8b40d4
xor edx, 0x1333f080
mov dword [0x429608], eax
mov dword [0x429528], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, 0x42ad2c
mov ecx, 0x1f25
movzx eax, byte [edx]
inc edx
test al, al
je 0x402c13
add ecx, eax
cmp ecx, 0x268b
jbe 0x402bcd
mov eax, dword [0x429840]
mov dword [esp], str.SdbReleaseDatabase
mov dword [esp + 4], eax
call fcn.00412770
mov eax, dword [0x429840]
or eax, 0x4c45480d
mov dword [0x429840], eax
mov dword [esp + 4], eax
mov dword [esp], str.Media_Changed
call fcn.00412770
mov eax, dword [0x429528]
mov byte [ebp + ebx - 0x118], bl
inc ebx
add eax, 0x33e704af
mov dword [0x429840], eax
mov eax, dword [0x42958c]
sub eax, 0x7c423696
mov dword [0x429528], eax
cmp ebx, 0x100
jne 0x402bbd
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x402c6b
sub eax, 0x30
cmp al, 9
jbe 0x402c68
mov eax, dword [0x429608]
and eax, 0x20c9a55
mov dword [0x429528], eax
jmp 0x402c6b
inc edx
jmp 0x402c4a
mov eax, dword [0x429528]
xor esi, esi
xor ebx, ebx
mov edx, eax
imul eax, eax, 0x45ced057
or edx, 0xe59bad0e
mov dword [0x429840], edx
mov dword [0x42958c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x42ad2c], 0
je 0x402cb3
mov eax, dword [0x429608]
mov dword [esp], eax
call fcn.004131b4
sub dword [0x429840], 0x6ca6ffba
mov edi, 0x3c
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
imul eax, dword [0x429840], 0x247863ed
mov dword [0x429528], eax
sub eax, 0x6d61cbf
mov dword [0x429840], eax
mov eax, ebx
div edi
movzx eax, byte [ebp + edx - 0xb94]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x402c8d
xor edi, edi
xor edx, edx
xor esi, esi
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
add edx, ebx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
mov byte [ebp + esi - 0x118], al
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x402d5c
inc eax
cmp eax, 0x17b1
jne 0x402d3a
mov dword [ebp - 0xeac], edx
call fcn.0040f4d4
mov edx, dword [ebp - 0xeac]
mov eax, dword [0x429528]
mov dword [ebp - 0xeac], edx
sub eax, 0x460a8c4
mov dword [0x42958c], eax
mov dword [esp], str.This_operation_requires_a_DAX_volume.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov eax, dword [0x429840]
and eax, 0x4c2c21d
mov dword [0x429528], eax
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str._logscrdesc_GlobalColorTableFlag
call fcn.00410758
mov edx, dword [ebp - 0xeac]
mov byte [ebp + edx - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
xor al, byte [ebp + edi - 0xe94]
movzx eax, al
mov word [ebp + edi*2 - 0xddc], ax
inc edi
cmp edi, 0xa
jne 0x402d18
mov word [ebp - 0xdc8], 0
mov edx, 0x42ad2c
mov ecx, 0x916
movzx eax, byte [edx]
inc edx
test al, al
je 0x402e26
add ecx, eax
cmp ecx, 0x1ae2
jbe 0x402def
mov eax, dword [0x42958c]
or eax, 0xa33308aa
mov dword [0x429840], eax
mov dword [esp], str.A_account_group_cannot_have_a_universal_group_as_a_member.
call fcn.00414b84
and dword [0x429608], 0x3f877b72
mov eax, dword [0x42958c]
and eax, 0xae48b875
mov dword [0x429528], eax
sub eax, 0x5837aaaf
mov dword [0x429840], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, 0x42ad2c
mov al, byte [edx]
test al, al
je 0x402e6b
sub eax, 0x30
cmp al, 9
jbe 0x402e68
mov eax, dword [0x42958c]
sub eax, 0x2fa552b0
mov dword [0x429528], eax
jmp 0x402e6b
inc edx
jmp 0x402e4a
sub dword [0x429528], 0x2e5c87e6
mov ebx, 3
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x402e9c
inc eax
cmp eax, 0x2270
jne 0x402e7c
mov eax, dword [0x429528]
and eax, 0x5af9f80d
mov dword [0x429608], eax
mov eax, dword [0x429528]
lea edx, [eax + 0x13664cb]
add eax, 0x75321527
mov dword [0x429528], eax
mov dword [0x429840], edx
mov dword [esp + 0xc], 0x42ad2c
mov eax, dword [0x429608]
mov dword [esp + 4], str.Failed_to_get_the_string_from_the_database
mov dword [esp + 8], eax
mov dword [esp], 0x42ad2c
call fcn.00414cd0
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x402f0d
inc eax
cmp eax, 0x2693
jne 0x402ede
mov eax, dword [0x42958c]
mov dword [esp], eax
call fcn.004131b4
mov eax, dword [0x429608]
and eax, 0x2d0e47ab
mov dword [0x429840], eax
jmp 0x402f14
cmp eax, 0x85
jle 0x402f19
call fcn.00412174
mov eax, dword [0x42958c]
add eax, 0x4600fb44
mov dword [0x429528], eax
mov eax, dword [0x429608]
or eax, 0x3e8daf9c
mov dword [0x429840], eax
dec ebx
jne 0x402e7a
lea eax, [ebp - 0xdc8]
xor esi, esi
mov dword [ebp - 0xca4], eax
lea eax, [ebp - 0xce8]
mov dword [ebp - 0xca0], eax
lea eax, [ebp - 0xdb2]
mov dword [ebp - 0xc9c], eax
lea eax, [ebp - 0xd5a]
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0xd42]
mov dword [ebp - 0xc94], eax
lea eax, [ebp - 0xd9c]
mov dword [ebp - 0xc90], eax
lea eax, [ebp - 0xd86]
mov dword [ebp - 0xc8c], eax
lea eax, [ebp - 0xdf0]
mov dword [ebp - 0xc88], eax
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xc84], eax
lea eax, [ebp - 0xe22]
mov dword [ebp - 0xc80], eax
lea eax, [ebp - 0xddc]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp + esi*4 - 0xca4]
mov dword [esp], eax
call fcn.004010e8
mov ebx, eax
test eax, eax
je 0x40310b
mov dword [ebp - 0xe48], 0x54
xor esi, esi
mov ebx, 0xa
mov dword [ebp - 0xe44], 0xc
mov dword [ebp - 0xe40], 0xffffffa9
mov dword [esp], 0x15f1
call dword [sym.imp.USER32.dll_GetLastActivePopup]
imul eax, eax, 0x62a4c325
push edx
mov dword [0x42958c], eax
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x403051
inc eax
cmp eax, 0xc47
jne 0x40301d
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.EfsClientEncryptFileEx
call fcn.0040fbac
mov eax, dword [0x42958c]
or eax, 0x8e06a3c5
mov dword [0x429608], eax
mov eax, dword [0x429528]
sub ebx, dword [ebp + esi*4 - 0xe48]
inc esi
and dword [0x429840], 0x924c6b86
xor eax, 0xef933107
mov dword [0x42958c], eax
cmp esi, 3
jne 0x403002
xor eax, eax
cmp byte [eax + 0x42ad2c], 0
je 0x4030a0
inc eax
cmp eax, 0x1f3b
jne 0x403079
mov dword [esp + 4], 0x42ad2c
mov dword [esp], str.The_specified_named_pipe_is_in_the_connected_state.
call fcn.00410758
jmp 0x4030a7
cmp eax, 0x144c
jle 0x4030b6
mov eax, dword [0x429528]
add eax, 0x7a85e809
mov dword [0x42958c], eax
mov eax, dword [0x429528]
mov ecx, 0x42ad2c
add eax, 0x6c5c3b27
mov dword [0x429608], eax
mov dl, byte [ecx]
test dl, dl
je 0x4030e7
sub edx, 0x30
cmp dl, 9
jbe 0x4030e4
xor dword [0x42958c], 0xb04e2eed
jmp 0x4030e7
inc ecx
jmp 0x4030ca
mov edx, dword [0x42958c]
and edx, 0xc78c759b
mov dword [0x429840], edx
mov dword [esp + 4], eax
mov dword [esp], 0x42cad6
call fcn.00412770
jmp 0x403115
inc esi
cmp esi, 0xb
jne 0x402fc4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret