Function at 0x40fa50
Capabilities:
Create process on windows
Create thread
Get common file path
Get file size
Get system information on windows
Hide graphical window
Persist via windows service
Print debug messages
Read file on windows
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aa2
mov eax, dword fs:[0]
push eax
mov eax, 0x3ac4
call fcn.0042a310
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x189
jne 0x40fc8b
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040af20
mov dword [ebp - 0x358c], 0
xor eax, eax
mov dword [ebp - 0x3588], eax
mov dword [ebp - 0x3584], eax
mov dword [ebp - 0x3580], eax
lea ecx, [ebp - 0x358c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3da
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x384
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov eax, dword [0x466a84]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a80]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a68]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a44]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x4663e4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x11c
push 0x126
mov eax, dword [ebp - 0x3580]
sub eax, dword [ebp - 0x3588]
sub eax, 0x11c
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x3588]
push eax
mov eax, dword [ebp - 0x3584]
sub eax, dword [ebp - 0x358c]
sub eax, 0x126
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x358c]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0xf1
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x37fc], 0x6d0
push 1
mov ecx, dword [ebp - 0x37fc]
push ecx
call fcn.0042f5a5
add esp, 8
mov dword [ebp - 0x37ec], eax
mov edx, dword [ebp - 0x37fc]
push edx
mov eax, dword [0x466420]
push eax
mov ecx, dword [ebp - 0x37ec]
push ecx
call fcn.0042ca90
add esp, 0xc
mov edx, dword [ebp - 0x37ec]
push edx
mov eax, dword [ebp - 0x37fc]
push eax
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x3888], eax
push 0
mov ecx, dword [ebp - 0x3888]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x37ec], 0
je 0x40fc58
mov eax, dword [ebp - 0x37ec]
push eax
call fcn.0042f5b0
add esp, 4
mov dword [0x466a20], 0x2b7
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x18f
jne 0x40fcf5
cmp dword [0x466ab0], 0
je 0x40fcb6
mov eax, dword [ebp + 8]
push eax
call fcn.0041df80
add esp, 4
jmp 0x40fcf0
cmp dword [0x465f68], 0
je 0x40fce0
mov dword [0x465f70], 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x18d
jne 0x40fd19
mov edx, dword [ebp + 8]
push edx
call fcn.0041df80
add esp, 4
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x18e
jne 0x41032b
cmp dword [0x465f88], 0
jne 0x4102ff
cmp dword [0x466a20], 0x2b7
jne 0x40fee4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040af20
mov dword [ebp - 0x35ac], 0
xor eax, eax
mov dword [ebp - 0x35a8], eax
mov dword [ebp - 0x35a4], eax
mov dword [ebp - 0x35a0], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea edx, [ebp - 0x35ac]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x3890], eax
push 0x40005
mov ecx, dword [ebp - 0x3890]
push ecx
push 0x3db
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 5
mov edx, dword [0x4663f0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x4663e8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x4663c0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0xca
push 0xc6
mov eax, dword [ebp - 0x35a0]
sub eax, dword [ebp - 0x35a8]
sub eax, 0xca
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x35a8]
push eax
mov eax, dword [ebp - 0x35a4]
sub eax, dword [ebp - 0x35ac]
sub eax, 0xc6
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x35ac]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 0x3800], 0x1280
push 1
mov eax, dword [ebp - 0x3800]
push eax
call fcn.0042f5a5
add esp, 8
mov dword [ebp - 0x37e8], eax
mov ecx, dword [ebp - 0x3800]
push ecx
mov edx, dword [0x466414]
push edx
mov eax, dword [ebp - 0x37e8]
push eax
call fcn.0042ca90
add esp, 0xc
mov ecx, dword [ebp - 0x37e8]
push ecx
mov edx, dword [ebp - 0x3800]
push edx
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x3884], eax
push 0
mov eax, dword [ebp - 0x3884]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x37e8], 0
je 0x40febf
mov edx, dword [ebp - 0x37e8]
push edx
call fcn.0042f5b0
add esp, 4
mov dword [0x466a20], 0x2b8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4102de
cmp dword [0x466a20], 0x2b2
jne 0x410057
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040af20
mov dword [ebp - 0x359c], 0
xor eax, eax
mov dword [ebp - 0x3598], eax
mov dword [ebp - 0x3594], eax
mov dword [ebp - 0x3590], eax
lea ecx, [ebp - 0x359c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3da
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x384
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov eax, dword [0x466a84]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a80]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a68]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a44]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x4663e4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x11c
push 0x126
mov eax, dword [ebp - 0x3590]
sub eax, dword [ebp - 0x3598]
sub eax, 0x11c
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x3598]
push eax
mov eax, dword [ebp - 0x3594]
sub eax, dword [ebp - 0x359c]
sub eax, 0x126
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x359c]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0xf1
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x466a20], 0x2b7
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4102de
cmp dword [0x466a20], 0x2b6
jne 0x410094
push 0
mov eax, dword [0x466a90]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a94]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a9c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410254
cmp dword [0x466a20], 0x2b5
jne 0x4100d1
push 0
mov eax, dword [0x466a64]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a7c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a78]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410254
cmp dword [0x466a20], 0x2b4
jne 0x41011c
push 0
mov eax, dword [0x466a50]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a88]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a54]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a74]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410254
cmp dword [0x466a20], 0x2b3
jne 0x4101a3
push 5
mov ecx, dword [0x466a84]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a80]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a98]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f74], 0
je 0x41019e
push 0
push 0
push 0
push 0x414fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3880], eax
mov edx, dword [ebp - 0x3880]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x465f74], 0
jmp 0x410254
cmp dword [0x466a20], 0x2b1
jne 0x410254
push 5
mov eax, dword [0x466a84]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a80]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466abc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466ab8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a24]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a2c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a30]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a34]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a38]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x367c], 0x17
mov dword [ebp - 0x3678], 0x1b
mov dword [ebp - 0x3674], 0x117
mov dword [ebp - 0x3670], 0xc1
push 1
lea edx, [ebp - 0x367c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov ecx, dword [0x466a4c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a68]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a44]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a40]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x466a20], 0x2b7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4102fd
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410318
push 0x40
push 0x44d104
push 0x44d138
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x18b
jne 0x4105c6
cmp dword [0x465f88], 0
jne 0x41059b
cmp dword [0x466a20], 0x2b6
je 0x410579
cmp dword [0x466a20], 0x2b7
jne 0x41039d
push 0
mov eax, dword [0x466a44]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a40]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41041d
cmp dword [0x466a20], 0x2b5
jne 0x4103d7
push 0
mov eax, dword [0x466a64]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a7c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a78]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41041d
cmp dword [0x466a20], 0x2b4
jne 0x41041d
push 0
mov eax, dword [0x466a50]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a88]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a54]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a74]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x354c], 0xab
mov dword [ebp - 0x3548], 0x19
mov dword [ebp - 0x3544], 0x10c
mov dword [ebp - 0x3540], 0xbc
push 1
lea ecx, [ebp - 0x354c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x35fc], 0x21
mov dword [ebp - 0x35f8], 0x19
mov dword [ebp - 0x35f4], 0x81
mov dword [ebp - 0x35f0], 0xbc
mov eax, dword [ebp - 0x35fc]
mov dword [ebp - 0x354c], eax
mov ecx, dword [ebp - 0x35f8]
mov dword [ebp - 0x3548], ecx
mov edx, dword [ebp - 0x35f4]
mov dword [ebp - 0x3544], edx
mov eax, dword [ebp - 0x35f0]
mov dword [ebp - 0x3540], eax
push 1
lea ecx, [ebp - 0x354c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x35ec], 0x90
mov dword [ebp - 0x35e8], 0x34
mov dword [ebp - 0x35e4], 0xa0
mov dword [ebp - 0x35e0], 0x64
mov eax, dword [ebp - 0x35ec]
mov dword [ebp - 0x354c], eax
mov ecx, dword [ebp - 0x35e8]
mov dword [ebp - 0x3548], ecx
mov edx, dword [ebp - 0x35e4]
mov dword [ebp - 0x3544], edx
mov eax, dword [ebp - 0x35e0]
mov dword [ebp - 0x3540], eax
push 1
lea ecx, [ebp - 0x354c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov eax, dword [0x466a90]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a94]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a9c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x466a20], 0x2b6
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x410599
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4105b3
push 0x40
push 0x44d3e0
push 0x44d420
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x188
jne 0x410862
cmp dword [0x465f88], 0
jne 0x410836
cmp dword [0x466a20], 0x2b5
je 0x410815
cmp dword [0x466a20], 0x2b7
jne 0x410637
push 0
mov ecx, dword [0x466a44]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a40]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4106b8
cmp dword [0x466a20], 0x2b6
jne 0x410671
push 0
mov ecx, dword [0x466a90]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a94]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a9c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4106b8
cmp dword [0x466a20], 0x2b4
jne 0x4106b8
push 0
mov ecx, dword [0x466a50]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a88]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a54]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a74]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x357c], 0xab
mov dword [ebp - 0x3578], 0x19
mov dword [ebp - 0x3574], 0x10c
mov dword [ebp - 0x3570], 0xbc
push 1
lea edx, [ebp - 0x357c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x35cc], 0x21
mov dword [ebp - 0x35c8], 0x19
mov dword [ebp - 0x35c4], 0x81
mov dword [ebp - 0x35c0], 0xbc
mov ecx, dword [ebp - 0x35cc]
mov dword [ebp - 0x357c], ecx
mov edx, dword [ebp - 0x35c8]
mov dword [ebp - 0x3578], edx
mov eax, dword [ebp - 0x35c4]
mov dword [ebp - 0x3574], eax
mov ecx, dword [ebp - 0x35c0]
mov dword [ebp - 0x3570], ecx
push 1
lea edx, [ebp - 0x357c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x362c], 0x90
mov dword [ebp - 0x3628], 0x34
mov dword [ebp - 0x3624], 0xa0
mov dword [ebp - 0x3620], 0x64
mov ecx, dword [ebp - 0x362c]
mov dword [ebp - 0x357c], ecx
mov edx, dword [ebp - 0x3628]
mov dword [ebp - 0x3578], edx
mov eax, dword [ebp - 0x3624]
mov dword [ebp - 0x3574], eax
mov ecx, dword [ebp - 0x3620]
mov dword [ebp - 0x3570], ecx
push 1
lea edx, [ebp - 0x357c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov ecx, dword [0x466a64]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a7c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a78]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
mov ecx, dword [0x466a4c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x466a20], 0x2b5
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x410834
push 0
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41084f
push 0x40
push 0x44d708
push 0x44d748
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x187
jne 0x410b99
cmp dword [0x466a20], 0x2b4
je 0x410b86
cmp dword [0x4663ac], 0
je 0x41096e
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x410952
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f84], 1
mov dword [0x465f80], 1
lea eax, [ebp - 0x36ec]
push eax
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x466a1c], 0x2ad
push 0x14
mov edx, dword [0x46640c]
push edx
mov eax, dword [0x466408]
push eax
mov ecx, dword [ebp - 0x36e8]
add ecx, 0x32
push ecx
mov edx, dword [ebp - 0x36ec]
add edx, 0x24
push edx
push 0
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x466404]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x410969
mov dword [0x466a1c], 0x2ad
mov ecx, dword [0x466404]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x410b86
cmp dword [0x466a20], 0x2b7
jne 0x4109a8
push 0
mov edx, dword [0x466a44]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a4c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410a1a
cmp dword [0x466a20], 0x2b6
jne 0x4109e2
push 0
mov edx, dword [0x466a90]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a94]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a9c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410a1a
cmp dword [0x466a20], 0x2b5
jne 0x410a1a
push 0
mov edx, dword [0x466a64]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a7c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a78]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x356c], 0xab
mov dword [ebp - 0x3568], 0x19
mov dword [ebp - 0x3564], 0x10c
mov dword [ebp - 0x3560], 0xbc
push 1
lea edx, [ebp - 0x356c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x360c], 0x21
mov dword [ebp - 0x3608], 0x19
mov dword [ebp - 0x3604], 0x81
mov dword [ebp - 0x3600], 0xbc
mov ecx, dword [ebp - 0x360c]
mov dword [ebp - 0x356c], ecx
mov edx, dword [ebp - 0x3608]
mov dword [ebp - 0x3568], edx
mov eax, dword [ebp - 0x3604]
mov dword [ebp - 0x3564], eax
mov ecx, dword [ebp - 0x3600]
mov dword [ebp - 0x3560], ecx
push 1
lea edx, [ebp - 0x356c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x361c], 0x90
mov dword [ebp - 0x3618], 0x34
mov dword [ebp - 0x3614], 0xa0
mov dword [ebp - 0x3610], 0x64
mov ecx, dword [ebp - 0x361c]
mov dword [ebp - 0x356c], ecx
mov edx, dword [ebp - 0x3618]
mov dword [ebp - 0x3568], edx
mov eax, dword [ebp - 0x3614]
mov dword [ebp - 0x3564], eax
mov ecx, dword [ebp - 0x3610]
mov dword [ebp - 0x3560], ecx
push 1
lea edx, [ebp - 0x356c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov ecx, dword [0x466a50]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a88]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a54]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a74]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x466a20], 0x2b4
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x172
jne 0x410bde
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x410bcc
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x170
jne 0x410c65
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x410c11
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
mov eax, dword [0x466a70]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
mov ecx, dword [0x466a8c]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
mov edx, dword [0x466a6c]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
mov eax, dword [0x466a60]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x183
jne 0x410cbc
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0
push 0
push 0x40ee90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3848], eax
cmp dword [ebp - 0x3848], 0
je 0x410cb7
mov eax, dword [ebp - 0x3848]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x182
jne 0x410ddd
call fcn.0040af20
mov dword [ebp - 0x368c], 0x17
mov dword [ebp - 0x3688], 0x1b
mov dword [ebp - 0x3684], 0x117
mov dword [ebp - 0x3680], 0xc1
push 1
lea eax, [ebp - 0x368c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov edx, dword [0x466abc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x4663e4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466ab8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a28]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a2c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a34]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a38]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x410da9
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f5c], 1
jne 0x410dc0
push 5
mov eax, dword [0x466a24]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x466a20], 0x2b1
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x181
jne 0x410f53
cmp dword [0x4663ac], 0
je 0x410ed9
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x410ec1
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f84], 1
mov dword [0x465f80], 1
lea edx, [ebp - 0x36bc]
push edx
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x466a1c], 0x2ac
push 0x14
mov ecx, dword [0x46640c]
push ecx
mov edx, dword [0x466408]
push edx
mov eax, dword [ebp - 0x36b8]
add eax, 0x32
push eax
mov ecx, dword [ebp - 0x36bc]
add ecx, 0xae
push ecx
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x466404]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x410ed7
mov dword [0x466a1c], 0x2ac
mov eax, dword [0x466404]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x410f4e
call fcn.0040af20
mov dword [ebp - 0x366c], 0x23
mov dword [ebp - 0x3668], 0x1b
mov dword [ebp - 0x3664], 0x10c
mov dword [ebp - 0x3660], 0xba
push 1
lea ecx, [ebp - 0x366c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov eax, dword [0x4663e4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x466a20], 0x2b3
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x186
jne 0x411034
cmp dword [0x465f68], 0
je 0x410f94
mov dword [0x465f70], 1
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ax, word [0x44dd0c]
mov word [ebp - 0x1004], ax
push 0x298
push 0
lea ecx, [ebp - 0x1002]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x3844], eax
cmp dword [ebp - 0x3844], 1
jne 0x410fe4
push str.bcdedit__deletevalue_default_safeboot
lea edx, [ebp - 0x1004]
push edx
call fcn.0042fb63
add esp, 8
jmp 0x411001
cmp dword [ebp - 0x3844], 0
jne 0x411001
push str.bcdedit__set_default_safeboot_minimal
lea eax, [ebp - 0x1004]
push eax
call fcn.0042fb63
add esp, 8
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00407ed0
add esp, 4
cmp eax, 1
jne 0x41102f
push 0
push 0
push 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call fcn.0041c1e0
add esp, 4
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x185
jne 0x411090
cmp dword [0x465f68], 0
je 0x411071
mov dword [0x465f70], 1
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call fcn.0041c1e0
add esp, 4
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x184
jne 0x4110ed
cmp dword [0x465f68], 0
je 0x4110ce
mov dword [0x465f70], 1
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
call fcn.0041c1e0
add esp, 4
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x18c
jne 0x4111ee
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x411124
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f68], 0
jne 0x4111df
mov dword [0x465f68], 1
push 5
mov eax, dword [0x466ab4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a44]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x32
mov edx, dword [0x465f9c]
push edx
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0x40ef60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x382c], eax
cmp dword [ebp - 0x382c], 0
je 0x4111a0
mov ecx, dword [ebp - 0x382c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x369c], 0xa0
mov dword [ebp - 0x3698], 0x3c
mov dword [ebp - 0x3694], 0x11a
mov dword [ebp - 0x3690], 0x83
push 1
lea edx, [ebp - 0x369c]
push edx
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4111e9
mov dword [0x465f70], 1
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x18a
jne 0x411375
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x411225
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f68], 0
jne 0x411366
mov dword [ebp - 0x37d4], 0
push 0x44de44
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41126a
push 0x44de50
push 0x44de4c
call fcn.004259e0
add esp, 8
mov dword [ebp - 0x37d4], eax
jmp 0x41128b
push str.Select_a_Folder_You_Want_to_Scan
push str.SystemDrive
call fcn.0042f6a5
add esp, 4
push eax
call fcn.004259e0
add esp, 8
mov dword [ebp - 0x37d4], eax
cmp dword [ebp - 0x37d4], 0
je 0x411364
mov edx, dword [ebp - 0x37d4]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x411364
mov dword [0x465f68], 1
push 5
mov eax, dword [0x466ab4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a44]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x32
mov edx, dword [0x465f9c]
push edx
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
mov ecx, dword [ebp - 0x37d4]
push ecx
push 0x40f340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3818], eax
cmp dword [ebp - 0x3818], 0
je 0x411326
mov edx, dword [ebp - 0x3818]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x365c], 0xa0
mov dword [ebp - 0x3658], 0x3c
mov dword [ebp - 0x3654], 0x11a
mov dword [ebp - 0x3650], 0x83
push 1
lea eax, [ebp - 0x365c]
push eax
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x411370
mov dword [0x465f70], 1
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x180
jne 0x41169a
mov cx, word [0x44dee4]
mov word [ebp - 0x313c], cx
push 0x7fe
push 0
lea edx, [ebp - 0x313a]
push edx
call fcn.0042d590
add esp, 0xc
push 0x3c
push 0
push 0x4669b0
call fcn.0042d590
add esp, 0xc
mov dword [0x4669b0], 1
mov dword [0x4669b8], 0
lea eax, [ebp - 0x313c]
mov dword [0x4669c4], eax
mov dword [0x4669c8], 0x100
push 1
push 0xffffffffffffffff
push 0x100c
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4669b4], eax
push 0x4669b0
push 1
push 0xffffffffffffffff
push 0x100c
mov edx, dword [0x4663f4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x1073
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x37dc]
push ecx
mov ecx, 0x466ae8
call fcn.00421770
lea edx, [ebp - 0x38b8]
push edx
mov ecx, 0x466ae8
call fcn.00422270
push eax
lea ecx, [ebp - 0x37dc]
call fcn.00404f00
movzx eax, al
test eax, eax
je 0x4114bf
lea ecx, [ebp - 0x313c]
push ecx
lea ecx, [ebp - 0x37dc]
call fcn.00405060
mov ecx, eax
call fcn.00421c30
test eax, eax
jne 0x4114b2
mov edx, dword [ebp - 0x37dc]
mov dword [ebp - 0x387c], edx
mov eax, dword [ebp - 0x387c]
push eax
lea ecx, [ebp - 0x38ac]
push ecx
mov ecx, 0x466ae8
call fcn.00422650
mov edx, dword [eax]
mov dword [ebp - 0x37dc], edx
jmp 0x4114bd
lea ecx, [ebp - 0x37dc]
call fcn.004050c0
jmp 0x411443
push 0
push 0
push 0x1004
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x4114f1
push 0
push 0
push 0x1009
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41151b
push 0
push 2
push 0xffffffffffffffff
push 0x100c
mov edx, dword [0x4663f4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x1008
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3808], 0
push 0x44dee8
lea ecx, [ebp - 0x3744]
call fcn.00403550
mov dword [ebp - 4], 0
mov dword [ebp - 0x381c], 0x466ae8
lea ecx, [ebp - 0x3804]
push ecx
mov ecx, dword [ebp - 0x381c]
call fcn.00421770
lea edx, [ebp - 0x3878]
push edx
mov ecx, dword [ebp - 0x381c]
call fcn.00422270
jmp 0x411577
lea ecx, [ebp - 0x3804]
call fcn.004050c0
lea eax, [ebp - 0x3878]
push eax
lea ecx, [ebp - 0x3804]
call fcn.00404f00
movzx ecx, al
test ecx, ecx
je 0x41161d
lea ecx, [ebp - 0x3804]
call fcn.00405080
mov dword [ebp - 0x3820], eax
mov ecx, dword [ebp - 0x3820]
call fcn.00421840
push eax
call fcn.0042fb85
add esp, 4
mov edx, dword [ebp - 0x3808]
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 0x3808], eax
push 0
mov ecx, dword [ebp - 0x3820]
push ecx
lea edx, [ebp - 0x3774]
push edx
call fcn.004017e0
add esp, 0xc
mov dword [ebp - 0x3874], eax
mov eax, dword [ebp - 0x3874]
mov dword [ebp - 0x3870], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3870]
push ecx
lea ecx, [ebp - 0x3744]
call fcn.00405180
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3774]
call fcn.004046b0
jmp 0x41156c
mov dword [ebp - 0x37f4], 0
lea edx, [ebp - 0x37f4]
push edx
mov eax, dword [str.SYSTEMCurrentControlSetServicesCls]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x411683
mov ecx, dword [ebp - 0x3808]
push ecx
lea ecx, [ebp - 0x3744]
call fcn.00421840
push eax
push 7
push 0
push 0x44deec
mov edx, dword [ebp - 0x37f4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x37f4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x465f74], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3744]
call fcn.004046b0
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x17e
jne 0x4117c7
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
cmp dword [0x465f88], 0
jne 0x411762
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f88], 1
lea eax, [ebp - 0x36ac]
push eax
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x14
mov edx, dword [0x46640c]
push edx
mov eax, dword [0x466408]
push eax
mov ecx, dword [ebp - 0x36a8]
add ecx, 0x32
push ecx
mov edx, dword [ebp - 0x36ac]
add edx, 0xae
push edx
push 0
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x466404]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4117c2
push 0
push 0
push 0xf0
mov ecx, dword [0x466a88]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x411794
push 0
push 0
push 0xf1
mov edx, dword [0x466a88]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4117a9
push 0
push 1
push 0xf1
mov eax, dword [0x466a88]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x40
push 0x44def8
push str.Cls_Says._nYou_cannot_serve_two_masters._nFirst_get_done_with_Cls_Key_then_proceed._nTake_it_easy__One_step_at_a_time._You_will_get_there.
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x17b
jne 0x411fce
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4117fe
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf0
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x411ae4
mov ecx, dword [0x44e010]
mov dword [ebp - 0x2cc], ecx
mov edx, dword [0x44e014]
mov dword [ebp - 0x2c8], edx
mov eax, dword [0x44e018]
mov dword [ebp - 0x2c4], eax
mov ecx, dword [0x44e01c]
mov dword [ebp - 0x2c0], ecx
push 0x1f8
push 0
lea edx, [ebp - 0x2bc]
push edx
call fcn.0042d590
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.0042d590
add esp, 0xc
push 0x58
push 0
lea ecx, [ebp - 0x392c]
push ecx
call fcn.0042d590
add esp, 0xc
mov dword [ebp - 0x392c], 0x58
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3928], edx
mov dword [ebp - 0x3920], str.Text_File
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x3910], eax
mov dword [ebp - 0x38f0], 0x44e044
mov dword [ebp - 0x3908], 0x44e04c
mov dword [ebp - 0x390c], 0x104
mov dword [ebp - 0x38fc], 0x44e058
mov dword [ebp - 0x38f8], 0x2001000
lea ecx, [ebp - 0x392c]
push ecx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x411adf
push 1
push 0x40
push 2
lea edx, [ebp - 0x2cc]
push edx
lea ecx, [ebp - 0x3ad0]
call fcn.00403060
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3ad0]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x3ad0]
call fcn.00404e10
movzx edx, al
test edx, edx
je 0x41195b
mov dword [ebp - 0x386c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ad0]
call fcn.00405220
mov eax, dword [ebp - 0x386c]
jmp 0x413312
lea ecx, [ebp - 0x3ad0]
call fcn.00422c90
movzx eax, al
test eax, eax
je 0x411a82
mov ecx, dword [ebp - 0x3ad0]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x3ad0]
call fcn.00422a90
movzx eax, al
test eax, eax
je 0x411a82
mov dword [ebp - 0x3824], 0x466af4
lea ecx, [ebp - 0x380c]
push ecx
mov ecx, dword [ebp - 0x3824]
call fcn.00421770
lea edx, [ebp - 0x38a4]
push edx
mov ecx, dword [ebp - 0x3824]
call fcn.00422270
jmp 0x4119cc
lea ecx, [ebp - 0x380c]
call fcn.004050c0
lea eax, [ebp - 0x38a4]
push eax
lea ecx, [ebp - 0x380c]
call fcn.00404f00
movzx ecx, al
test ecx, ecx
je 0x411a82
lea ecx, [ebp - 0x380c]
call fcn.00405080
mov dword [ebp - 0x3828], eax
lea ecx, [ebp - 0x37f5]
call fcn.0041f440
push eax
lea edx, [ebp - 0x38b0]
push edx
mov ecx, dword [ebp - 0x3828]
call fcn.004221e0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x38b4]
push ecx
mov ecx, dword [ebp - 0x3828]
call fcn.00421710
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x375c]
call fcn.004013b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x375c]
call fcn.00421800
push eax
lea eax, [ebp - 0x3ad0]
push eax
call fcn.00401420
add esp, 8
push 0x44e054
lea ecx, [ebp - 0x3ad0]
push ecx
call fcn.00401420
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x375c]
call fcn.00404660
jmp 0x4119c1
lea ecx, [ebp - 0x3ad0]
call fcn.00422c90
movzx edx, al
test edx, edx
je 0x411a9f
lea ecx, [ebp - 0x3ad0]
call fcn.00421b90
push 0
push 0
push 0xf1
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x40
push 0x44e0c0
push str.Romans__14_:_17_._nThe_Kingdom_Of_God_Is_Not_Eating_And_Drinking._nBut_Righteousness_And_Peace_In_The_Holy_Ghost._nFor_Ever_And_Ever_Amen.
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ad0]
call fcn.00405220
jmp 0x411fc9
mov edx, dword [str.Cls.txt]
mov dword [ebp - 0xd68], edx
mov eax, dword [0x44e200]
mov dword [ebp - 0xd64], eax
mov ecx, dword [0x44e204]
mov dword [ebp - 0xd60], ecx
mov edx, dword [0x44e208]
mov dword [ebp - 0xd5c], edx
push 0x7f0
push 0
lea eax, [ebp - 0xd58]
push eax
call fcn.0042d590
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0xd68]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x58
push 0
lea edx, [ebp - 0x3a20]
push edx
call fcn.0042d590
add esp, 0xc
mov dword [ebp - 0x3a20], 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3a1c], eax
mov dword [ebp - 0x3a14], str.Virus_File
lea ecx, [ebp - 0xd68]
mov dword [ebp - 0x3a04], ecx
mov dword [ebp - 0x3a00], 0x400
mov dword [ebp - 0x39f0], str.Browse_For_Cls_Virus_DataBase_File_Or_A_New_Virus_File_
mov dword [ebp - 0x39ec], 0x2001000
lea edx, [ebp - 0x3a20]
push edx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x411fc9
lea eax, [ebp - 0xd68]
push eax
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x411fb0
push 0x44e20c
lea ecx, [ebp - 0xd68]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x411bf2
lea edx, [ebp - 0xd68]
push edx
call fcn.0041a540
add esp, 4
jmp 0x411fae
push 0x44e2d4
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e350
lea ecx, [ebp - 0xd68]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e35c
lea edx, [ebp - 0xd68]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e368
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e374
lea ecx, [ebp - 0xd68]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e380
lea edx, [ebp - 0xd68]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e38c
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e398
lea ecx, [ebp - 0xd68]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e3a4
lea edx, [ebp - 0xd68]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x411ce2
push 0x44e3b0
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x411f96
push 0x44
push 0x44e3bc
push str.Are_You_Sure_You_Want_To_Add_This_File___nTo_The_List_Of_Known_Viruses__
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x411f94
lea edx, [ebp - 0xd68]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
je 0x411d1e
xor eax, eax
jmp 0x413312
push 0
push 0
push 3
push 0
push 4
push SysReAllocString
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x37d0], eax
cmp dword [ebp - 0x37d0], 0xffffffff
jne 0x411d50
xor eax, eax
jmp 0x413312
push 0
mov ecx, dword [ebp - 0x37d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3814], eax
cmp dword [ebp - 0x3814], 0x3200000
jbe 0x411d87
mov edx, dword [ebp - 0x37d0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x413312
cmp dword [ebp - 0x3814], 0
jne 0x411da7
mov eax, dword [ebp - 0x37d0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x413312
mov dword [ebp - 0x3810], 0
lea ecx, [ebp - 0x37cc]
push ecx
call fcn.00427c70
add esp, 4
push 0
lea edx, [ebp - 0x3834]
push edx
push 0x400
lea eax, [ebp - 0x353c]
push eax
mov ecx, dword [ebp - 0x37d0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x3834]
push edx
lea eax, [ebp - 0x353c]
push eax
lea ecx, [ebp - 0x37cc]
push ecx
call fcn.00427a10
add esp, 0xc
mov edx, dword [ebp - 0x3810]
add edx, dword [ebp - 0x3834]
mov dword [ebp - 0x3810], edx
mov eax, dword [ebp - 0x3810]
cmp eax, dword [ebp - 0x3814]
jb 0x411dc0
mov ecx, dword [ebp - 0x37d0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x37cc]
push eax
call fcn.00427b90
add esp, 8
mov dword [ebp - 0x37d8], 0
jmp 0x411e5a
mov ecx, dword [ebp - 0x37d8]
add ecx, 1
mov dword [ebp - 0x37d8], ecx
cmp dword [ebp - 0x37d8], 0x10
jge 0x411e89
mov edx, dword [ebp - 0x37d8]
movzx eax, byte [ebp + edx - 0x20]
push eax
push 0x44e470
mov ecx, dword [ebp - 0x37d8]
lea edx, [ebp + ecx*2 - 0x44]
push edx
call fcn.00427e00
add esp, 0xc
jmp 0x411e4b
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x372c]
call fcn.004033a0
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x37f6]
call fcn.0041f440
push eax
lea ecx, [ebp - 0x38d4]
push ecx
lea ecx, [ebp - 0x372c]
call fcn.00422100
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x38d0]
push eax
lea ecx, [ebp - 0x372c]
call fcn.00421650
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x3714]
call fcn.00401340
mov byte [ebp - 4], 5
lea edx, [ebp - 0x38cc]
push edx
mov ecx, 0x466af4
call fcn.00422270
push eax
lea eax, [ebp - 0x3714]
push eax
lea ecx, [ebp - 0x38c8]
push ecx
mov ecx, 0x466af4
call fcn.00422270
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x38c4]
push eax
mov ecx, 0x466af4
call fcn.00421770
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x38c0]
push edx
call fcn.004025c0
add esp, 0x10
mov ecx, eax
call fcn.00404f00
movzx eax, al
test eax, eax
je 0x411f44
jmp 0x411f73
lea ecx, [ebp - 0x3714]
push ecx
mov ecx, 0x466af4
call fcn.00424a60
call fcn.0041d7e0
push 0x40
push 0x44e478
push str.Cls_Files._nNew__Virus._nIs_Added_To_Known._nViruses_Database._Thanxs
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3714]
call fcn.004046b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x372c]
call fcn.00404660
jmp 0x411fae
push 0x40
push 0x44e508
push str.Cls_Says._nPlease_Select_A_Text._nFile_Containing_Virus_Hashes._nAlrigned_One_Hash_Per_Line_Or_A_Virus_File.__nThat_Is_Not_In_The_Virus_Database_And_Try_Again.
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x411fc9
push 0x40
push 0x44e648
push str.Cls_Says._nPlease_Select_A_Text._nFile_containing_Virus_Hashes._nAlrigned_One_Hash_Per_Line_Or_A_Virus_File.__nThat_Is_Not_In_The_Virus_Database_And_Try_Again.
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x179
jne 0x412163
push 0
push 0
push 0xf0
mov ecx, dword [0x466a48]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x412036
push 0x44e788
call fcn.0041d420
add esp, 4
test eax, eax
jne 0x41201b
push str._CLS______Stopped_Successfully_____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0xf1
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41215e
cmp dword [0x4663ac], 0
je 0x412118
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4120ff
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f84], 1
mov dword [0x465f80], 1
lea ecx, [ebp - 0x36cc]
push ecx
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x466a1c], 0x2aa
push 0x14
mov eax, dword [0x46640c]
push eax
mov ecx, dword [0x466408]
push ecx
mov edx, dword [ebp - 0x36c8]
add edx, 0x32
push edx
mov eax, dword [ebp - 0x36cc]
add eax, 0x24
push eax
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x466404]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x412116
mov dword [0x466a1c], 0x2aa
mov edx, dword [0x466404]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x41215e
mov dword [0x466ab0], 0
push 0
push 0
mov eax, dword [0x466ab0]
push eax
push 0x44e7e4
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0x40
push 0x44e7f4
push str.Am_on_it._Alright_Stay_With_Your_Doom_
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x17a
jne 0x412232
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4121c7
push 0x44e850
call fcn.0041c640
add esp, 4
test eax, eax
jne 0x4121b0
push str._CLS______Started_Successfully_____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0xf1
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41222d
mov dword [0x466ab0], 1
push 0
push 0
mov ecx, dword [0x466ab0]
push ecx
push 0x44e8ac
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x412214
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40
push 0x44e8cc
push str.Am_on_it._I_Gat_Your_Back_
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x178
jne 0x412626
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4124ef
cmp dword [0x465fa0], 0
je 0x4122b3
push 0x44ea3c
call fcn.00409450
add esp, 4
test eax, eax
jne 0x4122ae
mov dword [0x465fa0], 0
push str._CLS______Deleted_Successfully_____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x40
push 0x44eaa4
push str.Salvation__nPraise__Worship_and_Glory_Belongs_to_Jesus._nThe_Prince_of_Peace.
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4124d4
mov cx, word [0x44e7fc]
mov word [ebp - 0x568], cx
push 0x298
push 0
lea edx, [ebp - 0x566]
push edx
call fcn.0042d590
add esp, 0xc
mov ax, word [0x44e92c]
mov word [ebp - 0x193c], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x193a]
push ecx
call fcn.0042d590
add esp, 0xc
lea edx, [ebp - 0x193c]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x29a
lea eax, [ebp - 0x568]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.InfDefaultInstall.exe
lea ecx, [ebp - 0x193c]
push ecx
call fcn.0042faf2
add esp, 8
mov dword [ebp - 0x37f0], 0
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x44ea44
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
lea ecx, [ebp - 0x568]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x41239b
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x193c]
push eax
call fcn.0042faf2
add esp, 8
mov dword [ebp - 0x37f0], 1
jmp 0x41249a
mov ecx, dword [str.Cls.inf]
mov dword [ebp - 0x213c], ecx
mov edx, dword [0x44ebac]
mov dword [ebp - 0x2138], edx
mov eax, dword [0x44ebb0]
mov dword [ebp - 0x2134], eax
mov ecx, dword [0x44ebb4]
mov dword [ebp - 0x2130], ecx
push 0x7f0
push 0
lea edx, [ebp - 0x212c]
push edx
call fcn.0042d590
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x213c]
push eax
call fcn.0042d590
add esp, 0xc
push 0x58
push 0
lea ecx, [ebp - 0x39c8]
push ecx
call fcn.0042d590
add esp, 0xc
mov dword [ebp - 0x39c8], 0x58
mov edx, dword [0x4663ec]
mov dword [ebp - 0x39c4], edx
mov dword [ebp - 0x39bc], str.Inf_File
lea eax, [ebp - 0x213c]
mov dword [ebp - 0x39ac], eax
mov dword [ebp - 0x39a8], 0x400
mov dword [ebp - 0x3998], str.Browse_For_Cls_Inf_File_
mov dword [ebp - 0x3994], 0x2001000
lea ecx, [ebp - 0x39c8]
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x41249a
lea edx, [ebp - 0x213c]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x41249a
lea eax, [ebp - 0x213c]
push eax
lea ecx, [ebp - 0x193c]
push ecx
call fcn.0042faf2
add esp, 8
mov dword [ebp - 0x37f0], 1
cmp dword [ebp - 0x37f0], 1
jne 0x4124d4
lea edx, [ebp - 0x193c]
push edx
call fcn.00407ed0
add esp, 4
mov dword [0x465fa0], 1
push 0x40
push 0x44ebd8
push str.Here_We_Go._Luke__10_:_19__nBehold__I_Give_You_Power_To_Tread_On_nSerpents_And_Scopions_And_Over_All_nThe_Power_Of_The_Enemy.
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0xf1
mov ecx, dword [0x466a48]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x412609
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41250e
push 0
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f98], 0
je 0x412604
cmp dword [0x4663ac], 0
je 0x4125fd
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4125e5
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f84], 1
mov dword [0x465f80], 1
lea edx, [ebp - 0x36fc]
push edx
mov eax, dword [0x4663ec]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x466a1c], 0x2a9
push 0x14
mov ecx, dword [0x46640c]
push ecx
mov edx, dword [0x466408]
push edx
mov eax, dword [ebp - 0x36f8]
add eax, 0x32
push eax
mov ecx, dword [ebp - 0x36fc]
add ecx, 0x24
push ecx
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x466404]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4125fb
mov dword [0x466a1c], 0x2a9
mov eax, dword [0x466404]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x412602
call fcn.004090e0
jmp 0x412609
call fcn.0041a9d0
push 1
push 0
mov ecx, dword [0x466a70]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
jmp 0x413312
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x175
jne 0x4128b5
push 0
push 0
push 0xf0
mov ecx, dword [0x466a48]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41279b
mov dword [ebp - 0x3838], 0
mov dword [ebp - 0x3860], 0
xor edx, edx
mov dword [ebp - 0x385c], edx
mov dword [ebp - 0x3860], 8
mov ax, word [0x44ed2c]
mov word [ebp - 0x12a0], ax
push 0x298
push 0
lea ecx, [ebp - 0x129e]
push ecx
call fcn.0042d590
add esp, 0xc
mov dx, word [0x44ed40]
mov word [ebp - 0x153c], dx
push 0x298
push 0
lea eax, [ebp - 0x153a]
push eax
call fcn.0042d590
add esp, 0xc
lea ecx, [ebp - 0x3838]
push ecx
push 8
lea edx, [ebp - 0x3860]
push edx
push 0x67
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jl 0x412780
cmp dword [ebp - 0x3838], 8
jne 0x412780
mov eax, dword [ebp - 0x385c]
and eax, 2
je 0x412729
push str.bcdedit__set_TESTSIGNING_OFF
lea ecx, [ebp - 0x12a0]
push ecx
call fcn.0042fb63
add esp, 8
push str.Successfully_Set_TESTSIGNING_OFF
lea edx, [ebp - 0x153c]
push edx
call fcn.0042fb63
add esp, 8
jmp 0x412751
push str.bcdedit__set_TESTSIGNING_ON
lea eax, [ebp - 0x12a0]
push eax
call fcn.0042fb63
add esp, 8
push str.Successfully_Set_TESTSIGNING_ON
lea ecx, [ebp - 0x153c]
push ecx
call fcn.0042fb63
add esp, 8
lea edx, [ebp - 0x12a0]
push edx
call fcn.00407ed0
add esp, 4
cmp eax, 1
jne 0x412780
push 0x40
push 0x44ee8c
lea eax, [ebp - 0x153c]
push eax
mov ecx, dword [0x4663ec]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0xf1
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4128b0
call fcn.00426970
mov dword [ebp - 0x3830], eax
cmp dword [ebp - 0x3830], 3
je 0x4128b0
cmp dword [ebp - 0x3830], 0
jne 0x4128ab
cmp dword [0x4663ac], 0
je 0x4128a4
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41288b
mov dword [0x466408], 0x5c
mov dword [0x46640c], 0x87
mov dword [0x465f84], 1
mov dword [0x465f80], 1
lea ecx, [ebp - 0x36dc]
push ecx
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x466a1c], 0x2ab
push 0x14
mov eax, dword [0x46640c]
push eax
mov ecx, dword [0x466408]
push ecx
mov edx, dword [ebp - 0x36d8]
add edx, 0x32
push edx
mov eax, dword [ebp - 0x36dc]
add eax, 0xae
push eax
push 0
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 5
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov eax, dword [0x466400]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x466404]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4128a2
mov dword [0x466a1c], 0x2ab
mov edx, dword [0x466404]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4128a9
call fcn.004266b0
jmp 0x4128b0
call fcn.00426c40
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x177
jne 0x412b44
call fcn.0040af20
mov dword [ebp - 0x355c], 0xab
mov dword [ebp - 0x3558], 0x19
mov dword [ebp - 0x3554], 0x10c
mov dword [ebp - 0x3550], 0xbc
push 1
lea edx, [ebp - 0x355c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x35dc], 0x21
mov dword [ebp - 0x35d8], 0x19
mov dword [ebp - 0x35d4], 0x81
mov dword [ebp - 0x35d0], 0xbc
mov ecx, dword [ebp - 0x35dc]
mov dword [ebp - 0x355c], ecx
mov edx, dword [ebp - 0x35d8]
mov dword [ebp - 0x3558], edx
mov eax, dword [ebp - 0x35d4]
mov dword [ebp - 0x3554], eax
mov ecx, dword [ebp - 0x35d0]
mov dword [ebp - 0x3550], ecx
push 1
lea edx, [ebp - 0x355c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x363c], 0x81
mov dword [ebp - 0x3638], 0x32
mov dword [ebp - 0x3634], 0xae
mov dword [ebp - 0x3630], 0x62
mov ecx, dword [ebp - 0x363c]
mov dword [ebp - 0x355c], ecx
mov edx, dword [ebp - 0x3638]
mov dword [ebp - 0x3558], edx
mov eax, dword [ebp - 0x3634]
mov dword [ebp - 0x3554], eax
mov ecx, dword [ebp - 0x3630]
mov dword [ebp - 0x3550], ecx
push 1
lea edx, [ebp - 0x355c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3d9
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x412a1b
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x3840], 0
mov dword [ebp - 0x3868], 0
xor eax, eax
mov dword [ebp - 0x3864], eax
mov dword [ebp - 0x3868], 8
lea ecx, [ebp - 0x3840]
push ecx
push 8
lea edx, [ebp - 0x3868]
push edx
push 0x67
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jl 0x412a92
cmp dword [ebp - 0x3840], 8
jne 0x412a92
mov eax, dword [ebp - 0x3864]
and eax, 2
je 0x412a7c
mov dword [ebp - 0x383c], 1
jmp 0x412a86
mov dword [ebp - 0x383c], 0
mov ecx, dword [ebp - 0x383c]
mov dword [0x465f58], ecx
push 5
mov edx, dword [0x466a5c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a58]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a70]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
mov ecx, dword [0x466a6c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a8c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a60]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x4663e4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x466a20], 0x2b2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040a8b0
add esp, 8
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x176
jne 0x412d98
push 0
push 0
push 0xf0
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x412d13
mov cx, word [0x44efbc]
mov word [ebp - 0x293c], cx
push 0x7fe
push 0
lea edx, [ebp - 0x293a]
push edx
call fcn.0042d590
add esp, 0xc
lea eax, [ebp - 0x293c]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x44efc8
lea ecx, [ebp - 0x293c]
push ecx
call fcn.0042faf2
add esp, 8
push str.__C__sfc__scannow__pause_
lea edx, [ebp - 0x293c]
push edx
call fcn.0042faf2
add esp, 8
mov dword [ebp - 0x3970], 0
push 0x40
push 0
lea eax, [ebp - 0x396c]
push eax
call fcn.0042d590
add esp, 0xc
mov dword [ebp - 0x3970], 0x44
mov dword [ebp - 0x3944], 1
mov ecx, 1
mov word [ebp - 0x3940], cx
mov dword [ebp - 0x3964], str.Cls_Fixing_System_Files
mov dword [ebp - 0x3858], 0
xor edx, edx
mov dword [ebp - 0x3854], edx
mov dword [ebp - 0x3850], edx
mov dword [ebp - 0x384c], edx
push 0x4663bc
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x412cb2
lea eax, [ebp - 0x3858]
push eax
lea ecx, [ebp - 0x3970]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x293c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x412ca4
mov eax, dword [ebp - 0x3858]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x3854]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x4663bc]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x412cb0
mov eax, dword [0x4663bc]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x412cf9
lea ecx, [ebp - 0x3858]
push ecx
lea edx, [ebp - 0x3970]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x293c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x412cf9
mov ecx, dword [ebp - 0x3858]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x3854]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xf1
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x412d93
mov dword [ebp - 0x364c], 0
xor ecx, ecx
mov dword [ebp - 0x3648], ecx
mov dword [ebp - 0x3644], ecx
mov dword [ebp - 0x3640], ecx
lea edx, [ebp - 0x364c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x466400]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x412d62
push 0
mov edx, dword [0x466400]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
mov eax, dword [ebp - 0x3648]
push eax
mov ecx, dword [ebp - 0x364c]
push ecx
push 0
mov edx, dword [0x4663f8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
mov eax, dword [0x4663f8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x17c
jne 0x412ef5
mov byte [ebp - 0x84], 0
push 0x3f
push 0
lea eax, [ebp - 0x83]
push eax
call fcn.0042d590
add esp, 0xc
push 0x466aa4
push 0
push 0
push 0
push 0
push 0x44f224
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
test eax, eax
jl 0x412ea9
push 0
push 0
push 0xf0
mov ecx, dword [0x466a74]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x412e0f
mov dword [0x466aac], 1
jmp 0x412e19
mov dword [0x466aac], 0
mov byte [ebp - 0x37e4], 0
mov dl, byte [0x466aa8]
mov byte [ebp - 0x37e3], dl
mov al, byte [0x466aac]
mov byte [ebp - 0x37e2], al
lea ecx, [ebp - 0x38bc]
push ecx
push 0x40
lea edx, [ebp - 0x84]
push edx
push 3
lea eax, [ebp - 0x37e4]
push eax
mov ecx, dword [0x466aa4]
push ecx
call sub.FLTLIB.DLL_FilterSendMessage
cmp dword [0x466aa4], 0
je 0x412e72
mov edx, dword [0x466aa4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov eax, dword [0x466aac]
push eax
push 0x44f324
mov ecx, dword [str.SYSTEMCurrentControlSetServicesCls]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
call fcn.0041a7e0
jmp 0x412ef0
push 0
push 0
push 0xf0
mov edx, dword [0x466a74]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x412eda
push 0
push 0
push 0xf1
mov eax, dword [0x466a74]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x412ef0
push 0
push 1
push 0xf1
mov ecx, dword [0x466a74]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x413310
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x17d
jne 0x413051
mov byte [ebp - 0xc4], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc3]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x466aa4
push 0
push 0
push 0
push 0
push str.C0011L0110C1111Cls
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
test eax, eax
jl 0x413005
push 0
push 0
push 0xf0
mov edx, dword [0x466a54]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x412f6b
mov dword [0x466aa8], 1
jmp 0x412f75
mov dword [0x466aa8], 0
mov byte [ebp - 0x37e0], 1
mov al, byte [0x466aa8]
mov byte [ebp - 0x37df], al
mov cl, byte [0x466aac]
mov byte [ebp - 0x37de], cl
lea edx, [ebp - 0x38a8]
push edx
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 3
lea ecx, [ebp - 0x37e0]
push ecx
mov edx, dword [0x466aa4]
push edx
call sub.FLTLIB.DLL_FilterSendMessage
cmp dword [0x466aa4], 0
je 0x412fcd
mov eax, dword [0x466aa4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov ecx, dword [0x466aa8]
push ecx
push 0x44f45c
mov edx, dword [str.SYSTEMCurrentControlSetServicesCls]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0x6f
push 0x3e7
call dword [sym.imp.KERNEL32.dll_Beep]
call fcn.0041a7e0
jmp 0x41304c
push 0
push 0
push 0xf0
mov eax, dword [0x466a54]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x413036
push 0
push 0
push 0xf1
mov ecx, dword [0x466a54]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41304c
push 0
push 1
push 0xf1
mov edx, dword [0x466a54]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x171
jne 0x413109
cmp dword [0x465f80], 0
jne 0x4130ee
push 0
push 0
push 0
push 0x418fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38a0], eax
mov edx, dword [ebp - 0x38a0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x465f78], 0
jne 0x4130d6
mov dword [0x465f78], 1
push 0
push 0
push 0
push 0x418c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x389c], eax
mov eax, dword [ebp - 0x389c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4130ec
push 0x40
push 0x44f4f8
push 0x44f508
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413104
push 0x40
push 0x44f584
push 0x44f5a0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x168
jne 0x41315e
cmp dword [0x465f5c], 0
jne 0x413159
mov dword [0x465f5c], 1
push 0
push 0
push 0
push 0x4189d0
push 0
push 0
call fcn.00432ec6
add esp, 0x18
mov dword [ebp - 0x3894], eax
mov edx, dword [ebp - 0x3894]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x197
jne 0x413216
cmp dword [0x465f80], 0
jne 0x4131fb
push 0
push 0
push 0
push 0x418fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3898], eax
mov edx, dword [ebp - 0x3898]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x465f78], 0
jne 0x4131e3
mov dword [0x465f78], 1
push 0
push 0
push 0
push 0x418c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x388c], eax
mov eax, dword [ebp - 0x388c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4131f9
push 0x40
push 0x44f64c
push str.Please_Wait_While_Collecting__n___Your_System_information_
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413211
push 0x40
push 0x44f6ec
push str.Please_Wait_While_Collecting__n___Your_System_Tools_
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x413310
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x192
jne 0x4132bc
mov dword [ebp - 0x35bc], 0
xor edx, edx
mov dword [ebp - 0x35b8], edx
mov dword [ebp - 0x35b4], edx
mov dword [ebp - 0x35b0], edx
lea eax, [ebp - 0x35bc]
push eax
mov ecx, dword [0x4663f8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0
push 0
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebp - 0x35b0]
sub edx, dword [ebp - 0x35b8]
sub eax, edx
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x35b4]
sub ecx, dword [ebp - 0x35bc]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push 0
mov edx, dword [0x4663f8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
mov eax, dword [0x4663f8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x190
jne 0x4132ef
push 0x465fac
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x413310
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x191
jne 0x413310
push 0x465fac
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret