Function at 0x41b1d0
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get common file path
Get comspec environment variable
Get file attributes
Get file system object information
Get session information
Get session user name
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429e60
mov eax, dword fs:[0]
push eax
mov eax, 0x106c
call fcn.0041e0c0
mov eax, dword [0x43e010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push 0x460
mov dword [ebp - 0xfd4], eax
xor edi, edi
mov dword [ebp - 0xff4], eax
lea eax, [ebp - 0x6a0]
push edi
push eax
mov dword [ebp - 0xfec], ebx
call fcn.0041e990
add esp, 0xc
lea eax, [ebp - 0xd00]
push 0x460
push edi
push eax
call fcn.0041e990
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
test esi, esi
je 0x41b261
xor eax, eax
cmp esi, 0x3a4
sete al
mov dword [0x458ac8], eax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0xfcc], 0x3e44493c
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a20], eax
mov dword [ebp - 0xfcc], 0x492f3c37
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a24], eax
mov dword [ebp - 0xfcc], 0x3e44
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a28], eax
mov dword [ebp - 0xfcc], 0x3e44493c
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a10], eax
mov dword [ebp - 0xfcc], 0x2f3c3034
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a14], eax
mov dword [ebp - 0xfcc], 0x3e4449
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a18], eax
mov dword [ebp - 0xfcc], 0x3e44493c
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a00], eax
mov dword [ebp - 0xfcc], 0x3c313031
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a04], eax
mov dword [ebp - 0xfcc], 0x3e44492f
mov eax, dword [ebp - 0xfcc]
mov dword [0x450a08], eax
mov byte [ebp - 0xfcc], 0x3c
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509f0], eax
mov dword [ebp - 0xfcc], 0x3c333035
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509f4], eax
mov dword [ebp - 0xfcc], 0x3e44492f
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509f8], eax
mov byte [ebp - 0xfcc], 0x3c
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509e0], eax
mov dword [ebp - 0xfcc], 0x2f3c3431
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509e4], eax
mov dword [ebp - 0xfcc], 0x3e4449
mov eax, dword [ebp - 0xfcc]
mov dword [0x4509e8], eax
mov dword [ebp - 0xfdc], 0x656e6974
mov eax, dword [ebp - 0xfdc]
mov dword [0x450963], eax
mov dword [ebp - 0xfcc], 0x7263694d
mov eax, dword [ebp - 0xfcc]
mov dword [0x43e8b0], eax
mov dword [ebp - 0xfcc], 0x666f736f
mov eax, dword [ebp - 0xfcc]
mov dword [0x43e8b4], eax
mov dword [ebp - 0xfcc], 0x454e2e74
mov eax, dword [ebp - 0xfcc]
mov dword [0x43e8b8], eax
call fcn.00402060
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x452b78], eax
test eax, eax
jne 0x41b42b
mov eax, 0x270e
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xfcc], eax
jmp 0x41bbcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xfcc], eax
cmp eax, 0xb7
jne 0x41b454
mov eax, 0x270d
mov dword [ebp - 0xfcc], edi
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
push 0x118
push 0x4519f8
push 0
mov dword [0x4522e8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0xff4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0xff4], 2
mov ebx, eax
mov dword [ebp - 0xff8], ebx
jle 0x41b5a4
mov cx, word [0x4519f8]
xor esi, esi
mov eax, 0x270f
mov dword [ebp - 0xfd8], 0xffffffff
xor edx, edx
mov dword [ebp - 0xfd4], eax
test cx, cx
je 0x41b4f6
movzx eax, cx
mov ecx, 0x4519f8
cmp ax, 0x5c
je 0x41b4ce
cmp ax, 0x2f
jne 0x41b4d0
mov esi, ecx
inc edx
movzx eax, word [edx*2 + 0x4519f8]
lea ecx, [edx*2 + 0x4519f8]
test ax, ax
jne 0x41b4c2
test esi, esi
je 0x41b4f6
xor eax, eax
mov word [esi], ax
lea eax, [esi + 2]
mov dword [0x43e8cc], eax
lea eax, [ebp - 0x6a0]
push eax
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0xfe1]
movzx edx, word [eax]
sub edx, 0x30
call fcn.004021d0
lea eax, [ebp - 0xfd8]
push eax
lea edx, [ebp - 0x6a0]
lea ecx, [ebp - 0xfe1]
call fcn.00402bf0
mov edi, eax
lea eax, [ebp - 0x679]
push edi
push dword [ebp - 0xfd8]
push str._____d___d__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x6a0]
push 0x10
push 0x438f48
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x4519f8
lea eax, [ebp - 0xd00]
push 0x42f890
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x6a0]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea ecx, [ebp - 0xd00]
call fcn.00403d70
add esp, 4
jmp 0x41bbcd
lea eax, [ebp - 0xfe0]
xor edi, edi
push eax
lea eax, [ebp - 0xfd8]
mov dword [ebp - 0xfe0], edi
push eax
push 1
push edi
push edi
mov dword [ebp - 0x1004], edi
mov dword [ebp - 0xfdc], edi
mov dword [ebp - 0xfd8], edi
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test eax, eax
jne 0x41b5e8
or edi, 0xffffffff
jmp 0x41b6cf
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0xfe8], eax
mov dword [ebp - 0xfd0], edi
cmp dword [ebp - 0xfe0], edi
jbe 0x41b6cf
xor ebx, ebx
nop dword [eax + eax]
lea eax, [ebp - 0x1004]
mov dword [ebp - 0xfdc], 0
push eax
lea eax, [ebp - 0xfdc]
push eax
mov eax, dword [ebp - 0xfd8]
push 5
push dword [eax + ebx]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x41b6c4
mov eax, dword [ebp - 0xfd8]
mov ecx, dword [ebp - 0xfe8]
push dword [ebp - 0xfdc]
cmp dword [eax + ebx], ecx
jne 0x41b66d
mov edi, dword [ebp - 0xfe0]
push 0x450858
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41b687
mov eax, dword [0x44fe54]
shl eax, 8
add eax, 0x44fe58
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [0x44fe54]
mov eax, dword [ebp - 0xfdc]
test eax, eax
je 0x41b6a0
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor eax, eax
mov dword [ebp - 0xfdc], eax
mov ecx, dword [ebp - 0xfd0]
add ebx, 0xc
inc ecx
mov dword [ebp - 0xfd0], ecx
cmp ecx, dword [ebp - 0xfe0]
jb 0x41b610
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x41b6d5
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov edi, 0xfffffffe
mov eax, dword [ebp - 0xfdc]
test eax, eax
je 0x41b6dc
push eax
call ebx
mov eax, dword [ebp - 0xfd8]
test eax, eax
je 0x41b6e9
push eax
call ebx
mov dword [ebp - 0xfe8], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0041e990
add esp, 0xc
lea eax, [ebp - 0xe18]
push 0x100
push 0
push eax
call fcn.0041e990
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0xfe8]
add esp, 0xc
push eax
lea eax, [ebp - 0x110]
push eax
call ebx
test eax, eax
je 0x41b7e5
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xe18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ax, word [ebp - 0xe18]
xor edx, edx
test ax, ax
je 0x41b79d
lea ecx, [ebp - 0xe18]
movzx ebx, ax
nop
movzx ebx, bx
lea eax, [ebx - 0x61]
cmp ax, 0x19
ja 0x41b782
lea eax, [ebx - 0x20]
mov word [ecx], ax
inc edx
lea ecx, [ebp - 0xe18]
movzx eax, word [ecx + edx*2]
lea ecx, [ecx + edx*2]
mov ebx, eax
test ax, ax
jne 0x41b770
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0xe18]
push eax
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b7dd
lea eax, [ebp - 0xe18]
push eax
push str.SYSTEM
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b7dd
lea eax, [ebp - 0x110]
push eax
push 0x43f538
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41b7e5
xor eax, eax
mov word [0x43f538], ax
push 0x43f538
push 0x450a90
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x41b81f
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x41b81f
mov dword [0x43e890], 2
jmp 0x41b83a
push str.AddAccessAllowedAceEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov ecx, 3
cmove eax, ecx
mov dword [0x43e890], eax
cmp word [0x450a90], 0
jne 0x41b85c
lea eax, [ebp - 0xfe8]
mov dword [ebp - 0xfe8], 0x40
push eax
push 0x450a90
call ebx
push 0x230
lea eax, [ebp - 0x240]
mov dword [0x450958], 0x756e694c
push 0
push eax
mov word [0x45095c], 0x2078
mov dword [ebp - 0x1078], 0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0xfd0], 0
call fcn.0041e990
add esp, 0xc
lea eax, [ebp - 0x240]
push 0x118
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ax, word [ebp - 0x240]
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x41b8f7
movzx edx, ax
lea eax, [ebp - 0x240]
cmp dx, 0x5c
lea ecx, [ecx + 1]
cmovne eax, ebx
mov ebx, eax
lea eax, [ebp - 0x240]
movzx edx, word [eax + ecx*2]
lea eax, [eax + ecx*2]
test dx, dx
jne 0x41b8d0
test ebx, ebx
je 0x41b8f7
xor eax, eax
mov word [ebx], ax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x240]
push 0x42f7ac
push eax
call ebx
push str.HTTP_Parser_Log.txt
lea eax, [ebp - 0x240]
push eax
call ebx
lea edx, [ebp - 0xfd0]
lea ecx, [ebp - 0x1078]
call fcn.00401270
xor ebx, ebx
nop dword [eax]
push 0
push 0x8000080
push 2
push dword [ebp - 0xfd0]
lea eax, [ebp - 0x240]
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x43e8f4], eax
cmp eax, 0xffffffff
jne 0x41b97e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc8
mov dword [0x43e8f4], 0xffffffff
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xa
jl 0x41b930
cmp dword [ebp - 0x1074], 0
je 0x41b9df
push dword [ebp - 0x1010]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x1074]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [ebp - 0x1078], ebx
jle 0x41b9df
nop dword [eax]
push dword [ebp + ebx*4 - 0x1070]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc ebx
cmp ebx, dword [ebp - 0x1078]
jl 0x41b9c0
push 0x438f98
call fcn.00403840
add esp, 4
push 0x4519f8
push str.__tWinMain__________________Module_FullName________________s_
call fcn.00403840
push esi
push str.__tWinMain__________________CodePage_______________________d_
call fcn.00403840
push dword [ebp - 0xff4]
push str.__tWinMain__________________Arg_Count______________________d_
call fcn.00403840
push edi
push str.__tWinMain__________________ActUserNameInformation_________d_
call fcn.00403840
push dword [0x44fe54]
push str.__tWinMain__________________Logon_UserCount________________d_
call fcn.00403840
push 0x450858
push str.__tWinMain__________________ActiveUserName_________________s_
call fcn.00403840
push 0x450a90
push str.__tWinMain__________________MainGetUserName________________s_
call fcn.00403840
push str.__tWinMain__________________Start________
call fcn.00403840
add esp, 0x3c
mov dword [ebp - 0x230], 0x42f394
xorps xmm0, xmm0
xor esi, esi
movups xmmword [ebp - 0x24], xmm0
mov ebx, 1
push 2
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41bc64
cmp eax, ebx
je 0x41bc64
mov dword [ebp - 0x230], str._CoInitializeEx_Call_Error
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 0x3e2
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xfcc], eax
lea eax, [ebp - 0xd10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x8a0]
push str.ErrorInfo.log
push 0x4519f8
push 0x42f890
push eax
call ebx
push dword [ebp - 0x24]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x230]
push str._s_:_ErrorCode____08X_
push eax
call ebx
push dword [ebp - 0xfcc]
lea eax, [ebp - 0x22c]
push eax
movzx eax, word [ebp - 0xd04]
push eax
movzx eax, word [ebp - 0xd06]
push eax
movzx eax, word [ebp - 0xd08]
push eax
movzx eax, word [ebp - 0xd0a]
push eax
movzx eax, word [ebp - 0xd0e]
push eax
movzx eax, word [ebp - 0xd10]
push eax
lea eax, [ebp - 0x6a0]
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
push eax
call ebx
add esp, 0x48
lea eax, [ebp - 0xd00]
push 0
push 0
push 0x118
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x6a0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xd00]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea ecx, [ebp - 0x8a0]
call fcn.00403d70
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41bba3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41bbb0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x20], 1
jne 0x41bbb8
call esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [0x4517b4]
mov esi, 0x10
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test eax, eax
je 0x41bbe4
push eax
call ebx
mov eax, dword [0x4517bc]
test eax, eax
je 0x41bbf0
push eax
call ebx
mov eax, dword [0x4517b8]
test eax, eax
je 0x41bbfc
push eax
call ebx
mov eax, dword [0x452b90]
test eax, eax
je 0x41bc0c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x452b88]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41bc1e
push eax
call ebx
mov eax, dword [0x452b84]
test eax, eax
je 0x41bc2a
push eax
call ebx
mov eax, dword [0x452b78]
test eax, eax
je 0x41bc36
push eax
call ebx
mov ebx, dword [ebp - 0xfd4]
cmp ebx, 0x3df
ja 0x41cde4
je 0x41cdb3
test ebx, ebx
jne case.default.0x41cf0f
xor eax, eax
mov word [ebp - 0x6a0], ax
jmp 0x41d06a
cmp dword [ebp - 0x20], esi
jne 0x41bcb1
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41bcae
cmp eax, 0x80010119
je 0x41bcae
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
call esi
push 2
mov dword [ebp - 0x230], str._CoInitializeSecurity_Call_Error
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41baa7
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x1c], esi
jne 0x41bce6
lea eax, [ebp - 0x1c]
push eax
push 0x42a520
push 7
push 0
push 0x42a530
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41bce6
mov dword [ebp - 0x230], str._CoCreateInstance_Call_Error
push 3
jmp 0x41ba9b
cmp dword [ebp - 0x18], esi
jne 0x41bd4c
push str.RootCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea esi, [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp - 0x1c]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
mov dword [ebp - 0xfe8], edx
call dword [ecx + 0xc]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41bd30
mov dword [ebp - 0x230], str._ConnectServer_Call_Error
mov dword [ebp - 0x18], 0
push dword [ebp - 0xfe8]
mov esi, eax
neg esi
sbb esi, esi
xor ebx, ebx
and esi, 4
test eax, eax
sete bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x41baa1
lea ecx, [ebp - 0x230]
call fcn.0040c560
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41bd73
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41bd80
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x20], 1
jne 0x41bd8c
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x118
lea eax, [ebp - 0xd00]
mov dword [ebp - 0x18], 0
push eax
push 0xffffffffffffffff
push str.sysinfoview.xml
push 0
push 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xd00]
push eax
push str.__tWinMain__________________FirstRunFile___________________s_
call fcn.00403840
mov ax, word [0x4519f8]
add esp, 8
xor esi, esi
xor edx, edx
test ax, ax
je 0x41be27
movzx eax, ax
mov ecx, 0x4519f8
cmp ax, 0x5c
je 0x41bdfc
cmp ax, 0x2f
jne 0x41bdfe
mov esi, ecx
inc edx
movzx eax, word [edx*2 + 0x4519f8]
lea ecx, [edx*2 + 0x4519f8]
test ax, ax
jne 0x41bdf0
test esi, esi
je 0x41be27
xor eax, eax
mov word [esi], ax
add esi, 2
mov dword [0x43e8cc], esi
jmp 0x41be2d
mov esi, dword [0x43e8cc]
push esi
push 0x439478
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41be4d
mov eax, 0x3df
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xd00]
push eax
push 0x4519f8
lea eax, [ebp - 0x6a0]
push 0x42f890
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xfcc], eax
cmp esi, 0xffffffff
jne 0x41bea0
mov eax, 0x3e0
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
lea eax, [ebp - 0x1000]
push eax
push 0
push 0x36387828
push fcn.004049e0
push 0
push 0
call fcn.004207bb
add esp, 0x18
test eax, eax
jne 0x41bf97
mov eax, 0x3e1
mov edi, 1
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xd10]
push eax
mov dword [ebp - 0xfcc], esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.ErrorInfo.log
push 0x4519f8
lea eax, [ebp - 0x8a0]
push 0x42f890
push eax
call ebx
push esi
push str.parserSearchThread_Call_Error
movzx eax, word [ebp - 0xd04]
push eax
movzx eax, word [ebp - 0xd06]
push eax
movzx eax, word [ebp - 0xd08]
push eax
movzx eax, word [ebp - 0xd0a]
push eax
movzx eax, word [ebp - 0xd0e]
push eax
movzx eax, word [ebp - 0xd10]
push eax
lea eax, [ebp - 0x6a0]
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
push eax
call ebx
add esp, 0x38
lea eax, [ebp - 0xd00]
push 0
push 0
push 0x118
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x6a0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xd00]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea ecx, [ebp - 0x8a0]
call fcn.00403d70
add esp, 4
jmp 0x41bbcd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
xor edx, edx
lea ecx, [ebp - 0x6a0]
call fcn.0040adf0
mov edi, eax
test edi, edi
je 0x41c021
cmp edi, 0xc9
jne 0x41bfd6
mov eax, 0x3e9
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
cmp edi, 0xca
jne 0x41bfee
mov eax, 0x3ea
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
cmp edi, 0xcb
jne 0x41c006
mov eax, 0x3eb
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
xor eax, eax
cmp edi, 0x96
setl al
add eax, 0x3ec
mov dword [ebp - 0xfd4], eax
jmp 0x41bbcd
push str.parserchk.txt
push 0x4519f8
lea eax, [ebp - 0x6a0]
push 0x42f890
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp esi, 0xffffffff
je 0x41c0a3
push str.parsernot.txt
push 0x4519f8
lea eax, [ebp - 0x6a0]
mov dword [0x4517c4], 1
push 0x42f890
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call edi
mov eax, dword [0x4517c4]
cmp esi, 0xffffffff
mov ecx, 2
cmovne eax, ecx
mov dword [0x4517c4], eax
push 0x4519f8
push str._sHTTP_Parser.chm
push 0x4517c8
call ebx
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xff4]
test ecx, ecx
jle 0x41c0f6
xor eax, eax
test ecx, ecx
jle 0x41c0f6
mov edi, dword [ebp - 0xff8]
push dword [edi + eax*4]
lea esi, [eax + 1]
push esi
push str.__tWinMain__________________Arg_List_______________________d___s_
call fcn.00403840
mov eax, esi
add esp, 0xc
cmp eax, dword [ebp - 0xff4]
jl 0x41c0d8
push 0x4519f8
push str.__tWinMain__________________Base_Folder____________________s_
call fcn.00403840
add esp, 8
mov dword [ebp - 0xfd0], 0
push str.BINTYPE
push 0x12d
push dword [0x4522e8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, dword [sym.imp.OLEAUT32.dll_VarUI4FromI8]
mov esi, eax
test esi, esi
je 0x41c2e4
push 0x460
lea eax, [ebp - 0x6a0]
push 0
push eax
call fcn.0041e990
mov edi, dword [ebp - 0xfec]
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ebx, eax
push edi
mov dword [ebp - 0xfd8], ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test ebx, ebx
je 0x41c17f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xfd0], eax
push 0x230
lea eax, [ebp - 0xf48]
push 0
push eax
call fcn.0041e990
add esp, 0xc
test esi, esi
jle 0x41c291
lea eax, [ebp - 0xf48]
push eax
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.logo.gif
lea eax, [ebp - 0xf48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor ebx, ebx
mov dword [ebp - 0xff0], 0xffffffff
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0xf48]
mov dword [ebp - 0xfe0], ebx
push eax
mov dword [ebp - 0xfec], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c211
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
jmp 0x41c28b
push 0
lea eax, [ebp - 0xff0]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea eax, [ebp - 0xfe0]
push eax
push esi
push dword [ebp - 0xfd0]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c24b
lea esi, [eax - 3]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x41c264
cmp esi, dword [ebp - 0xfe0]
je 0x41c262
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x41c264
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call eax
test esi, esi
jne 0x41c28b
lea eax, [ebp - 0xf48]
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [ebp - 0xfd8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0xfd0], 0
push eax
push 0x42a420
push 0
push 0
push 0
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromI8]
mov ecx, dword [ebp - 0xfd0]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [0x4522e4], ecx
test ebx, ebx
je 0x41c2de
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [sym.imp.OLEAUT32.dll_VarUI4FromI8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x6a0]
push 0x4519f8
push str._s_themes_b_good.bmp
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xd00]
push 0x4519f8
push str._s_themes_b_bad.bmp
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8a0]
push 0x4519f8
push str._s_themes_b_desktop.bmp
push eax
call esi
add esp, 0xc
mov dword [ebp - 0xfd0], 0
lea eax, [ebp - 0xfd0]
push eax
push 0x42a420
push 0
push 0
push 0
lea eax, [ebp - 0x6a0]
push eax
call ebx
mov ecx, dword [ebp - 0xfd0]
xor edx, edx
test eax, eax
mov dword [ebp - 0xfd0], edx
lea eax, [ebp - 0xfd0]
push eax
push 0x42a420
push edx
push edx
push edx
lea eax, [ebp - 0xd00]
cmovs ecx, edx
push eax
mov dword [0x4522e0], ecx
call ebx
mov ecx, dword [ebp - 0xfd0]
xor edx, edx
test eax, eax
mov dword [ebp - 0xfec], edx
lea eax, [ebp - 0xfec]
push eax
push 0x42a420
push edx
push edx
push edx
lea eax, [ebp - 0x8a0]
cmovs ecx, edx
push eax
mov dword [0x4522dc], ecx
call ebx
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x452b84], eax
cmp eax, 0xffffffff
jne 0x41c46b
mov eax, 0x3e1
mov edi, 2
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x452b84], 0
lea eax, [ebp - 0xd10]
mov dword [ebp - 0xfcc], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.ErrorInfo.log
push 0x4519f8
lea eax, [ebp - 0x8a0]
push 0x42f890
push eax
call esi
movzx eax, word [ebp - 0xd04]
push ebx
push str.Mail_Handle_Create_Error
push eax
movzx eax, word [ebp - 0xd06]
push eax
movzx eax, word [ebp - 0xd08]
push eax
movzx eax, word [ebp - 0xd0a]
push eax
movzx eax, word [ebp - 0xd0e]
push eax
movzx eax, word [ebp - 0xd10]
push eax
lea eax, [ebp - 0x6a0]
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
push eax
call esi
jmp 0x41bf4e
push str.PARSER_SHARED_MAPMEMORY
push 0xa00000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x452b88], eax
test eax, eax
jne 0x41c51a
lea edi, [eax + 3]
mov eax, 0x3e1
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [ebp - 0xd10]
push eax
mov dword [ebp - 0xfcc], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.ErrorInfo.log
push 0x4519f8
lea eax, [ebp - 0x8a0]
push 0x42f890
push eax
call esi
movzx eax, word [ebp - 0xd04]
push ebx
push str.Map_Handle_Create_Error
push eax
movzx eax, word [ebp - 0xd06]
push eax
movzx eax, word [ebp - 0xd08]
push eax
movzx eax, word [ebp - 0xd0a]
push eax
movzx eax, word [ebp - 0xd0e]
push eax
movzx eax, word [ebp - 0xd10]
push eax
lea eax, [ebp - 0x6a0]
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
push eax
call esi
jmp 0x41bf4e
push 0xa00000
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x452b90], eax
test eax, eax
jne 0x41c53d
lea edi, [eax + 4]
jmp 0x41c493
push eax
push str.__tWinMain__________________SharedMemory___________________08X_
call fcn.00403840
add esp, 8
mov dword [ebp - 0xff0], 8
lea eax, [ebp - 0xff0]
mov dword [ebp - 0xfec], 0x3ff
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x100
push 0x451e58
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x41c595
push str.cmd.exe
push 0x451e58
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x452f20
call fcn.0041e990
add esp, 0xc
lea eax, [ebp - 0x6a0]
push str.sitelink.txt
push 0x4519f8
push 0x42f890
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
cmp esi, 0xffffffff
je 0x41c5f8
push 0x452f20
mov edx, 0x5460
lea ecx, [ebp - 0x6a0]
call fcn.00403ab0
add esp, 4
lea eax, [ebp - 0x1000]
mov dword [0x4522d8], 1
push eax
push 0
push 0
push 0x408a40
push 0
push 0
call fcn.004207bb
add esp, 0x18
mov dword [ebp - 0xfec], eax
test eax, eax
jne 0x41c678
mov eax, 0x3e1
mov edi, 5
mov dword [ebp - 0xfd4], eax
call ebx
mov esi, eax
lea eax, [ebp - 0xd10]
push eax
mov dword [ebp - 0xfcc], esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x8a0]
push str.ErrorInfo.log
push 0x4519f8
push 0x42f890
push eax
call ebx
push esi
push str.sessionSearchThread_Call_Error
jmp 0x41bf10
call fcn.004043a0
xor esi, esi
cmp word [0x4512a0], si
je 0x41c6b4
mov eax, 0x4512a0
nop dword [eax]
push eax
push str.__tWinMain__________________InstBrowser____________________s_
call fcn.00403840
inc esi
add esp, 8
mov eax, esi
shl eax, 7
cmp word [eax + 0x4512a0], 0
lea eax, [eax + 0x4512a0]
jne 0x41c690
push 0x410
xor esi, esi
mov dword [ebp - 0xfd8], 0
push esi
push 0x458ad0
call fcn.0041e990
add esp, 0xc
mov edx, 0x5c
xor ecx, ecx
mov eax, str._test.html
nop
cmp dx, 0x2e
lea ecx, [ecx + 1]
movzx edx, word [ecx*2 + str._test.html]
cmovne eax, esi
mov esi, eax
lea eax, [ecx*2 + str._test.html]
test dx, dx
jne 0x41c6e0
push str._test.html
push str._FindExecutable_____________Run_File_______________________s_
call fcn.00403840
add esp, 8
test esi, esi
je 0x41c752
lea eax, [ebp - 0xfd8]
mov dword [ebp - 0xfd8], 0x208
push eax
push 0x458ad0
push str.open
push esi
push 2
push 0x20
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
push 0x458ad0
push str._FindExecutable_____________AssocQueryString_______________s_
mov edi, eax
call fcn.00403840
add esp, 8
jmp 0x41c758
mov edi, dword [ebp - 0x1000]
test edi, edi
js 0x41c765
cmp dword [ebp - 0xfd8], 0
jne 0x41c78d
test esi, esi
je 0x41c78d
push 0x458ad0
push 0
push str._test.html
call dword [sym.imp.SHELL32.dll_FindExecutableW]
push 0x458ad0
push str._FindExecutable_____________FindExecutable_________________s_
call fcn.00403840
add esp, 8
xor eax, eax
mov esi, 0x458ad0
cmp word [0x458ad0], ax
cmove esi, eax
test esi, esi
je 0x41c8fc
movzx eax, word [esi]
xor ecx, ecx
mov edx, eax
test ax, ax
je 0x41c7db
mov eax, esi
xor ebx, ebx
add eax, 2
lea ecx, [ecx + 1]
cmp dx, 0x5c
movzx edx, word [esi + ecx*2]
cmovne eax, ebx
mov ebx, eax
lea eax, [esi + ecx*2]
test dx, dx
jne 0x41c7b6
mov dword [ebp - 0xfd0], ebx
test ebx, ebx
jne 0x41c7e6
mov ebx, str.msedge.exe
mov dword [ebp - 0xfd0], ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
xor esi, esi
mov dword [0x4522d4], 0xffffffff
mov edi, eax
cmp word [0x450da0], si
je 0x41c850
mov ecx, 0x450da0
nop dword [eax + eax]
mov edx, dword [ebp - 0xfd0]
push edi
call fcn.00403e60
add esp, 4
test eax, eax
je 0x41c841
inc esi
mov eax, esi
shl eax, 7
cmp word [eax + 0x450da0], 0
lea ecx, [eax + 0x450da0]
jne 0x41c810
mov esi, dword [0x4522d4]
jmp 0x41c847
mov dword [0x4522d4], esi
cmp esi, 0xffffffff
jne 0x41c902
push str.msedge.exe
call ebx
xor esi, esi
mov dword [0x4522d4], 0xffffffff
mov edi, eax
cmp word [0x450da0], si
je 0x41c8ae
mov ecx, 0x450da0
push edi
mov edx, str.msedge.exe
call fcn.00403e60
add esp, 4
test eax, eax
je 0x41c8a3
inc esi
mov eax, esi
shl eax, 7
cmp word [eax + 0x450da0], 0
lea ecx, [eax + 0x450da0]
jne 0x41c873
mov esi, dword [0x4522d4]
jmp 0x41c8a9
mov dword [0x4522d4], esi
cmp esi, 0xffffffff
jne 0x41c902
push str.iexplore.exe
call ebx
or esi, 0xffffffff
xor edi, edi
mov ebx, eax
mov dword [0x4522d4], esi
cmp word [0x450da0], di
je 0x41c902
mov ecx, 0x450da0
push ebx
mov edx, str.iexplore.exe
call fcn.00403e60
add esp, 4
test eax, eax
je 0x41ca31
inc edi
mov eax, edi
shl eax, 7
cmp word [eax + 0x450da0], 0
lea ecx, [eax + 0x450da0]
jne 0x41c8d0
mov esi, dword [0x4522d4]
mov ecx, esi
shl ecx, 7
lea eax, [ecx + 0x450da0]
push eax
lea eax, [ecx + 0x4512a0]
push eax
push esi
push str.__tWinMain__________________DefaultBrowser_________________d___s_:__s_
call fcn.00403840
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x6a0]
push str.parsercommon.data
push 0x4519f8
push 0x42f890
push eax
call ebx
add esp, 0x20
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xfcc], eax
cmp esi, 0xffffffff
je 0x41c99b
push 0x452c10
mov edx, 0x310
lea ecx, [ebp - 0x6a0]
call fcn.00403ab0
add esp, 4
test eax, eax
js 0x41c9a8
mov eax, dword [0x452c18]
mov dword [0x4522d4], eax
mov eax, dword [0x452c1c]
mov dword [0x43e8f0], eax
mov eax, dword [0x452c14]
mov dword [0x4522d0], eax
cmp byte [0x452c10], 0
jne 0x41ca90
mov eax, dword [0x4522d0]
xor esi, esi
push esi
push 0x80
push 2
mov dword [0x452c14], eax
mov eax, dword [0x4522d4]
push esi
mov dword [0x452c18], eax
mov eax, dword [0x43e8f0]
push 1
mov dword [0x452c1c], eax
lea eax, [ebp - 0x6a0]
push 0x40000000
push eax
mov dword [0x452c10], 0x3030909
mov word [0x452c20], 0
mov byte [0x452c22], 0
mov byte [0x452c24], 0
mov dword [ebp - 0xfd0], esi
mov dword [ebp - 0xffc], 0xffffffff
mov dword [ebp - 0xff8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41ca3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41ca89
mov esi, edi
mov dword [0x4522d4], esi
jmp 0x41c902
push 0
lea eax, [ebp - 0xffc]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea eax, [ebp - 0xfd0]
push eax
push 0x310
push 0x452c10
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41ca7a
cmp dword [ebp - 0xfd0], 0x310
je 0x41ca82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x4517b8], eax
test eax, eax
je 0x41caee
mov edi, dword [sym.imp.USER32.dll_LoadImageW]
mov esi, 0x99
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
nop word [eax + eax]
push 0
push 0x10
push 0x10
push 1
movzx eax, si
push eax
push dword [0x4522e8]
call edi
push eax
push 0xffffffffffffffff
push dword [0x4517b8]
call ebx
inc esi
cmp esi, 0xb5
jle 0x41cac0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
push dword [0x4522e8]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4000
push 0x2b4
mov dword [0x4517bc], eax
lea eax, [ebp - 0xfc8]
push eax
push 0
push 0x439a68
call esi
push 0x4001
push 0x2b4
lea eax, [ebp - 0xfc8]
push eax
push 0
push 0x439a68
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RICHED20.DLL
call esi
push str.HHCTRL.OCX
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41cb79
push str.HtmlHelpW
push eax
call edi
mov dword [0x4517a0], eax
push str.imm32.dll
call esi
test eax, eax
je 0x41cb91
push str.ImmAssociateContext
push eax
call edi
mov dword [0x4517a4], eax
push dword [0x43e8d8]
push dword [0x43e8dc]
push dword [0x43e8e0]
push dword [0x43e8e4]
push dword [0x43e8d4]
push 0
push str.__tWinMain______________Run_____IDD_PARSER_BASE_____1______d___d:_d:_d:_d:_d_
call fcn.00403840
add esp, 0x1c
mov dword [ebp - 0xffc], 8
lea eax, [ebp - 0xffc]
mov dword [ebp - 0xff8], 0x3ff
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x8d
push dword [0x4522e8]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
push 0x4184f0
push 0
push 0x259
push dword [0x4522e8]
mov dword [0x452b74], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push dword [0x43e8d8]
mov dword [0x4522f0], 0
push dword [0x43e8dc]
mov dword [0x4522d8], 0
push dword [0x43e8e0]
push dword [0x43e8e4]
push dword [0x43e8d4]
push 0
push str.__tWinMain______________End_____parserSearchThread__1______d___d:_d:_d:_d:_d_
call fcn.00403840
add esp, 0x1c
push 2
call fcn.004049e0
push 0
push str.__tWinMain______________End_____parserSearchThread__2______d_
call fcn.00403840
push 0x4519f8
lea eax, [ebp - 0x6a0]
push str._slist.txt
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0xfec]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [0x452b8c]
test eax, eax
je 0x41ccbc
push 0x1388
push eax
call esi
push dword [0x452b8c]
call edi
xor ecx, ecx
call fcn.0040c020
push str.sitelink.txt
push 0x4519f8
lea eax, [ebp - 0x6a0]
push 0x42f890
push eax
call ebx
add esp, 0x10
mov dword [ebp - 0xff0], 0xffffffff
xor esi, esi
mov dword [ebp - 0xfec], 0xffffffff
lea eax, [ebp - 0x6a0]
mov dword [ebp - 0xfe0], esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41cd2a
or edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41cd8b
push 0
lea eax, [ebp - 0xff0]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea eax, [ebp - 0xfe0]
push eax
push 0x5460
push 0x452f20
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd67
lea edi, [eax - 3]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41cd84
cmp dword [ebp - 0xfe0], 0x5460
je 0x41cd82
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41cd84
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.__tWinMain__________________SITE_CHECKST_FILE______________d___d___s_
call fcn.00403840
add esp, 0x10
jmp 0x41bbcd
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
je 0x41cdd3
push 0x439d28
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d046
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d046
cmp ebx, 0x3e9
ja 0x41ceee
je 0x41ceaf
mov eax, ebx
sub eax, 0x3e0
je 0x41ce7e
sub eax, 1
je 0x41ce3e
sub eax, 1
jne case.default.0x41cf0f
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
je 0x41ce2d
push 0x439fe8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d041
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d041
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push dword [ebp - 0xfcc]
push edi
je 0x41ce69
push 0x439f20
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0x10
jmp 0x41d041
push str.OS_state_is_unstable___d_:__d_
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0x10
jmp 0x41d041
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
je 0x41ce9e
push 0x439e28
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d046
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41d046
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push dword [0x43e8c8]
je 0x41ced9
push 0x43a0c8
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
cmp ebx, 0x270d
ja 0x41d002
je 0x41d015
lea eax, [ebx - 0x3ea]
cmp eax, 3
ja case.default.0x41cf0f
jmp dword [eax*4 + 0x41d0d4]
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push dword [0x43e8c8]
je 0x41cf40
push 0x43a2c8
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push dword [0x43e8c8]
je 0x41cf7f
push 0x43a4c8
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push edi
je 0x41cfb9
push 0x43a6c8
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push edi
je 0x41cff0
push 0x43a8c8
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
jmp 0x41d046
cmp ebx, 0x270e
je 0x41d015
xor eax, eax
mov word [ebp - 0x6a0], ax
jmp 0x41d06a
cmp dword [0x458ac8], 0
lea eax, [ebp - 0x6a0]
push dword [ebp - 0xfcc]
je 0x41d031
push 0x43aac8
jmp 0x41d036
push str.Multiple_Programs_cannot_be_started.___d_
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
mov esi, 0x30
cmp word [ebp - 0x6a0], 0
je 0x41d06a
push esi
push 0x4383e8
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.__tWinMain__________________End__________
call fcn.00403840
add esp, 4
push dword [ebp - 0xfcc]
push edi
push ebx
push str.__tWinMain__________________fcret__________________________d_:__d___d_
call fcn.00403840
push 0x438f98
call fcn.00403840
mov eax, dword [0x43e8f4]
add esp, 0x14
cmp eax, 0xffffffff
je 0x41d0b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x43e8f4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d3d1
mov esp, ebp
pop ebp
ret 0x10