Function at 0x4251ed
Capabilities:
Modify service
Persist via run registry key
Start service
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0x2d4]
sub esp, 0x354
mov eax, dword [0x4755d0]
xor eax, ebp
mov dword [ebp + 0x2d0], eax
mov eax, dword [ebp + 0x2e0]
push ebx
mov ebx, dword [ebp + 0x2dc]
push esi
push edi
mov esi, 0x103
push esi
mov dword [ebp - 0x74], eax
xor edi, edi
lea eax, [ebp + 0x1cd]
push edi
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp + 0x1cc], 0
call fcn.00448090
push esi
lea eax, [ebp + 0xc9]
push edi
push eax
mov byte [ebp + 0xc8], 0
call fcn.00448090
push esi
lea eax, [ebp - 0x3b]
push edi
push eax
mov byte [ebp - 0x3c], 0
call fcn.00448090
add esp, 0x24
push 6
pop ecx
xor eax, eax
lea esi, [ebx*4 + 0x478a70]
mov ebx, dword [ebp - 0x74]
push eax
imul ebx, ebx, 0xf54
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x80], edi
push dword [ebp - 0x70]
mov dword [ebp - 0x58], edi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push dword [ebx + eax + 0x50]
mov dword [ebp - 0x60], ebx
call fcn.0043b804
mov eax, dword [0x47c474]
mov edi, str.AutoRun
test eax, eax
je 0x4252a9
cmp byte [eax], 0
jne 0x4252d6
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4252d6
mov eax, dword [0x478a40]
test eax, eax
je 0x4252cf
push str.No_program_name_or_command_line_provided
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x4263dd
mov eax, dword [esi]
add eax, ebx
push str.Send
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42535d
mov eax, dword [esi]
add eax, ebx
push str.Command
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42535d
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push dword [ebx + eax + 0x50]
call fcn.0043b804
cmp dword [0x4771e8], edi
jne 0x425333
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4771e8], eax
push edi
push dword [0x47c474]
call fcn.0040109c
pop ecx
movzx eax, ax
push eax
push 0x111
push dword [0x4771e8]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
jmp 0x4263dd
mov eax, dword [esi]
add eax, ebx
push 0x461d78
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425479
xor edi, edi
cmp dword [ebp + 0x2e4], edi
jne 0x4253a5
mov eax, dword [ebp - 0x70]
shl eax, 0x14
add eax, dword [ebp - 0x74]
push eax
push 0x280d8
push 0x111
push dword [0x4771a0]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4263dd
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
mov byte [ebp + 0x1cc], 0
cmp eax, edi
je 0x4253ed
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push eax
call fcn.0043b804
push 0x103
lea eax, [ebp + 0x1cc]
push eax
mov eax, dword [ebp - 0x70]
imul eax, eax, 0x104
add eax, 0x4775d8
push eax
push dword [0x47c474]
call fcn.0041030b
mov eax, dword [esi]
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push dword [ebx + eax + 0x50]
call fcn.0043b804
mov eax, dword [esi]
push 1
lea eax, [ebx + eax + 0x58]
push str.cdecl
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
push eax
push dword [0x47c474]
lea eax, [ebp + 0x1cc]
push eax
call fcn.00421d6e
mov esi, eax
cmp esi, 0x69f6f36
je 0x4252cf
push esi
lea eax, [ebp - 0x3c]
push 0x45cb18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.004245b3
cmp esi, 1
jl 0x425355
mov eax, esi
jmp 0x4263dd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x42574f
lea eax, [ebx + eax + 0x58]
push 0x461d6c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4254da
push 4
lea eax, [ebp + 0x1cc]
push eax
push dword [0x47c474]
call fcn.0040eb69
push dword [0x47c474]
lea eax, [ebp + 0x1cc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0
call fcn.004201ca
add esp, 0x10
jmp 0x425355
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Remove
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425615
and dword [ebp - 0x5c], 0
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
xor eax, eax
cmp dword [ebp - 0x5c], eax
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
and dword [ebp - 0x64], 0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x5c], 2
jge 0x4255de
push 2
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp - 0x60]
call fcn.00440a1b
mov dword [ebp - 0x68], eax
test eax, eax
je 0x4255d1
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.00420158
lea eax, [ebp + 0x1cc]
push eax
push dword [0x47c474]
call fcn.004010ff
add esp, 0x18
test eax, eax
jne 0x42559b
lea eax, [ebp + 0xc8]
push eax
push dword [0x47c474]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42559b
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x461d30
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4255d1
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.004011fc
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x461d30
push eax
call fcn.004010ff
add esp, 0x14
test eax, eax
jne 0x4255ce
push 0x63
pop eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x5c], eax
jmp 0x4255d1
dec dword [ebp - 0x64]
inc dword [ebp - 0x64]
cmp dword [ebp - 0x68], 0
jne 0x425512
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x4254fe
cmp dword [ebp - 0x5c], 0x63
jge 0x425355
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x461d30
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x425355
jmp 0x4252cf
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.List
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4252cf
mov eax, dword [0x47c474]
test eax, eax
je 0x425640
push eax
call fcn.00447ab6
pop ecx
push 1
push 0x100000
call fcn.00447e84
and dword [ebp - 0x5c], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
mov dword [0x47c474], eax
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
xor eax, eax
cmp dword [ebp - 0x5c], eax
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
and dword [ebp - 0x64], 0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x5c], 2
jge 0x42571f
push dword [0x47c474]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff00
jge 0x42571f
push 2
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp - 0x60]
call fcn.00440a1b
mov ebx, eax
test ebx, ebx
je 0x425714
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.00420158
mov eax, dword [0x47c474]
add esp, 0x10
test eax, eax
je 0x425714
lea ecx, [ebp + 0x1cc]
push ecx
push eax
call esi
mov eax, dword [0x47c474]
test eax, eax
je 0x425714
push 0x45deb8
push eax
call esi
mov eax, dword [0x47c474]
test eax, eax
je 0x425714
lea ecx, [ebp + 0xc8]
push ecx
push eax
call esi
mov eax, dword [0x47c474]
test eax, eax
je 0x425714
push 0x45e620
push eax
call esi
inc dword [ebp - 0x64]
test ebx, ebx
jne 0x425676
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x425662
push dword [0x47c474]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x47c474]
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.004245b3
jmp 0x425355
add eax, ebx
push str.KILL
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4257b7
push 2
xor esi, esi
push esi
push esi
push esi
push 2
push dword [0x47c474]
call fcn.0044489e
cmp eax, esi
jne 0x425355
push 1
push esi
push esi
push esi
push 2
push dword [0x47c474]
call fcn.0044489e
cmp eax, esi
jne 0x425355
push dword [0x47c474]
push str.Unable_to_find_process__s
push dword [0x478a40]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4252cf
mov eax, dword [esi]
add eax, ebx
push str.Control_Panel
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x425aa3
push str.System
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425829
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_sysdm.cpl
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
push str.Advanced
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a8c
push 0x461cc0
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x425a8c
mov eax, dword [esi]
push str.Add_Remove_Programs
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425849
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_appwiz.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Internet
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425869
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_inetcpl.cpl_0
jmp 0x425a7f
mov eax, dword [esi]
push str.Device_Manager
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425889
push str.rundll32.exe_DevMgr.dll_DeviceManager_ExecuteA
jmp 0x425a7f
mov eax, dword [esi]
push str.Display
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4258a9
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_desk.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Time_Date
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4258c9
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_timedate.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Regional
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4258e9
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_intl.cpl_0
jmp 0x425a7f
mov eax, dword [esi]
push str.Keyboard
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425909
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__1
jmp 0x425a7f
mov eax, dword [esi]
push str.Game_Controllers
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425929
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_joy.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Mouse
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425949
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__0
jmp 0x425a7f
mov eax, dword [esi]
push str.Power
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425969
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_powercfg.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Sounds
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425989
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_mmsys.cpl_0
jmp 0x425a7f
mov eax, dword [esi]
push str.Network
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4259a9
push str.control.exe_netconnections
jmp 0x425a7f
mov eax, dword [esi]
push str.Ease_of_Access
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4259c9
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_access.cpl
jmp 0x425a7f
mov eax, dword [esi]
push str.Admin
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4259e9
push str.control.exe_admintools
jmp 0x425a7f
mov eax, dword [esi]
push str.Phone
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a06
push str.control.exe_telephony
jmp 0x425a7f
mov eax, dword [esi]
push str.Scheduled
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a23
push str.control.exe_schedtasks
jmp 0x425a7f
mov eax, dword [esi]
push str.User
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a40
push str.control.exe_userpasswords
jmp 0x425a7f
mov eax, dword [esi]
push str.Fonts
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a5d
push str.control.exe_fonts
jmp 0x425a7f
mov eax, dword [esi]
push str.Appearance
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425a7a
push str.control.exe_color
jmp 0x425a7f
push str.control.exe
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push 0
push 1
lea eax, [ebp + 0x1cc]
push eax
call fcn.00443b3f
jmp 0x4263dd
add eax, ebx
push str.Service
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425c6f
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x60], eax
cmp eax, edi
jne 0x425af6
push edi
push 0x7ff
push dword [0x478a40]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
jmp 0x4252cf
mov eax, dword [esi]
add eax, ebx
push str.Startup
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425b0f
push 2
jmp 0x425b11
push 0x30
push dword [0x47c474]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x64], eax
cmp eax, edi
jne 0x425b59
push edi
push 0x7ff
push dword [0x478a40]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4252cf
mov eax, dword [esi]
add eax, ebx
push str.Startup
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x425bee
lea eax, [ebx + eax + 0x364]
push str.Automatic
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425b95
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
jmp 0x425be1
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
push str.Manual
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425bbc
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 3
jmp 0x425be1
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
push str.Disabled
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425c36
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
jmp 0x425c32
add eax, ebx
push 0x45d398
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425c0e
push edi
push edi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x425c32
mov eax, dword [esi]
add eax, ebx
push str.Stop
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425c36
lea eax, [ebp - 0x58]
push eax
push 1
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, edi
jne 0x425c6a
push edi
push 0x7ff
push dword [0x478a40]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x4263dd
xor edi, edi
inc edi
jmp 0x425c5a
push dword [0x47c474]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
add eax, 0x100000
mov dword [ebp - 0x68], eax
cmp eax, 0x1000
jg 0x425c91
mov eax, 0x1000
push 1
push eax
call fcn.00447e84
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x4252cf
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x68]
imul eax, eax, 0x104
add ecx, 0xfffffc00
push ecx
push dword [ebp - 0x5c]
lea eax, [eax + 0x4775d8]
push eax
push dword [0x47c474]
mov dword [ebp - 0x6c], eax
call fcn.0041030b
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425cf9
push str..EXE
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425d40
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426158
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426158
push str..EXE
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426158
push dword [ebp - 0x5c]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x425d76
mov eax, dword [0x478a40]
test eax, eax
je 0x425d65
push str.A_script_cannot_call_itself__it_would_cause_an_endless_loop_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
push dword [ebp - 0x5c]
call fcn.00447ab6
mov eax, esi
jmp 0x4263dc
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x22
je 0x425d8b
push 0x45ddf8
push 0
push eax
call fcn.00441ac4
push dword [ebp - 0x5c]
call edi
mov ecx, dword [ebp - 0x5c]
cmp byte [eax + ecx - 1], 0x22
je 0x425da6
push 0x45ddf8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x103
lea eax, [ebp + 0x1cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1cc]
push 0x45ddf8
push eax
call fcn.00447a30
pop ecx
test eax, eax
pop ecx
lea eax, [ebp + 0x1cc]
jne 0x425e05
push 0x45ddf8
push 0
push eax
call fcn.00441ac4
push str.___r
lea eax, [ebp + 0x1cc]
jmp 0x425e0a
push str.__r
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1cc]
push eax
push 0
push dword [ebp - 0x5c]
call fcn.00441ac4
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
test eax, eax
je 0x426158
push str.__s
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x74]
lea eax, [ebx + eax + 0x364]
push dword [ebp - 0x70]
push eax
call fcn.0043b804
mov eax, dword [0x47c474]
test eax, eax
je 0x425e84
push str.0123456789
push eax
call fcn.00449d20
pop ecx
pop ecx
push dword [0x47c474]
mov ebx, eax
call edi
cmp ebx, eax
mov ebx, dword [ebp - 0x60]
sbb eax, eax
inc eax
jmp 0x425e86
xor eax, eax
test eax, eax
je 0x425e9e
push dword [0x47c474]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x426158
lea eax, [ebp - 0x3c]
push eax
call fcn.0040e912
mov dword [ebp - 0x6c], eax
add eax, 0x100
cmp eax, 0x1000
ja 0x425ebb
mov eax, 0x1000
push 1
push eax
call fcn.00447e84
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
test eax, eax
je 0x426158
push dword [0x47c474]
lea eax, [ebp + 0xc8]
push str._action_Label__action__text__s__text_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x6c]
lea eax, [ebp - 0x3c]
push dword [ebp - 0x64]
push 0
push eax
call fcn.0040e78f
push str.__r_n
call edi
push 0x45c970
mov dword [ebp - 0x7c], eax
call edi
push str.__r_n
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x425f7e
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x7c]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x68]
call fcn.00448130
push dword [ebp - 0x6c]
push 0x45c970
push dword [ebp - 0x60]
call fcn.00447af0
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x425f74
push str.__r_n
push dword [ebp - 0x68]
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x425f78
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x425f26
push 0x45e680
call edi
push 0x45c970
mov dword [ebp - 0x78], eax
call edi
push 0x45e680
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x426000
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00448130
push dword [ebp - 0x6c]
push 0x45c970
push dword [ebp - 0x60]
call fcn.00447af0
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x425ff6
push 0x45e680
push dword [ebp - 0x68]
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x425ffa
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x425fa8
push 0x45c848
call edi
push 0x45c970
mov dword [ebp - 0x78], eax
call edi
push 0x45c848
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x426082
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00448130
push dword [ebp - 0x6c]
push 0x45c970
push dword [ebp - 0x60]
call fcn.00447af0
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x426078
push 0x45c848
push dword [ebp - 0x68]
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x42607c
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x42602a
push 0x45c850
call edi
push 0x45c970
mov dword [ebp - 0x78], eax
call edi
push 0x45c850
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x426104
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00448130
push dword [ebp - 0x6c]
push 0x45c970
push dword [ebp - 0x60]
call fcn.00447af0
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x4260fa
push 0x45c850
push dword [ebp - 0x68]
call fcn.00447a30
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x4260fe
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x4260ac
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x64]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42614f
push str._step
push dword [ebp - 0x64]
mov byte [eax], 0
call fcn.004415b1
push eax
lea eax, [ebp + 0xc8]
push 0x45cb18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x64]
call fcn.00447ab6
pop ecx
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426184
cmp byte [0x47b0e0], 2
jb 0x426184
push str.__L
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esi]
cmp dword [ebx + eax + 0xf28], 1
jg 0x4261e2
push dword [ebp - 0x5c]
call edi
inc eax
cmp eax, 0x103
jle 0x4261a4
mov eax, 0x103
jmp 0x4261aa
push dword [ebp - 0x5c]
call edi
inc eax
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 4
push 0x4616bc
lea eax, [ebp + 0x2ca]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp + 0x1cc]
push eax
push str.____Translated_run_buffer:___s_
call fcn.00421b06
pop ecx
pop ecx
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Single
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42627d
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42627d
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42627d
push 2
lea ecx, [ebp - 0x80]
push ecx
push eax
push eax
push 1
push dword [ebp - 0x5c]
mov dword [ebp - 0x80], eax
call fcn.0044489e
test eax, eax
jne 0x426256
push 1
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 1
push dword [ebp - 0x5c]
call fcn.0044489e
cmp dword [ebp - 0x80], 0
je 0x42627d
push dword [ebp - 0x5c]
push str.____Found_existing_program_already_running___Activating___s_
call fcn.00421b06
pop ecx
pop ecx
push 0
push dword [ebp - 0x80]
call fcn.00442631
xor esi, esi
inc esi
jmp 0x425d67
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4262f0
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4262f0
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4262d7
push str.vTask.exe
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4262d7
xor al, al
jmp 0x4262d9
mov al, 1
push 1
movzx eax, al
push 0
push eax
push dword [ebp - 0x5c]
call fcn.00443b3f
mov edi, eax
jmp 0x4263c8
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x74]
lea eax, [ebx + eax + 0x15c]
push dword [ebp - 0x70]
push eax
call fcn.0043b804
push 0
push 0
push dword [0x47c474]
call fcn.00419f2c
fld st(0)
fldz
add esp, 0xc
fucompp
fnstsw ax
test ah, 0x44
jp 0x426330
fstp st(0)
fld qword [0x461780]
push 1
call fcn.00449ec0
imul eax, eax, 0x3e8
push eax
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.00443b3f
cmp eax, 0xffffcfc4
jne 0x426388
mov eax, dword [esi]
lea eax, [ebx + eax + 0x15c]
push eax
push str.Program_still_running_after_timeout_limit_of__s_seconds
push dword [0x478a40]
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4263c8
cmp eax, 0xffffcfc3
jne 0x426393
xor edi, edi
jmp 0x4263c8
push eax
lea eax, [ebp + 0x1cc]
push 0x45cb18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x1cc]
push eax
call edi
push eax
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.004245b3
xor edi, edi
inc edi
push dword [ebp - 0x5c]
call fcn.00447ab6
lea eax, [edi + 0x303d]
neg eax
sbb eax, eax
and eax, edi
pop ecx
mov ecx, dword [ebp + 0x2d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448080
add ebp, 0x2d4
leave
ret 0xc