Function at 0x401dee
Capabilities:
Get common file path

Disassembly:
mov eax, 0x420142
call fcn.00412d4c
sub esp, 0xe34
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
and eax, 0xffffff
mov dword [esp + 0x1c], eax
call fcn.00404672
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 3
pop esi
cmp eax, esi
jae 0x401e30
lea eax, [esp + 0x208]
push eax
push 0x104
call ebp
mov ebx, dword [esp + 0xe58]
test bl, 1
je 0x4024dc
test byte [edi], 1
jne 0x4024dc
lea eax, [esp + 0x100]
push str._:text:KERNEL32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
and dword [esp + 0xe4c], 0
cmp dword [eax + 0x14], 0x10
jb 0x401e6d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [edi + 8], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x100]
call fcn.004015cc
test esi, esi
je 0x4024dc
push str._:hash:CreateFileA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:CreateFileMappingA
push dword [edi + 8]
mov dword [edi + 0x54], eax
call fcn.0040652a
push str._:hash:CreateFileMappingW
push dword [edi + 8]
mov dword [edi + 0x58], eax
call fcn.0040652a
push str._:hash:CreateFileW
push dword [edi + 8]
mov dword [edi + 0x5c], eax
call fcn.0040652a
push str._:hash:CreateProcessA
push dword [edi + 8]
mov dword [edi + 0x60], eax
call fcn.0040652a
push str._:hash:CreateProcessW
push dword [edi + 8]
mov dword [edi + 0x64], eax
call fcn.0040652a
push str._:hash:CreateRemoteThread
push dword [edi + 8]
mov dword [edi + 0x68], eax
call fcn.0040652a
push str._:hash:CreateToolhelp32Snapshot
push dword [edi + 8]
mov dword [edi + 0x6c], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x70], eax
push str._:hash:ExpandEnvironmentStringsA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:ExpandEnvironmentStringsW
push dword [edi + 8]
mov dword [edi + 0x74], eax
call fcn.0040652a
push str._:hash:FindFirstFileA
push dword [edi + 8]
mov dword [edi + 0x78], eax
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0x7c], eax
call fcn.00404672
push 3
pop esi
cmp eax, esi
jae 0x401f6a
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:FindFirstFileW
push dword [edi + 8]
call fcn.0040652a
push str._:hash:FindNextFileA
push dword [edi + 8]
mov dword [edi + 0x80], eax
call fcn.0040652a
push str._:hash:FindNextFileW
push dword [edi + 8]
mov dword [edi + 0x84], eax
call fcn.0040652a
push str._:hash:FlushInstructionCache
push dword [edi + 8]
mov dword [edi + 0x88], eax
call fcn.0040652a
push str._:hash:GetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x8c], eax
call fcn.0040652a
push str._:hash:GetCurrentConsoleFontEx
push dword [edi + 8]
mov dword [edi + 0x90], eax
call fcn.0040652a
push str._:hash:GetEnvironmentVariableA
push dword [edi + 8]
mov dword [edi + 0x94], eax
call fcn.0040652a
push str._:hash:GetEnvironmentVariableW
push dword [edi + 8]
mov dword [edi + 0x98], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x9c], eax
push str._:hash:GetExitCodeProcess
push dword [edi + 8]
call fcn.0040652a
push str._:hash:GetFullPathNameA
push dword [edi + 8]
mov dword [edi + 0xa0], eax
call fcn.0040652a
push str._:hash:GetFullPathNameW
push dword [edi + 8]
mov dword [edi + 0xa4], eax
call fcn.0040652a
push str._:hash:GetLogicalDriveStringsA
push dword [edi + 8]
mov dword [edi + 0xa8], eax
call fcn.0040652a
push str._:hash:GetLogicalDriveStringsW
push dword [edi + 8]
mov dword [edi + 0xac], eax
call fcn.0040652a
push str._:hash:GetModuleFileNameA
push dword [edi + 8]
mov dword [edi + 0xb0], eax
call fcn.0040652a
push str._:hash:GetModuleFileNameW
push dword [edi + 8]
mov dword [edi + 0xb4], eax
call fcn.0040652a
push str._:hash:GetModuleHandleA
push dword [edi + 8]
mov dword [edi + 0xb8], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0xbc], eax
call fcn.00404672
cmp eax, esi
jae 0x4020c6
push str.Global596
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4020c6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetModuleHandleExA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:GetModuleHandleExW
push dword [edi + 8]
mov dword [edi + 0xc0], eax
call fcn.0040652a
push str._:hash:GetModuleHandleW
push dword [edi + 8]
mov dword [edi + 0xc4], eax
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0xc8], eax
call fcn.00404672
cmp eax, esi
jae 0x402128
push str.Global179
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x402128
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetSystemWow64DirectoryA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:GetSystemWow64DirectoryW
push dword [edi + 8]
mov dword [edi + 0xcc], eax
call fcn.0040652a
push str._:hash:GetTickCount64
push dword [edi + 8]
mov dword [edi + 0xd0], eax
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0xd4], eax
call fcn.00404672
cmp eax, esi
jae 0x402189
push str.Local183
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x402189
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:GetVersionExA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:GetVersionExW
push dword [edi + 8]
mov dword [edi + 0xd8], eax
call fcn.0040652a
push str._:hash:GetVolumeInformationA
push dword [edi + 8]
mov dword [edi + 0xdc], eax
call fcn.0040652a
push str._:hash:GetVolumeInformationW
push dword [edi + 8]
mov dword [edi + 0xe0], eax
call fcn.0040652a
push str._:hash:IsBadReadPtr
push dword [edi + 8]
mov dword [edi + 0xe4], eax
call fcn.0040652a
push str._:hash:IsBadWritePtr
push dword [edi + 8]
mov dword [edi + 0xe8], eax
call fcn.0040652a
push str._:hash:IsWow64Process
push dword [edi + 8]
mov dword [edi + 0xec], eax
call fcn.0040652a
push str._:hash:LoadLibraryA
push dword [edi + 8]
mov dword [edi + 0xf0], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0xf4], eax
push str._:hash:LoadLibraryW
push dword [edi + 8]
call fcn.0040652a
push str._:hash:MapViewOfFile
push dword [edi + 8]
mov dword [edi + 0xf8], eax
call fcn.0040652a
push str._:hash:Module32First
push dword [edi + 8]
mov dword [edi + 0xfc], eax
call fcn.0040652a
push str._:hash:Module32FirstW
push dword [edi + 8]
mov dword [edi + 0x100], eax
call fcn.0040652a
push str._:hash:Module32Next
push dword [edi + 8]
mov dword [edi + 0x104], eax
call fcn.0040652a
add esp, 0x28
mov dword [edi + 0x108], eax
call fcn.00404672
cmp eax, esi
jae 0x40229e
lea eax, [esp + 0x61c]
push eax
push 0x104
call ebp
push str._:hash:Module32NextW
push dword [edi + 8]
call fcn.0040652a
push str._:hash:OpenFileMappingA
push dword [edi + 8]
mov dword [edi + 0x10c], eax
call fcn.0040652a
push str._:hash:OpenFileMappingW
push dword [edi + 8]
mov dword [edi + 0x110], eax
call fcn.0040652a
push str._:hash:OpenProcess
push dword [edi + 8]
mov dword [edi + 0x114], eax
call fcn.0040652a
push str._:hash:OpenThread
push dword [edi + 8]
mov dword [edi + 0x118], eax
call fcn.0040652a
push str._:hash:Process32First
push dword [edi + 8]
mov dword [edi + 0x11c], eax
call fcn.0040652a
push str._:hash:Process32FirstW
push dword [edi + 8]
mov dword [edi + 0x120], eax
call fcn.0040652a
push str._:hash:Process32Next
push dword [edi + 8]
mov dword [edi + 0x124], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x128], eax
push str._:hash:Process32NextW
push dword [edi + 8]
call fcn.0040652a
push str._:hash:ProcessIdToSessionId
push dword [edi + 8]
mov dword [edi + 0x12c], eax
call fcn.0040652a
push str._:hash:QueryDosDeviceA
push dword [edi + 8]
mov dword [edi + 0x130], eax
call fcn.0040652a
push str._:hash:QueryDosDeviceW
push dword [edi + 8]
mov dword [edi + 0x134], eax
call fcn.0040652a
push str._:hash:ReadProcessMemory
push dword [edi + 8]
mov dword [edi + 0x138], eax
call fcn.0040652a
push str._:hash:SetConsoleScreenBufferInfoEx
push dword [edi + 8]
mov dword [edi + 0x13c], eax
call fcn.0040652a
push str._:hash:SetCurrentConsoleFontEx
push dword [edi + 8]
mov dword [edi + 0x140], eax
call fcn.0040652a
push str._:hash:TerminateProcess
push dword [edi + 8]
mov dword [edi + 0x144], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x148], eax
push str._:hash:VerifyVersionInfoA
push dword [edi + 8]
call fcn.0040652a
push str._:hash:VerifyVersionInfoW
push dword [edi + 8]
mov dword [edi + 0x14c], eax
call fcn.0040652a
push str._:hash:VerSetConditionMask
push dword [edi + 8]
mov dword [edi + 0x150], eax
call fcn.0040652a
push str._:hash:VirtualAlloc
push dword [edi + 8]
mov dword [edi + 0x154], eax
call fcn.0040652a
push str._:hash:VirtualAllocEx
push dword [edi + 8]
mov dword [edi + 0x158], eax
call fcn.0040652a
push str._:hash:VirtualProtect
push dword [edi + 8]
mov dword [edi + 0x15c], eax
call fcn.0040652a
push str._:hash:VirtualProtectEx
push dword [edi + 8]
mov dword [edi + 0x160], eax
call fcn.0040652a
push str._:hash:VirtualQuery
push dword [edi + 8]
mov dword [edi + 0x164], eax
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x168], eax
push str._:hash:WriteProcessMemory
push dword [edi + 8]
call fcn.0040652a
push str._:hash:Wow64DisableWow64FsRedirection
push dword [edi + 8]
mov dword [edi + 0x16c], eax
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x170], eax
call fcn.00404672
cmp eax, esi
jae 0x4024b0
lea eax, [esp + 0xa30]
push eax
push 0x104
call ebp
push str._:hash:Wow64RevertWow64FsRedirection
push dword [edi + 8]
call fcn.0040652a
push str._:hash:WTSGetActiveConsoleSessionId
push dword [edi + 8]
mov dword [edi + 0x174], eax
call fcn.0040652a
add esp, 0x10
or dword [edi], 1
mov dword [edi + 0x178], eax
test bl, 2
je 0x402b00
test byte [edi], 2
jne 0x402b00
lea eax, [esp + 0x1c0]
push str._:text:ADVAPI32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 1
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0xc], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x1c0]
call fcn.004015cc
test esi, esi
je 0x402b00
push str._:hash:AccessCheck
push dword [edi + 0xc]
call fcn.0040652a
push str._:hash:AdjustTokenPrivileges
push dword [edi + 0xc]
mov dword [edi + 0x17c], eax
call fcn.0040652a
push str._:hash:AllocateAndInitializeSid
push dword [edi + 0xc]
mov dword [edi + 0x180], eax
call fcn.0040652a
push str._:hash:ChangeServiceConfigA
push dword [edi + 0xc]
mov dword [edi + 0x184], eax
call fcn.0040652a
push str._:hash:ChangeServiceConfigW
push dword [edi + 0xc]
mov dword [edi + 0x188], eax
call fcn.0040652a
push str._:hash:CheckTokenMembership
push dword [edi + 0xc]
mov dword [edi + 0x18c], eax
call fcn.0040652a
push str._:hash:CloseServiceHandle
push dword [edi + 0xc]
mov dword [edi + 0x190], eax
call fcn.0040652a
add esp, 0x38
mov dword [edi + 0x194], eax
call fcn.00404672
push 3
pop ebp
xor esi, esi
cmp eax, ebp
jae 0x4025e8
push str.Global12
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4025e8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:ControlService
push dword [edi + 0xc]
call fcn.0040652a
push str._:hash:ConvertSidToStringSidA
push dword [edi + 0xc]
mov dword [edi + 0x198], eax
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x19c], eax
call fcn.00404672
cmp eax, ebp
jae 0x402629
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:ConvertSidToStringSidW
push dword [edi + 0xc]
call fcn.0040652a
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorA
push dword [edi + 0xc]
mov dword [edi + 0x1a0], eax
call fcn.0040652a
push str._:hash:ConvertStringSecurityDescriptorToSecurityDescriptorW
push dword [edi + 0xc]
mov dword [edi + 0x1a4], eax
call fcn.0040652a
push str._:hash:ConvertStringSidToSidA
push dword [edi + 0xc]
mov dword [edi + 0x1a8], eax
call fcn.0040652a
add esp, 0x20
mov dword [edi + 0x1ac], eax
call fcn.00404672
cmp eax, ebp
jae 0x402697
push str.296296
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402697
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push str._:hash:ConvertStringSidToSidW
push dword [edi + 0xc]
call fcn.0040652a
push str._:hash:CreateProcessAsUserA
push dword [edi + 0xc]
mov dword [edi + 0x1b0], eax
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x1b4], eax
call fcn.00404672
cmp eax, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
jae 0x4026e2
push esi
push 1
push 1
push esi
call ebp
test eax, eax
je 0x4026e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:CreateProcessAsUserW
push dword [edi + 0xc]
call fcn.0040652a
push str._:hash:CreateServiceA
push dword [edi + 0xc]
mov dword [edi + 0x1b8], eax
call fcn.0040652a
push str._:hash:CreateServiceW
push dword [edi + 0xc]
mov dword [edi + 0x1bc], eax
call fcn.0040652a
push str._:hash:DeleteService
push dword [edi + 0xc]
mov dword [edi + 0x1c0], eax
call fcn.0040652a
push str._:hash:DuplicateToken
push dword [edi + 0xc]
mov dword [edi + 0x1c4], eax
call fcn.0040652a
mov dword [edi + 0x1c8], eax
push str._:hash:DuplicateTokenEx
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1cc], eax
push str._:hash:FreeSid
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1d0], eax
push str._:hash:GetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x1d4], eax
push str._:hash:GetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.0040652a
pop ecx
pop ecx
mov dword [edi + 0x1d8], eax
call fcn.00404672
cmp eax, 3
jae 0x4027ad
push esi
push esi
push esi
push esi
call ebp
test eax, eax
je 0x4027ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetSecurityInfo
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1dc], eax
push str._:hash:GetTokenInformation
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1e0], eax
push str._:hash:GetUserNameA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1e4], eax
push str._:hash:GetUserNameW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1e8], eax
push str._:hash:ImpersonateLoggedOnUser
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1ec], eax
push str._:hash:ImpersonateSelf
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1f0], eax
push str._:hash:InitializeSecurityDescriptor
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x1f4], eax
push str._:hash:IsValidSid
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x1f8], eax
push str._:hash:LookupAccountSidA
push dword [edi + 0xc]
call fcn.0040652a
pop ecx
pop ecx
mov dword [edi + 0x1fc], eax
call fcn.00404672
cmp eax, 3
jae 0x402878
push esi
push esi
push esi
push esi
call ebp
test eax, eax
je 0x402878
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:LookupAccountSidW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x200], eax
push str._:hash:LookupPrivilegeValueA
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x204], eax
call fcn.00404672
cmp eax, 3
jae 0x4028bc
push esi
push esi
push esi
push esi
call ebp
test eax, eax
je 0x4028bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:LookupPrivilegeValueW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x208], eax
push str._:hash:OpenProcessToken
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x20c], eax
push str._:hash:OpenSCManagerA
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0x210], eax
call fcn.00404672
cmp eax, 3
jae 0x402918
push str.863863
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402918
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push str._:hash:OpenSCManagerW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x214], eax
push str._:hash:OpenServiceA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x218], eax
push str._:hash:OpenServiceW
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0x21c], eax
call fcn.00404672
cmp eax, 3
jae 0x402975
push str.Local206
push 1
push 1
push esi
call ebp
test eax, eax
je 0x402975
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:OpenThreadToken
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x220], eax
push str._:hash:QueryServiceStatus
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x224], eax
push str._:hash:RegisterServiceCtrlHandlerA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x228], eax
push str._:hash:RegisterServiceCtrlHandlerW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x22c], eax
push str._:hash:RegDeleteKeyExA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x230], eax
push str._:hash:RegDeleteKeyExW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x234], eax
push str._:hash:RevertToSelf
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x238], eax
push str._:hash:SetEntriesInAclA
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x23c], eax
push str._:hash:SetEntriesInAclW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x240], eax
push str._:hash:SetSecurityDescriptorDacl
push dword [edi + 0xc]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x244], eax
call fcn.00404672
cmp eax, 3
jae 0x402a5a
push str.Local207
push 1
push 1
push esi
call ebp
test eax, eax
je 0x402a5a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str._:hash:SetSecurityDescriptorSacl
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x248], eax
push str._:hash:SetSecurityInfo
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x24c], eax
push str._:hash:SetServiceStatus
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x250], eax
push str._:hash:StartServiceA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x254], eax
push str._:hash:StartServiceCtrlDispatcherA
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x258], eax
push str._:hash:StartServiceCtrlDispatcherW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x25c], eax
push str._:hash:StartServiceW
push dword [edi + 0xc]
call fcn.0040652a
mov dword [edi + 0x260], eax
or dword [edi], 2
add esp, 0x38
call fcn.00404672
xor ebp, ebp
cmp eax, 3
jae 0x402b02
push str.Global310
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x402b02
xor ebp, ebp
test bl, 0x10
je 0x402b76
test byte [edi], 0x10
jne 0x402b76
lea eax, [esp + 0x70]
push str._:text:SECUR32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 2
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x28], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x70]
call fcn.004015cc
test esi, esi
je 0x402b76
push str._:hash:GetUserNameExA
push dword [edi + 0x28]
call fcn.0040652a
mov dword [edi + 0x3c4], eax
push str._:hash:GetUserNameExW
push dword [edi + 0x28]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x3c8], eax
or dword [edi], 0x10
mov eax, 0x400
test eax, ebx
je 0x402d40
test dword [edi], eax
jne 0x402d40
lea eax, [esp + 0x160]
push str._:text:WS2_32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 3
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x10], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x160]
call fcn.004015cc
test esi, esi
je 0x402d40
push str._:hash:WSAStartup
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x264], eax
push str._:hash:WSACleanup
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x268], eax
push str._:hash:WSAGetLastError
push dword [edi + 0x10]
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0x26c], eax
call fcn.00404672
cmp eax, 3
jae 0x402c2f
push str.559559
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x402c2f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push str._:hash:getaddrinfo
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x270], eax
push str._:hash:freeaddrinfo
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x274], eax
push str._:hash:socket
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x278], eax
push str._:hash:connect
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x27c], eax
push str._:hash:send
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x280], eax
push str._:hash:sendto
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x284], eax
push str._:hash:recv
push dword [edi + 0x10]
call fcn.0040652a
add esp, 0x38
mov dword [edi + 0x288], eax
call fcn.00404672
cmp eax, 3
jae 0x402cd8
push ebp
push 1
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x402cd8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:select
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x28c], eax
push str._:hash:shutdown
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x290], eax
push str._:hash:closesocket
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x294], eax
push str._:hash:setsockopt
push dword [edi + 0x10]
call fcn.0040652a
mov dword [edi + 0x298], eax
push str._:hash:htons
push dword [edi + 0x10]
call fcn.0040652a
add esp, 0x28
mov dword [edi + 0x29c], eax
or dword [edi], 0x400
mov eax, 0x800
test eax, ebx
je 0x402ed9
test dword [edi], eax
jne 0x402ed9
lea eax, [esp + 0xa0]
push str._:text:WININET.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 4
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x14], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0xa0]
call fcn.004015cc
test esi, esi
je 0x402ed9
push str._:hash:InternetOpenA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2a0], eax
push str._:hash:InternetOpenW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2a4], eax
push str._:hash:InternetConnectA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2a8], eax
push str._:hash:InternetConnectW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2ac], eax
push str._:hash:HttpOpenRequestA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2b0], eax
push str._:hash:HttpOpenRequestW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2b4], eax
push str._:hash:HttpSendRequestA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2b8], eax
push str._:hash:HttpSendRequestW
push dword [edi + 0x14]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x2bc], eax
push str._:hash:HttpQueryInfoA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2c0], eax
push str._:hash:HttpQueryInfoW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2c4], eax
push str._:hash:InternetCloseHandle
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2c8], eax
push str._:hash:InternetCrackUrlA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2cc], eax
push str._:hash:InternetCrackUrlW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2d0], eax
push str._:hash:InternetSetOptionA
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2d4], eax
push str._:hash:InternetSetOptionW
push dword [edi + 0x14]
call fcn.0040652a
mov dword [edi + 0x2d8], eax
push str._:hash:InternetReadFile
push dword [edi + 0x14]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x2dc], eax
or dword [edi], 0x800
test bl, 4
je 0x40334b
test byte [edi], 4
jne 0x40334b
lea eax, [esp + 0x1f0]
push str._:text:USER32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 5
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x20], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x1f0]
call fcn.004015cc
test esi, esi
je 0x40334b
push str._:hash:AppendMenuW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2e0], eax
push str._:hash:BringWindowToTop
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2e4], eax
push str._:hash:CallNextHookEx
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2e8], eax
push str._:hash:CheckMenuItem
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2ec], eax
push str._:hash:CloseDesktop
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2f0], eax
push str._:hash:CreateDesktopW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2f4], eax
push str._:hash:CreatePopupMenu
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x2f8], eax
push str._:hash:CreateWindowExW
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x2fc], eax
push str._:hash:DefWindowProcW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x300], eax
push str._:hash:DestroyWindow
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x304], eax
push str._:hash:DispatchMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x308], eax
push str._:hash:EnumWindows
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x30c], eax
push str._:hash:FindWindowA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x310], eax
push str._:hash:FindWindowW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x314], eax
push str._:hash:GetClientRect
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x318], eax
push str._:hash:GetCursorPos
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x31c], eax
push str._:hash:GetDesktopWindow
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x320], eax
push str._:hash:GetDlgItem
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x324], eax
push str._:hash:GetLastInputInfo
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x328], eax
push str._:hash:GetMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x32c], eax
push str._:hash:GetParent
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x28
mov dword [edi + 0x330], eax
call fcn.00404672
cmp eax, 3
jae 0x4030eb
push str.461461
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4030eb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push str._:hash:GetSystemMetrics
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x334], eax
push str._:hash:GetThreadDesktop
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x338], eax
push str._:hash:GetWindowRect
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x33c], eax
push str._:hash:GetWindowTextA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x340], eax
push str._:hash:GetWindowTextW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x344], eax
push str._:hash:GetWindowThreadProcessId
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x30
mov dword [edi + 0x348], eax
call fcn.00404672
cmp eax, 3
jae 0x403177
push str.Global230
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:LoadIconW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x34c], eax
push str._:hash:MessageBoxA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x350], eax
push str._:hash:MessageBoxW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x354], eax
push str._:hash:MsgWaitForMultipleObjects
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x358], eax
push str._:hash:PeekMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x35c], eax
push str._:hash:PostMessageA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x360], eax
push str._:hash:PostMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x364], eax
push str._:hash:PostQuitMessage
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x368], eax
push str._:hash:RedrawWindow
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x36c], eax
push str._:hash:RegisterClassExW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x370], eax
push str._:hash:RegisterWindowMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x374], eax
push str._:hash:SendMessageA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x378], eax
push str._:hash:SendMessageW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x37c], eax
push str._:hash:SetFocus
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x380], eax
push str._:hash:SetForegroundWindow
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x384], eax
push str._:hash:SetThreadDesktop
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x388], eax
push str._:hash:SetWindowPos
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x38c], eax
push str._:hash:SetWindowsHookExA
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x390], eax
push str._:hash:SetWindowsHookExW
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x394], eax
push str._:hash:ShowWindow
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x398], eax
push str._:hash:TrackPopupMenu
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x39c], eax
push str._:hash:TranslateMessage
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x3a0], eax
push str._:hash:UnhookWindowsHookEx
push dword [edi + 0x20]
call fcn.0040652a
mov dword [edi + 0x3a4], eax
push str._:hash:UpdateWindow
push dword [edi + 0x20]
call fcn.0040652a
add esp, 0x40
mov dword [edi + 0x3a8], eax
or dword [edi], 4
test bl, 8
je 0x403419
test byte [edi], 8
jne 0x403419
lea eax, [esp + 0xd0]
push str._:text:SHELL32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 6
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x24], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0xd0]
call fcn.004015cc
test esi, esi
je 0x403419
push str._:hash:Shell_NotifyIconW
push dword [edi + 0x24]
call fcn.0040652a
mov dword [edi + 0x3ac], eax
push str._:hash:ShellExecuteExA
push dword [edi + 0x24]
call fcn.0040652a
mov dword [edi + 0x3b0], eax
push str._:hash:ShellExecuteExW
push dword [edi + 0x24]
call fcn.0040652a
mov dword [edi + 0x3b4], eax
push str._:hash:SHGetFolderPathA
push dword [edi + 0x24]
call fcn.0040652a
mov dword [edi + 0x3b8], eax
push str._:hash:SHGetFolderPathW
push dword [edi + 0x24]
call fcn.0040652a
mov dword [edi + 0x3bc], eax
push str._:hash:SHGetKnownFolderPath
push dword [edi + 0x24]
call fcn.0040652a
add esp, 0x30
mov dword [edi + 0x3c0], eax
or dword [edi], 8
test bl, 0x20
je 0x40347f
test byte [edi], 0x20
jne 0x40347f
lea eax, [esp + 0x190]
push str._:text:MSHTML.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 7
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x18], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x190]
call fcn.004015cc
test esi, esi
je 0x40347f
push str._:hash:ShowHTMLDialog
push dword [edi + 0x18]
call fcn.0040652a
pop ecx
mov dword [edi + 0x3cc], eax
or dword [edi], 0x20
pop ecx
test bl, 0x40
je 0x4034f3
test byte [edi], 0x40
jne 0x4034f3
lea eax, [esp + 0x28]
push str._:text:URLMON.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 8
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x1c], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.004015cc
test esi, esi
je 0x4034f3
push str._:hash:CreateURLMoniker
push dword [edi + 0x1c]
call fcn.0040652a
mov dword [edi + 0x3d0], eax
push str._:hash:CreateURLMonikerEx
push dword [edi + 0x1c]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x3d4], eax
or dword [edi], 0x40
test bl, bl
jns 0x40356f
test byte [edi], 0x80
jne 0x40356f
lea eax, [esp + 0x1d8]
push str._:text:GDI32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 9
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x2c], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x1d8]
call fcn.004015cc
test esi, esi
je 0x40356f
push str._:hash:GetStockObject
push dword [edi + 0x2c]
call fcn.0040652a
mov dword [edi + 0x3d8], eax
push str._:hash:CreateFontW
push dword [edi + 0x2c]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x3dc], eax
or dword [edi], 0x80
mov eax, 0x100
test eax, ebx
je 0x4036b6
test dword [edi], eax
jne 0x4036b6
lea eax, [esp + 0x130]
push str._:text:OLE32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xa
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x30], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x130]
call fcn.004015cc
test esi, esi
je 0x4036b6
push str._:hash:CoCreateInstance
push dword [edi + 0x30]
call fcn.0040652a
mov dword [edi + 0x3e0], eax
push str._:hash:CoInitialize
push dword [edi + 0x30]
call fcn.0040652a
mov dword [edi + 0x3e4], eax
push str._:hash:CoInitializeEx
push dword [edi + 0x30]
call fcn.0040652a
add esp, 0x18
mov dword [edi + 0x3e8], eax
call fcn.00404672
cmp eax, 3
jae 0x403627
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x403627
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:CoUninitialize
push dword [edi + 0x30]
call fcn.0040652a
mov dword [edi + 0x3ec], eax
push str._:hash:CoCreateGuid
push dword [edi + 0x30]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x3f0], eax
call fcn.00404672
cmp eax, 3
jae 0x403670
push str.290290
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403670
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00404672
cmp eax, 3
jae 0x403687
push str.Global582
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._:hash:CoTaskMemFree
push dword [edi + 0x30]
call fcn.0040652a
mov dword [edi + 0x3f4], eax
push str._:hash:StringFromGUID2
push dword [edi + 0x30]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x3f8], eax
or dword [edi], 0x100
mov eax, 0x200
test eax, ebx
je 0x4037ad
test dword [edi], eax
jne 0x4037ad
lea eax, [esp + 0x40]
push str._:text:OLEAUT32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xb
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x34], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.004015cc
test esi, esi
je 0x4037ad
push str._:hash:VariantClear
push dword [edi + 0x34]
call fcn.0040652a
mov dword [edi + 0x3fc], eax
push str._:hash:VariantInit
push dword [edi + 0x34]
call fcn.0040652a
mov dword [edi + 0x400], eax
push str._:hash:VariantChangeType
push dword [edi + 0x34]
call fcn.0040652a
mov dword [edi + 0x404], eax
push str._:hash:SysAllocString
push dword [edi + 0x34]
call fcn.0040652a
mov dword [edi + 0x408], eax
push str._:hash:SysFreeString
push dword [edi + 0x34]
call fcn.0040652a
mov dword [edi + 0x40c], eax
or dword [edi], 0x200
add esp, 0x28
call fcn.00404672
cmp eax, 3
jae 0x403794
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x403794
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00404672
cmp eax, 3
jae 0x4037ad
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 0x1000
test eax, ebx
je 0x4038e6
test dword [edi], eax
jne 0x4038e6
lea eax, [esp + 0x58]
push str._:text:VERSION.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xc
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x38], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x58]
call fcn.004015cc
test esi, esi
je 0x4038e6
call fcn.00404672
cmp eax, 3
jae 0x40381d
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push str._:hash:GetFileVersionInfoSizeA
push dword [edi + 0x38]
call fcn.0040652a
mov dword [edi + 0x414], eax
push str._:hash:GetFileVersionInfoSizeW
push dword [edi + 0x38]
call fcn.0040652a
mov dword [edi + 0x418], eax
push str._:hash:GetFileVersionInfoA
push dword [edi + 0x38]
call fcn.0040652a
mov dword [edi + 0x41c], eax
push str._:hash:GetFileVersionInfoW
push dword [edi + 0x38]
call fcn.0040652a
mov dword [edi + 0x420], eax
push str._:hash:VerQueryValueA
push dword [edi + 0x38]
call fcn.0040652a
add esp, 0x28
mov dword [edi + 0x424], eax
call fcn.00404672
cmp eax, 3
jae 0x4038a5
push str.Global534
push ebp
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4038a5
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:VerQueryValueW
push dword [edi + 0x38]
call fcn.0040652a
pop ecx
pop ecx
mov dword [edi + 0x428], eax
call fcn.00404672
cmp eax, 3
jae 0x4038e0
push str.Global471
push ebp
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4038e0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
or dword [edi], 0x1000
mov esi, 0x2000
test esi, ebx
je 0x403a6a
test dword [edi], esi
jne 0x403a6a
lea eax, [esp + 0x88]
push str._:text:PSAPI.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xd
push eax
mov ecx, edi
call fcn.00403e10
test eax, eax
mov dword [edi + 0x3c], eax
sete bl
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x88]
call fcn.004015cc
test bl, bl
je 0x403980
lea eax, [esp + 0xb8]
push str._:text:KERNEL32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xe
push eax
mov ecx, edi
call fcn.00403e10
mov dword [edi + 0x3c], eax
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0xb8]
call fcn.004015cc
cmp dword [edi + 0x3c], 0
je 0x403a63
push str._:hash:EnumProcesses
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x448], eax
push str._:hash:EnumProcessModules
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x44c], eax
push str._:hash:GetProcessMemoryInfo
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x450], eax
push str._:hash:GetModuleBaseNameA
push dword [edi + 0x3c]
call fcn.0040652a
add esp, 0x20
mov dword [edi + 0x454], eax
call fcn.00404672
cmp eax, 3
jae 0x4039ff
push str.Global325
push ebp
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4039ff
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str._:hash:GetModuleBaseNameW
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x458], eax
push str._:hash:GetModuleFileNameExA
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x45c], eax
push str._:hash:GetModuleFileNameExW
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x460], eax
push str._:hash:GetProcessImageFileNameA
push dword [edi + 0x3c]
call fcn.0040652a
mov dword [edi + 0x464], eax
push str._:hash:GetProcessImageFileNameW
push dword [edi + 0x3c]
call fcn.0040652a
add esp, 0x28
mov dword [edi + 0x468], eax
or dword [edi], esi
mov ebx, dword [esp + 0xe58]
mov eax, 0x4000
test eax, ebx
je 0x403b20
test dword [edi], eax
jne 0x403b20
lea eax, [esp + 0xe8]
push str._:text:IPHLPAPI.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0xf
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x40], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.004015cc
test esi, esi
je 0x403b20
call fcn.00404672
cmp eax, 3
jae 0x403ae4
push ebp
push 1
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x403ae4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._:hash:GetAdaptersInfo
push dword [edi + 0x40]
call fcn.0040652a
pop ecx
pop ecx
mov dword [edi + 0x410], eax
call fcn.00404672
cmp eax, 3
jae 0x403b1a
push ebp
push 1
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x403b1a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0x4000
mov eax, 0x8000
test eax, ebx
je 0x403c0f
test dword [edi], eax
jne 0x403c0f
lea eax, [esp + 0x118]
push str._:text:USERENV.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0x10
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x44], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x118]
call fcn.004015cc
test esi, esi
je 0x403c0f
push str._:hash:CreateEnvironmentBlock
push dword [edi + 0x44]
call fcn.0040652a
mov dword [edi + 0x42c], eax
push str._:hash:DestroyEnvironmentBlock
push dword [edi + 0x44]
call fcn.0040652a
mov dword [edi + 0x430], eax
push str._:hash:LoadUserProfileW
push dword [edi + 0x44]
call fcn.0040652a
mov dword [edi + 0x434], eax
push str._:hash:LoadUserProfileA
push dword [edi + 0x44]
call fcn.0040652a
mov dword [edi + 0x438], eax
push str._:hash:UnloadUserProfileW
push dword [edi + 0x44]
call fcn.0040652a
mov dword [edi + 0x43c], eax
push str._:hash:UnloadUserProfileA
push dword [edi + 0x44]
call fcn.0040652a
add esp, 0x30
mov dword [edi + 0x440], eax
call fcn.00404672
cmp eax, 3
jae 0x403c09
push str.Global193
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
or dword [edi], 0x8000
mov eax, 0x10000
test eax, ebx
je 0x403c7b
test dword [edi], eax
jne 0x403c7b
lea eax, [esp + 0x148]
push str._:text:WTSAPI32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0x11
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x48], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x148]
call fcn.004015cc
test esi, esi
je 0x403c7b
push str._:hash:WTSQueryUserToken
push dword [edi + 0x48]
call fcn.0040652a
pop ecx
mov dword [edi + 0x444], eax
or dword [edi], 0x10000
pop ecx
mov eax, 0x20000
test eax, ebx
je 0x403cfb
test dword [edi], eax
jne 0x403cfb
lea eax, [esp + 0x178]
push str._:text:NETAPI32.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0x12
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x4c], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x178]
call fcn.004015cc
test esi, esi
je 0x403cfb
push str._:hash:NetUserGetInfo
push dword [edi + 0x4c]
call fcn.0040652a
mov dword [edi + 0x46c], eax
push str._:hash:NetApiBufferFree
push dword [edi + 0x4c]
call fcn.0040652a
add esp, 0x10
mov dword [edi + 0x470], eax
or dword [edi], 0x20000
mov eax, 0x40000
test eax, ebx
je 0x403da9
test dword [edi], eax
jne 0x403da9
lea eax, [esp + 0x1a8]
push str._:text:IEFRAME.dll
push eax
call fcn.00405e9e
pop ecx
pop ecx
mov dword [esp + 0xe4c], 0x13
push eax
mov ecx, edi
call fcn.00403e10
mov esi, eax
mov dword [edi + 0x50], esi
or dword [esp + 0xe4c], 0xffffffff
lea ecx, [esp + 0x1a8]
call fcn.004015cc
test esi, esi
je 0x403da9
push str._:hash:IERegisterWritableRegistryKey
push dword [edi + 0x50]
call fcn.0040652a
mov dword [edi + 0x474], eax
push str._:hash:IERegisterWritableRegistryValue
push dword [edi + 0x50]
call fcn.0040652a
mov dword [edi + 0x478], eax
push str._:hash:IEGetWriteableHKCU
push dword [edi + 0x50]
call fcn.0040652a
mov dword [edi + 0x47c], eax
push str._:hash:IEIsProtectedModeProcess
push dword [edi + 0x50]
call fcn.0040652a
add esp, 0x20
mov dword [edi + 0x480], eax
or dword [edi], 0x40000
mov eax, dword [edi]
test eax, 0x4000000
je 0x403df6
xor eax, dword [esp + 0x1c]
test eax, 0xffffff
je 0x403df6
call fcn.00404672
cmp eax, 3
jae 0x403ddd
push str.332332
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x403ddd
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00404672
cmp eax, 3
jae 0x403df6
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [edi]
mov ecx, dword [esp + 0xe44]
pop edi
pop esi
pop ebp
and eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4