Function at 0x429aa8
Capabilities:
Modify service
Persist via run registry key
Start service
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0x2d4]
sub esp, 0x354
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x2d0], eax
mov eax, dword [ebp + 0x2e0]
push ebx
mov ebx, dword [ebp + 0x2dc]
push esi
push edi
mov esi, 0x103
push esi
mov dword [ebp - 0x74], eax
xor edi, edi
lea eax, [ebp + 0x1cd]
push edi
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp + 0x1cc], 0
call fcn.00452e00
push esi
lea eax, [ebp + 0xc9]
push edi
push eax
mov byte [ebp + 0xc8], 0
call fcn.00452e00
push esi
lea eax, [ebp - 0x3b]
push edi
push eax
mov byte [ebp - 0x3c], 0
call fcn.00452e00
add esp, 0x24
push 6
pop ecx
xor eax, eax
lea esi, [ebx*4 + 0x481990]
mov ebx, dword [ebp - 0x74]
push eax
imul ebx, ebx, 0xf54
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x80], edi
push dword [ebp - 0x70]
mov dword [ebp - 0x58], edi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push dword [ebx + eax + 0x50]
mov dword [ebp - 0x60], ebx
call fcn.00442c90
mov eax, dword [0x485434]
mov edi, str.AutoRun
test eax, eax
je 0x429b64
cmp byte [eax], 0
jne 0x429b91
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x429b91
mov eax, dword [0x481960]
test eax, eax
je 0x429b8a
push str.No_program_name_or_command_line_provided
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x42ac98
mov eax, dword [esi]
add eax, ebx
push str.Send
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429c18
mov eax, dword [esi]
add eax, ebx
push str.Command
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429c18
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push dword [ebx + eax + 0x50]
call fcn.00442c90
cmp dword [0x480108], edi
jne 0x429bee
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x480108], eax
push edi
push dword [0x485434]
call fcn.0040109c
pop ecx
movzx eax, ax
push eax
push 0x111
push dword [0x480108]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
jmp 0x42ac98
mov eax, dword [esi]
add eax, ebx
push 0x46a278
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429d34
xor edi, edi
cmp dword [ebp + 0x2e4], edi
jne 0x429c60
mov eax, dword [ebp - 0x70]
shl eax, 0x14
add eax, dword [ebp - 0x74]
push eax
push 0x280d8
push 0x111
push dword [0x4800c0]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x42ac98
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
mov byte [ebp + 0x1cc], 0
cmp eax, edi
je 0x429ca8
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push eax
call fcn.00442c90
push 0x103
lea eax, [ebp + 0x1cc]
push eax
mov eax, dword [ebp - 0x70]
imul eax, eax, 0x104
add eax, 0x4804f8
push eax
push dword [0x485434]
call fcn.00413805
mov eax, dword [esi]
push edi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push dword [ebx + eax + 0x50]
call fcn.00442c90
mov eax, dword [esi]
push 1
lea eax, [ebx + eax + 0x58]
push str.cdecl
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
push eax
push dword [0x485434]
lea eax, [ebp + 0x1cc]
push eax
call fcn.004262b2
mov esi, eax
cmp esi, 0x69f6f36
je 0x429b8a
push esi
lea eax, [ebp - 0x3c]
push 0x464bf8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.00428e6d
cmp esi, 1
jl 0x429c10
mov eax, esi
jmp 0x42ac98
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x42a00a
lea eax, [ebx + eax + 0x58]
push 0x46a26c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429d95
push 4
lea eax, [ebp + 0x1cc]
push eax
push dword [0x485434]
call fcn.00411eca
push dword [0x485434]
lea eax, [ebp + 0x1cc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0
call fcn.00424726
add esp, 0x10
jmp 0x429c10
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Remove
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429ed0
and dword [ebp - 0x5c], 0
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
xor eax, eax
cmp dword [ebp - 0x5c], eax
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
and dword [ebp - 0x64], 0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x5c], 2
jge 0x429e99
push 2
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp - 0x60]
call fcn.004485ca
mov dword [ebp - 0x68], eax
test eax, eax
je 0x429e8c
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.004246b4
lea eax, [ebp + 0x1cc]
push eax
push dword [0x485434]
call fcn.004010ff
add esp, 0x18
test eax, eax
jne 0x429e56
lea eax, [ebp + 0xc8]
push eax
push dword [0x485434]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x429e56
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x46a230
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429e8c
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.004011fc
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x46a230
push eax
call fcn.004010ff
add esp, 0x14
test eax, eax
jne 0x429e89
push 0x63
pop eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x5c], eax
jmp 0x429e8c
dec dword [ebp - 0x64]
inc dword [ebp - 0x64]
cmp dword [ebp - 0x68], 0
jne 0x429dcd
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x429db9
cmp dword [ebp - 0x5c], 0x63
jge 0x429c10
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push 0x46a230
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x429c10
jmp 0x429b8a
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.List
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x429b8a
mov eax, dword [0x485434]
test eax, eax
je 0x429efb
push eax
call fcn.00452756
pop ecx
push 1
push 0x100000
call fcn.00452b24
and dword [ebp - 0x5c], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
mov dword [0x485434], eax
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
xor eax, eax
cmp dword [ebp - 0x5c], eax
setne al
add eax, reloc.ODBC32.dll_SQLAllocConnect
and dword [ebp - 0x64], 0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x5c], 2
jge 0x429fda
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff00
jge 0x429fda
push 2
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp - 0x60]
call fcn.004485ca
mov ebx, eax
test ebx, ebx
je 0x429fcf
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
push edi
push dword [ebp - 0x60]
call fcn.004246b4
mov eax, dword [0x485434]
add esp, 0x10
test eax, eax
je 0x429fcf
lea ecx, [ebp + 0x1cc]
push ecx
push eax
call esi
mov eax, dword [0x485434]
test eax, eax
je 0x429fcf
push 0x465fb0
push eax
call esi
mov eax, dword [0x485434]
test eax, eax
je 0x429fcf
lea ecx, [ebp + 0xc8]
push ecx
push eax
call esi
mov eax, dword [0x485434]
test eax, eax
je 0x429fcf
push 0x4663d8
push eax
call esi
inc dword [ebp - 0x64]
test ebx, ebx
jne 0x429f31
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x429f1d
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x485434]
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.00428e6d
jmp 0x429c10
add eax, ebx
push str.KILL
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a072
push 2
xor esi, esi
push esi
push esi
push esi
push 2
push dword [0x485434]
call fcn.0044c6a8
cmp eax, esi
jne 0x429c10
push 1
push esi
push esi
push esi
push 2
push dword [0x485434]
call fcn.0044c6a8
cmp eax, esi
jne 0x429c10
push dword [0x485434]
push str.Unable_to_find_process__s
push dword [0x481960]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x429b8a
mov eax, dword [esi]
add eax, ebx
push str.Control_Panel
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x42a35e
push str.System
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a0e4
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_sysdm.cpl
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
push str.Advanced
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a347
push 0x46a1c0
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x42a347
mov eax, dword [esi]
push str.Add_Remove_Programs
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a104
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_appwiz.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Internet
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a124
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_inetcpl.cpl_0
jmp 0x42a33a
mov eax, dword [esi]
push str.Device_Manager
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a144
push str.rundll32.exe_DevMgr.dll_DeviceManager_ExecuteA
jmp 0x42a33a
mov eax, dword [esi]
push str.Display
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a164
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_desk.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Time_Date
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a184
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_timedate.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Regional
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a1a4
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_intl.cpl_0
jmp 0x42a33a
mov eax, dword [esi]
push str.Keyboard
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a1c4
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__1
jmp 0x42a33a
mov eax, dword [esi]
push str.Game_Controllers
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a1e4
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_joy.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Mouse
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a204
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_main.cpl__0
jmp 0x42a33a
mov eax, dword [esi]
push str.Power
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a224
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_powercfg.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Sounds
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a244
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_mmsys.cpl_0
jmp 0x42a33a
mov eax, dword [esi]
push str.Network
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a264
push str.control.exe_netconnections
jmp 0x42a33a
mov eax, dword [esi]
push str.Ease_of_Access
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a284
push str.rundll32.exe_Shell32.dll_Control_RunDLLA_access.cpl
jmp 0x42a33a
mov eax, dword [esi]
push str.Admin
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a2a4
push str.control.exe_admintools
jmp 0x42a33a
mov eax, dword [esi]
push str.Phone
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a2c1
push str.control.exe_telephony
jmp 0x42a33a
mov eax, dword [esi]
push str.Scheduled
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a2de
push str.control.exe_schedtasks
jmp 0x42a33a
mov eax, dword [esi]
push str.User
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a2fb
push str.control.exe_userpasswords
jmp 0x42a33a
mov eax, dword [esi]
push str.Fonts
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a318
push str.control.exe_fonts
jmp 0x42a33a
mov eax, dword [esi]
push str.Appearance
push dword [ebx + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a335
push str.control.exe_color
jmp 0x42a33a
push str.control.exe
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push 0
push 1
lea eax, [ebp + 0x1cc]
push eax
call fcn.0044b949
jmp 0x42ac98
add eax, ebx
push str.Service
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a52a
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x60], eax
cmp eax, edi
jne 0x42a3b1
push edi
push 0x7ff
push dword [0x481960]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
jmp 0x429b8a
mov eax, dword [esi]
add eax, ebx
push str.Startup
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a3ca
push 2
jmp 0x42a3cc
push 0x30
push dword [0x485434]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x64], eax
cmp eax, edi
jne 0x42a414
push edi
push 0x7ff
push dword [0x481960]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x429b8a
mov eax, dword [esi]
add eax, ebx
push str.Startup
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi]
pop ecx
je 0x42a4a9
lea eax, [ebx + eax + 0x364]
push str.Automatic
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a450
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
jmp 0x42a49c
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
push str.Manual
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a477
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 3
jmp 0x42a49c
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
push str.Disabled
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a4f1
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
jmp 0x42a4ed
add eax, ebx
push 0x465478
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a4c9
push edi
push edi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x42a4ed
mov eax, dword [esi]
add eax, ebx
push str.Stop
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a4f1
lea eax, [ebp - 0x58]
push eax
push 1
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, edi
jne 0x42a525
push edi
push 0x7ff
push dword [0x481960]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x42ac98
xor edi, edi
inc edi
jmp 0x42a515
push dword [0x485434]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
add eax, 0x100000
mov dword [ebp - 0x68], eax
cmp eax, 0x1000
jg 0x42a54c
mov eax, 0x1000
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x429b8a
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x68]
imul eax, eax, 0x104
add ecx, 0xfffffc00
push ecx
push dword [ebp - 0x5c]
lea eax, [eax + 0x4804f8]
push eax
push dword [0x485434]
mov dword [ebp - 0x6c], eax
call fcn.00413805
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a5b4
push str..EXE
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42a5fb
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42aa13
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42aa13
push str..EXE
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42aa13
push dword [ebp - 0x5c]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42a631
mov eax, dword [0x481960]
test eax, eax
je 0x42a620
push str.A_script_cannot_call_itself__it_would_cause_an_endless_loop_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
push dword [ebp - 0x5c]
call fcn.00452756
mov eax, esi
jmp 0x42ac97
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x22
je 0x42a646
push 0x465ee0
push 0
push eax
call fcn.00449673
push dword [ebp - 0x5c]
call edi
mov ecx, dword [ebp - 0x5c]
cmp byte [eax + ecx - 1], 0x22
je 0x42a661
push 0x465ee0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x103
lea eax, [ebp + 0x1cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1cc]
push 0x465ee0
push eax
call fcn.004526d0
pop ecx
test eax, eax
pop ecx
lea eax, [ebp + 0x1cc]
jne 0x42a6c0
push 0x465ee0
push 0
push eax
call fcn.00449673
push str.___r
lea eax, [ebp + 0x1cc]
jmp 0x42a6c5
push 0x469d3c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1cc]
push eax
push 0
push dword [ebp - 0x5c]
call fcn.00449673
mov eax, dword [esi]
lea eax, [ebx + eax + 0x364]
test eax, eax
je 0x42aa13
push str.__s
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x74]
lea eax, [ebx + eax + 0x364]
push dword [ebp - 0x70]
push eax
call fcn.00442c90
mov eax, dword [0x485434]
test eax, eax
je 0x42a73f
push str.0123456789
push eax
call fcn.00454a80
pop ecx
pop ecx
push dword [0x485434]
mov ebx, eax
call edi
cmp ebx, eax
mov ebx, dword [ebp - 0x60]
sbb eax, eax
inc eax
jmp 0x42a741
xor eax, eax
test eax, eax
je 0x42a759
push dword [0x485434]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x42aa13
lea eax, [ebp - 0x3c]
push eax
call fcn.00411c73
mov dword [ebp - 0x6c], eax
add eax, 0x100
cmp eax, 0x1000
ja 0x42a776
mov eax, 0x1000
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
test eax, eax
je 0x42aa13
push dword [0x485434]
lea eax, [ebp + 0xc8]
push str._action_Label__action__text__s__text_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x6c]
lea eax, [ebp - 0x3c]
push dword [ebp - 0x64]
push 0
push eax
call fcn.00411af0
push str.__r_n
call edi
push 0x464a50
mov dword [ebp - 0x7c], eax
call edi
push str.__r_n
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x42a839
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x7c]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x68]
call fcn.00452ea0
push dword [ebp - 0x6c]
push 0x464a50
push dword [ebp - 0x60]
call fcn.00452790
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x42a82f
push str.__r_n
push dword [ebp - 0x68]
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x42a833
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x42a7e1
push 0x4664a0
call edi
push 0x464a50
mov dword [ebp - 0x78], eax
call edi
push 0x4664a0
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x42a8bb
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00452ea0
push dword [ebp - 0x6c]
push 0x464a50
push dword [ebp - 0x60]
call fcn.00452790
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x42a8b1
push 0x4664a0
push dword [ebp - 0x68]
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x42a8b5
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x42a863
push 0x464928
call edi
push 0x464a50
mov dword [ebp - 0x78], eax
call edi
push 0x464928
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x42a93d
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00452ea0
push dword [ebp - 0x6c]
push 0x464a50
push dword [ebp - 0x60]
call fcn.00452790
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x42a933
push 0x464928
push dword [ebp - 0x68]
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x42a937
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x42a8e5
push 0x464930
call edi
push 0x464a50
mov dword [ebp - 0x78], eax
call edi
push 0x464930
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x42a9bf
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
add ecx, eax
add eax, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], eax
call edi
inc eax
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.00452ea0
push dword [ebp - 0x6c]
push 0x464a50
push dword [ebp - 0x60]
call fcn.00452790
add esp, 0x18
cmp dword [ebp - 0x68], 0
je 0x42a9b5
push 0x464930
push dword [ebp - 0x68]
call fcn.004526d0
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jmp 0x42a9b9
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x42a967
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x64]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42aa0a
push str._step
push dword [ebp - 0x64]
mov byte [eax], 0
call fcn.00449160
push eax
lea eax, [ebp + 0xc8]
push 0x464bf8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x64]
call fcn.00452756
pop ecx
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42aa3f
cmp byte [0x4840a0], 2
jb 0x42aa3f
push 0x469d04
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esi]
cmp dword [ebx + eax + 0xf28], 1
jg 0x42aa9d
push dword [ebp - 0x5c]
call edi
inc eax
cmp eax, 0x103
jle 0x42aa5f
mov eax, 0x103
jmp 0x42aa65
push dword [ebp - 0x5c]
call edi
inc eax
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 4
push 0x469bc0
lea eax, [ebp + 0x2ca]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp + 0x1cc]
push eax
push str.____Translated_run_buffer:___s_
call fcn.0042604a
pop ecx
pop ecx
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Single
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42ab38
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42ab38
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42ab38
push 2
lea ecx, [ebp - 0x80]
push ecx
push eax
push eax
push 1
push dword [ebp - 0x5c]
mov dword [ebp - 0x80], eax
call fcn.0044c6a8
test eax, eax
jne 0x42ab11
push 1
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 1
push dword [ebp - 0x5c]
call fcn.0044c6a8
cmp dword [ebp - 0x80], 0
je 0x42ab38
push dword [ebp - 0x5c]
push str.____Found_existing_program_already_running___Activating___s_
call fcn.0042604a
pop ecx
pop ecx
push 0
push dword [ebp - 0x80]
call fcn.0044a2f8
xor esi, esi
inc esi
jmp 0x42a622
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.Wait
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42abab
mov eax, dword [esi]
add eax, ebx
push str.CALL_SCRIPT
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42abab
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42ab92
push str.vTask.exe
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42ab92
xor al, al
jmp 0x42ab94
mov al, 1
push 1
movzx eax, al
push 0
push eax
push dword [ebp - 0x5c]
call fcn.0044b949
mov edi, eax
jmp 0x42ac83
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x74]
lea eax, [ebx + eax + 0x15c]
push dword [ebp - 0x70]
push eax
call fcn.00442c90
push 0
push 0
push dword [0x485434]
call fcn.0041e488
fld st(0)
fldz
add esp, 0xc
fucompp
fnstsw ax
test ah, 0x44
jp 0x42abeb
fstp st(0)
fld qword [0x469c80]
push 1
call fcn.00454810
imul eax, eax, 0x3e8
push eax
mov eax, dword [esi]
lea eax, [ebx + eax + 0x58]
push str.hidden
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.0044b949
cmp eax, 0xffffcfc4
jne 0x42ac43
mov eax, dword [esi]
lea eax, [ebx + eax + 0x15c]
push eax
push str.Program_still_running_after_timeout_limit_of__s_seconds
push dword [0x481960]
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x42ac83
cmp eax, 0xffffcfc3
jne 0x42ac4e
xor edi, edi
jmp 0x42ac83
push eax
lea eax, [ebp + 0x1cc]
push 0x464bf8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x1cc]
push eax
call edi
push eax
lea eax, [ebp + 0x1cc]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call fcn.00428e6d
xor edi, edi
inc edi
push dword [ebp - 0x5c]
call fcn.00452756
lea eax, [edi + 0x303d]
neg eax
sbb eax, eax
and eax, edi
pop ecx
mov ecx, dword [ebp + 0x2d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x2d4
leave
ret 0xc