Function at 0x40dcb0
Capabilities:
Accept command line arguments
Check mutex on windows
Contain obfuscated stackstrings
Create mailslot
Delete file
Extract resource via kernel32 functions
Get comspec environment variable
Get file system object information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.00408920
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x914], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x910], 0
mov dword [ebp - 0x904], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x908], 0
xor eax, eax
mov word [ebp - 0x498], ax
push 0x45e
push 0
lea ecx, [ebp - 0x496]
push ecx
call fcn.00402490
add esp, 0xc
xor edx, edx
mov word [ebp - 0x8f8], dx
push 0x45e
push 0
lea eax, [ebp - 0x8f6]
push eax
call fcn.00402490
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xb1e]
call fcn.00401000
lea ecx, [ebp - 0xb1d]
call fcn.00401000
mov dword [ebp - 0x14], str.ErrorInfo.log
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0xb1c], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040be60
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0xb1e]
push eax
call fcn.00410190
mov byte [ebp - 0xb2c], 0x4d
mov byte [ebp - 0xb2b], 0x69
mov byte [ebp - 0xb2a], 0x63
mov byte [ebp - 0xb29], 0x72
mov ecx, dword [ebp - 0xb2c]
mov dword [0x41bf68], ecx
mov byte [ebp - 0xb2c], 0x6f
mov byte [ebp - 0xb2b], 0x73
mov byte [ebp - 0xb2a], 0x6f
mov byte [ebp - 0xb29], 0x66
mov edx, dword [ebp - 0xb2c]
mov dword [0x41bf6c], edx
mov byte [ebp - 0xb2c], 0x74
mov byte [ebp - 0xb2b], 0x2e
mov byte [ebp - 0xb2a], 0x4e
mov byte [ebp - 0xb29], 0x45
mov eax, dword [ebp - 0xb2c]
mov dword [0x41bf70], eax
lea ecx, [ebp - 0xb2d]
call fcn.00401000
lea ecx, [ebp - 0xb2d]
push ecx
call fcn.00411f40
lea ecx, [ebp - 0xb2d]
call fcn.00401010
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x434a50], eax
cmp dword [0x434a50], 0
jne 0x40de62
mov dword [ebp - 0x914], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
jmp 0x40f14c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0xb7
jne 0x40de93
mov dword [ebp - 0x914], 0x270d
mov dword [ebp - 0x910], 0
jmp 0x40f14c
mov edx, dword [ebp + 8]
mov dword [0x434a68], edx
push 0x118
push 0x4351f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xb24], eax
cmp dword [ebp - 0x904], 2
jle 0x40e069
mov dword [ebp - 0xb34], 0xffffffff
lea ecx, [ebp - 0x498]
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb38], 0
lea ecx, [ebp - 0xb3d]
call fcn.00401000
mov dword [ebp - 0x914], 0x270f
mov dword [ebp - 0x8fc], 0
jmp 0x40df25
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x4351f0]
test ecx, ecx
je 0x40df72
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x4351f0]
cmp eax, 0x5c
je 0x40df5d
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x4351f0]
cmp edx, 0x2f
jne 0x40df70
mov eax, dword [ebp - 0x8fc]
lea ecx, [eax*2 + 0x4351f0]
mov dword [ebp - 0xb38], ecx
jmp 0x40df16
cmp dword [ebp - 0xb38], 0
je 0x40df95
xor edx, edx
mov eax, dword [ebp - 0xb38]
mov word [eax], dx
mov ecx, dword [ebp - 0xb38]
add ecx, 2
mov dword [0x41bf64], ecx
mov edx, dword [ebp - 0xb3c]
push edx
mov eax, dword [ebp - 0xb24]
mov ecx, dword [eax + 4]
movzx edx, word [ecx]
sub edx, 0x30
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.00411630
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb34]
push ecx
mov edx, dword [ebp - 0xb3c]
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.00410520
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xb34]
push edx
push str._____d___d__r_n
mov eax, dword [ebp - 0xb3c]
add eax, 0x27
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x4173e4
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x4351f0
push 0x41740c
lea edx, [ebp - 0x8f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb3c]
push eax
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x8f8]
push edx
call fcn.00401520
add esp, 0xc
lea ecx, [ebp - 0xb3d]
call fcn.00401010
jmp 0x40f14c
lea ecx, [ebp - 0xb25]
call fcn.00401000
lea ecx, [ebp - 0xb26]
call fcn.00401000
lea eax, [ebp - 0xb25]
push eax
call fcn.004103b0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb26]
push ecx
call fcn.00412430
lea edx, [ebp - 0xb1e]
push edx
call fcn.00410160
push 1
push str.HTTP_Parser_Log.txt
call fcn.0040f8f0
push 0x417440
call fcn.0040f770
add esp, 4
push 0x4351f0
push str.__tWinMain__________________Module_FullName________________s_
call fcn.0040f770
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
push str.__tWinMain__________________CodePage_______________________d_
call fcn.0040f770
add esp, 8
mov ecx, dword [ebp - 0x904]
push ecx
push str.__tWinMain__________________Arg_Count______________________d_
call fcn.0040f770
add esp, 8
mov edx, dword [ebp - 4]
push edx
push str.__tWinMain__________________ActUserNameInformation_________d_
call fcn.0040f770
add esp, 8
lea eax, [ebp - 0xb25]
push eax
call fcn.00410500
push eax
push str.__tWinMain__________________Logon_UserCount________________d_
call fcn.0040f770
add esp, 8
lea ecx, [ebp - 0xb25]
push ecx
call fcn.00410510
push eax
push str.__tWinMain__________________ActiveUserName_________________s_
call fcn.0040f770
add esp, 8
lea edx, [ebp - 0xb1e]
push edx
call fcn.00410090
push eax
push str.__tWinMain__________________MainGetUserName________________s_
call fcn.0040f770
add esp, 8
push str.__tWinMain__________________Start________
call fcn.0040f770
add esp, 4
lea ecx, [ebp - 0xd60]
call fcn.00410040
push 1
lea ecx, [ebp - 0xd60]
call fcn.0040fd60
test eax, eax
je 0x40e19c
lea eax, [ebp - 0xd60]
push eax
call fcn.0040bf00
push 1
lea ecx, [ebp - 0xd60]
call fcn.0040fc80
jmp 0x40e28d
mov dword [ebp - 0x914], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4351f0
push 0x417444
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
lea ecx, [ebp - 0xd60]
call fcn.0040ff70
push eax
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401520
add esp, 0xc
lea ecx, [ebp - 0xd60]
call fcn.0040ffb0
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
lea ecx, [ebp - 0xd60]
call fcn.0040ffb0
push 0x118
lea edx, [ebp - 0x8f8]
push edx
push 0xffffffffffffffff
push str.sysinfoview.xml
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0x18], 0x36387828
mov dword [ebp - 0x8fc], 0
jmp 0x40e2e1
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x4351f0]
test edx, edx
je 0x40e32e
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x4351f0]
cmp ecx, 0x5c
je 0x40e319
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x4351f0]
cmp eax, 0x2f
jne 0x40e32c
mov ecx, dword [ebp - 0x8fc]
lea edx, [ecx*2 + 0x4351f0]
mov dword [ebp - 0xd64], edx
jmp 0x40e2d2
cmp dword [ebp - 0xd64], 0
je 0x40e351
xor eax, eax
mov ecx, dword [ebp - 0xd64]
mov word [ecx], ax
mov edx, dword [ebp - 0xd64]
add edx, 2
mov dword [0x41bf64], edx
mov eax, dword [0x41bf64]
push eax
push 0x4178a8
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40e38b
mov dword [ebp - 0x914], 0x3df
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
lea ecx, [ebp - 0x8f8]
push ecx
push 0x4351f0
push 0x4178c8
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x498]
push ecx
call fcn.004010d0
add esp, 8
test eax, eax
jge 0x40e3eb
mov dword [ebp - 0x914], 0x3e0
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x498]
push eax
call fcn.0040cfa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e492
cmp dword [ebp - 4], 0xc9
jne 0x40e42e
mov dword [ebp - 0x914], 0x3e9
jmp 0x40e477
cmp dword [ebp - 4], 0xca
jne 0x40e443
mov dword [ebp - 0x914], 0x3ea
jmp 0x40e477
cmp dword [ebp - 4], 0xcb
jne 0x40e458
mov dword [ebp - 0x914], 0x3eb
jmp 0x40e477
cmp dword [ebp - 4], 0x96
jl 0x40e46d
mov dword [ebp - 0x914], 0x3ec
jmp 0x40e477
mov dword [ebp - 0x914], 0x3ed
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
push str.parserchk.txt
push 0x4351f0
push 0x4178f0
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x910]
push edx
lea eax, [ebp - 0x498]
push eax
call fcn.004010d0
add esp, 8
test eax, eax
jl 0x40e518
mov dword [0x434a8c], 1
push str.parsernot.txt
push 0x4351f0
push 0x417918
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x910]
push edx
lea eax, [ebp - 0x498]
push eax
call fcn.004010d0
add esp, 8
test eax, eax
jl 0x40e518
mov dword [0x434a8c], 2
push 0x4351f0
push str._sHTTP_Parser.chm
push 0x435420
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xd74], 0
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xd6c], 0
mov dword [ebp - 0xd70], 0
push str.BINTYPE
push 0x12d
mov ecx, dword [0x434a68]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0xd74], 0
je 0x40e62f
push 0x460
push 0
lea edx, [ebp - 0x498]
push edx
call fcn.00402490
add esp, 0xc
cmp dword [ebp - 0xd74], 0
je 0x40e5c3
mov eax, dword [ebp - 0xd74]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xd68], eax
cmp dword [ebp - 0xd74], 0
je 0x40e5e3
mov edx, dword [ebp - 0xd74]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd68], 0
je 0x40e5ff
mov ecx, dword [ebp - 0xd68]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xd70], eax
lea edx, [ebp - 0x498]
push edx
push str.logo.gif
mov eax, dword [ebp - 0xd6c]
push eax
mov ecx, dword [ebp - 0xd70]
push ecx
call fcn.0040ced0
lea edx, [ebp - 0x498]
push edx
call fcn.0040b800
mov dword [0x434a6c], eax
cmp dword [ebp - 0xd68], 0
je 0x40e645
mov eax, dword [ebp - 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x4351f0
push str._s_themes_b_good.bmp
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x4351f0
push str._s_themes_b_bad.bmp
lea edx, [ebp - 0x8f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x4351f0
push str._s_themes_b_desktop.bmp
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x498]
push ecx
call fcn.0040b800
mov dword [0x434a70], eax
lea edx, [ebp - 0x8f8]
push edx
call fcn.0040b800
mov dword [0x434a74], eax
lea eax, [ebp - 0xb18]
push eax
call fcn.0040b800
mov dword [0x434a78], eax
mov dword [ebp - 0xd78], 0xa00000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x434a54], eax
cmp dword [0x434a54], 0xffffffff
jne 0x40e7e6
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
mov dword [0x434a54], 0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x4351f0
push 0x417a2c
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.Mail_Handle_Create_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push 0x417a70
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401520
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
push str.PARSER_SHARED_MAPMEMORY
mov edx, dword [ebp - 0xd78]
push edx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x434a58], eax
cmp dword [0x434a58], 0
jne 0x40e8f8
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4351f0
push 0x417aec
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x910]
push eax
push 0x417af8
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x417b28
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xb1c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x498]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xb1c]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00401520
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
mov ecx, dword [ebp - 0xd78]
push ecx
push 0
push 0
push 2
mov edx, dword [0x434a58]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x434a60], eax
cmp dword [0x434a60], 0
jne 0x40ea0a
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4351f0
push 0x417b74
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x910]
push eax
push str.Map_Handle_Create_Error
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xb1c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x498]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xb1c]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00401520
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
jmp 0x40f14c
mov ecx, dword [0x434a60]
add ecx, 0x100000
mov dword [0x4358a4], ecx
mov dword [ebp - 0xd80], 8
mov dword [ebp - 0xd7c], 0x3ff
lea edx, [ebp - 0xd80]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [ebp - 0xb26]
call fcn.00401010
lea ecx, [ebp - 0xb25]
call fcn.00401010
push 0x100
push 0x434dc0
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40ea7c
push str.cmd.exe
push 0x434dc0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x42d960
call fcn.00402490
add esp, 0xc
push 0x417c1c
push 0x4351f0
push 0x417c38
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010d0
add esp, 8
test eax, eax
jl 0x40eae2
push 0x42d960
push 0x5460
lea eax, [ebp - 0x498]
push eax
call fcn.004012d0
add esp, 0xc
push 0x41bf68
push str.sysinfoview.xml
call fcn.0040b840
mov dword [0x434a7c], 1
call fcn.0040bad0
mov dword [ebp - 0x8fc], 0
jmp 0x40eb1b
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
movzx eax, word [edx + 0x42d6e0]
test eax, eax
je 0x40eb4e
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
add ecx, 0x42d6e0
push ecx
push str.__tWinMain__________________InstBrowser____________________s_
call fcn.0040f770
add esp, 8
jmp 0x40eb0c
push str._test.html
call fcn.0040b880
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40ed68
mov dword [ebp - 0x8fc], 0
jmp 0x40eb80
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x40ebb5
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x40ebb3
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x10], edx
jmp 0x40eb71
cmp dword [ebp - 0x10], 0
jne 0x40ebc2
mov dword [ebp - 0x10], 0x417cf8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x434a80], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x40ebf7
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
movzx eax, word [edx + 0x42d460]
test eax, eax
je 0x40ec41
mov ecx, dword [ebp - 0x90c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
add eax, 0x42d460
push eax
call fcn.00401650
add esp, 0xc
test eax, eax
jne 0x40ec3f
mov ecx, dword [ebp - 0x8fc]
mov dword [0x434a80], ecx
jmp 0x40ec41
jmp 0x40ebe8
cmp dword [0x434a80], 0xffffffff
jne 0x40ecd4
mov dword [ebp - 0x10], str.msedge.exe
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x434a80], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x40ec8a
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
movzx edx, word [ecx + 0x42d460]
test edx, edx
je 0x40ecd4
mov eax, dword [ebp - 0x90c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
add edx, 0x42d460
push edx
call fcn.00401650
add esp, 0xc
test eax, eax
jne 0x40ecd2
mov eax, dword [ebp - 0x8fc]
mov dword [0x434a80], eax
jmp 0x40ecd4
jmp 0x40ec7b
cmp dword [0x434a80], 0xffffffff
jne 0x40ed68
mov dword [ebp - 0x10], str.iexplore.exe
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x434a80], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x40ed1d
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
movzx ecx, word [eax + 0x42d460]
test ecx, ecx
je 0x40ed68
mov edx, dword [ebp - 0x90c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
add ecx, 0x42d460
push ecx
call fcn.00401650
add esp, 0xc
test eax, eax
jne 0x40ed66
mov edx, dword [ebp - 0x8fc]
mov dword [0x434a80], edx
jmp 0x40ed68
jmp 0x40ed0e
mov eax, dword [0x434a80]
shl eax, 7
add eax, 0x42d460
push eax
mov ecx, dword [0x434a80]
shl ecx, 7
add ecx, 0x42d6e0
push ecx
mov edx, dword [0x434a80]
push edx
push str.__tWinMain__________________DefaultBrowser_________________d___s_:__s_
call fcn.0040f770
add esp, 0x10
push str.parsercommon.data
push 0x4351f0
push 0x417ddc
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010d0
add esp, 8
test eax, eax
jl 0x40ee1b
push 0x432dc0
push 0x310
lea eax, [ebp - 0x498]
push eax
call fcn.004012d0
add esp, 0xc
test eax, eax
jl 0x40ee14
mov ecx, dword [0x432dc8]
mov dword [0x434a80], ecx
mov edx, dword [0x432dcc]
mov dword [0x41bf40], edx
mov eax, dword [0x432dc4]
mov dword [0x434a84], eax
jmp 0x40ee1b
mov byte [0x432dc0], 0
movzx ecx, byte [0x432dc0]
test ecx, ecx
jne 0x40ee9b
mov byte [0x432dc0], 9
mov byte [0x432dc1], 9
mov byte [0x432dc2], 3
mov byte [0x432dc3], 3
mov edx, dword [0x434a84]
mov dword [0x432dc4], edx
mov eax, dword [0x434a80]
mov dword [0x432dc8], eax
mov ecx, dword [0x41bf40]
mov dword [0x432dcc], ecx
mov byte [0x432dd0], 0
mov byte [0x432dd1], 0
mov byte [0x432dd2], 0
mov byte [0x432dd4], 0
push 0
push 0x432dc0
push 0x310
lea edx, [ebp - 0x498]
push edx
call fcn.004013e0
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x43589c], eax
cmp dword [0x43589c], 0
je 0x40ef1b
mov dword [ebp - 0x1040], 0x99
jmp 0x40eed4
mov eax, dword [ebp - 0x1040]
add eax, 1
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0xb5
jg 0x40ef1b
push 0
push 0x10
push 0x10
push 1
movzx ecx, word [ebp - 0x1040]
push ecx
mov edx, dword [0x434a68]
push edx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x103c]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x43589c]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x40eec5
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov edx, dword [0x434a68]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x435898], eax
push 0x4000
push 0x2b4
lea eax, [ebp - 0x1038]
push eax
push 0
push 0x417de8
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x435890], eax
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x1038]
push ecx
push 0
push 0x417df0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x435894], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x40efbe
push str.HtmlHelpW
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4358ac], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x40efe6
push str.ImmAssociateContext
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4358a8], eax
mov ecx, dword [0x41bf58]
push ecx
mov edx, dword [0x41bf54]
push edx
mov eax, dword [0x41bf50]
push eax
mov ecx, dword [0x41bf4c]
push ecx
mov edx, dword [0x41bf5c]
push edx
mov eax, dword [ebp - 0x908]
push eax
push str.__tWinMain______________Run_____IDD_PARSER_BASE_____1______d___d:_d:_d:_d:_d_
call fcn.0040f770
add esp, 0x1c
mov dword [ebp - 0x1048], 8
mov dword [ebp - 0x1044], 0x3ff
lea ecx, [ebp - 0x1048]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x8d
mov edx, dword [0x434a68]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x434a4c], eax
push 0
push 0x40bea0
push 0
push 0x259
mov eax, dword [0x434a68]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x434a64], 0
mov dword [0x434a7c], 0
push 0x4351f0
push str._slist.txt
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x434a5c], 0
je 0x40f0e9
push 0x1388
mov edx, dword [0x434a5c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x434a5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.0040c570
push str.sitelink.txt
push 0x4351f0
push str._s_s
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x42d960
push 0x5460
lea edx, [ebp - 0x498]
push edx
call fcn.004013e0
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.__tWinMain__________________SITE_CHECKST_FILE______________d___d___s_
call fcn.0040f770
add esp, 0x10
mov dword [ebp - 0xc], 0x10
cmp dword [0x4358a0], 0
je 0x40f169
mov edx, dword [0x4358a0]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x435898], 0
je 0x40f17e
mov eax, dword [0x435898]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x43589c], 0
je 0x40f194
mov ecx, dword [0x43589c]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x434a60], 0
je 0x40f1aa
mov edx, dword [0x434a60]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x434a58], 0
je 0x40f1bf
mov eax, dword [0x434a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x434a54], 0
je 0x40f1d5
mov ecx, dword [0x434a54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x434a50], 0
je 0x40f1eb
mov edx, dword [0x434a50]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x1050], 0x3df
jg 0x40f225
cmp dword [ebp - 0x1050], 0x3df
je 0x40f2d1
cmp dword [ebp - 0x1050], 0
je 0x40f2c3
jmp case.default.0x40f2b7
cmp dword [ebp - 0x1050], 0x3e9
jg 0x40f276
cmp dword [ebp - 0x1050], 0x3e9
je 0x40f3d3
cmp dword [ebp - 0x1050], 0x3e0
je 0x40f307
cmp dword [ebp - 0x1050], 0x3e1
je 0x40f33d
cmp dword [ebp - 0x1050], 0x3e2
je 0x40f396
jmp case.default.0x40f2b7
cmp dword [ebp - 0x1050], 0x270e
jg 0x40f2be
cmp dword [ebp - 0x1050], 0x270d
jge 0x40f55a
mov ecx, dword [ebp - 0x1050]
sub ecx, 0x3ea
mov dword [ebp - 0x1050], ecx
cmp dword [ebp - 0x1050], 3
ja case.default.0x40f2b7
mov edx, dword [ebp - 0x1050]
jmp dword [edx*4 + 0x40f650]
jmp case.default.0x40f2b7
xor eax, eax
mov word [ebp - 0x498], ax
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f2f0
push 0x417fd0
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40f302
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f326
push 0x4180d0
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40f338
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f36a
mov edx, dword [ebp - 0x910]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x4181c8
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x40f38a
mov edx, dword [ebp - 0x910]
push edx
mov eax, dword [ebp - 4]
push eax
push str.OS_state_is_unstable___d_:__d_
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xc], 0x30
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f3b5
push 0x418290
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40f3c7
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0xc], 0x30
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f402
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.004100a0
push eax
push 0x418370
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f424
lea eax, [ebp - 0xb1e]
push eax
call fcn.004100a0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f458
lea edx, [ebp - 0xb1e]
push edx
call fcn.004100a0
push eax
push 0x418570
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f47a
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.004100a0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f4ae
lea eax, [ebp - 0xb1e]
push eax
call fcn.004100a0
push eax
push 0x418770
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f4d0
lea edx, [ebp - 0xb1e]
push edx
call fcn.004100a0
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f4fb
mov ecx, dword [ebp - 4]
push ecx
push 0x418970
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f514
mov eax, dword [ebp - 4]
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f53f
mov edx, dword [ebp - 4]
push edx
push 0x418b70
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f558
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f5b1
push 0
call fcn.0040be60
test eax, eax
je 0x40f583
mov eax, dword [ebp - 0x910]
push eax
push 0x418d70
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f59f
mov edx, dword [ebp - 0x910]
push edx
push 0x418da0
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0xc], 0x30
jmp 0x40f5b1
xor ecx, ecx
mov word [ebp - 0x498], cx
movzx edx, word [ebp - 0x498]
test edx, edx
je 0x40f5d9
mov eax, dword [ebp - 0xc]
push eax
push str._notification_BOX
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.__tWinMain__________________End__________
call fcn.0040f770
add esp, 4
mov edx, dword [ebp - 0x910]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x914]
push ecx
push str.__tWinMain__________________fcret__________________________d_:__d___d_
call fcn.0040f770
add esp, 0x10
push 0x418d9c
call fcn.0040f770
add esp, 4
call fcn.0040f8c0
mov edx, dword [ebp - 0x914]
mov dword [ebp - 0x104c], edx
lea ecx, [ebp - 0xb1d]
call fcn.00401010
lea ecx, [ebp - 0xb1e]
call fcn.00401010
mov eax, dword [ebp - 0x104c]
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret 0x10