Function at 0x40f9f3
Capabilities:
Check http status code
Parse pe header
Reference http user-agent string

Disassembly:
push ebp
sub esp, 0xbcc
lea ebp, [esp - 4]
mov eax, dword [0x43e040]
xor eax, ebp
mov dword [ebp + 0xbcc], eax
push 0xb4
mov eax, 0x42fadb
call fcn.0041f9f2
mov eax, dword [ebp + 0xbd8]
and dword [ebp - 0x2c], 0
mov edi, dword [0x431270]
push str.SYSTEM
mov dword [ebp - 0x44], eax
call edi
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp + 0x400]
call fcn.0040e984
add esp, 0x1c
xor ebx, ebx
mov esi, eax
mov dword [ebp - 4], ebx
call fcn.0040dc83
or dword [ebp - 4], 0xffffffff
pop ecx
push ebx
push 1
lea esi, [ebp + 0x400]
mov byte [ebp - 0x35], al
call fcn.00402d55
mov byte [ebp - 0x4a], bl
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x90], ebx
cmp byte [ebp - 0x35], bl
jne 0x40fb55
lea eax, [ebp - 0x1c]
push eax
push 8
mov dword [ebp - 0x1c], ebx
call edi
push eax
call dword [0x43107c]
test eax, eax
je 0x40fb50
mov esi, dword [0x431084]
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
push 0x12
push dword [ebp - 0x1c]
xor edi, edi
call esi
test eax, eax
je 0x40fb3a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x14], 0x44
call dword [0x431068]
cmp dword [ebp - 0x8c], 3
jne 0x40fb2b
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x13
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
call esi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp + 0xb88]
push eax
push dword [ebp - 0x28]
call dword [section..rdata]
test eax, eax
je 0x40fb20
inc edi
push dword [ebp - 0x28]
call dword [0x431284]
jmp 0x40fb3a
call dword [0x431304]
xor edi, edi
mov dword [ebp - 0x90], eax
inc edi
push dword [ebp - 0x1c]
call dword [0x431284]
cmp edi, ebx
je 0x40fb50
cmp dword [ebp - 0x8c], 2
je 0x40fb55
mov byte [ebp - 0x15], bl
jmp 0x40fb59
mov byte [ebp - 0x15], 1
mov edi, dword [ebp - 0x44]
push 1
lea eax, [ebp - 0x20]
add edi, 0x218
push eax
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x20], 0x2f
call fcn.00407f10
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x40fc19
push 0xffffffffffffffff
inc eax
push eax
push edi
lea esi, [ebp + 0x400]
mov dword [ebp - 4], 1
call fcn.00402a74
cmp dword [eax + 0x18], 8
jb 0x40fba6
mov eax, dword [eax + 4]
jmp 0x40fba9
add eax, 4
push eax
call fcn.0041cf3b
pop ecx
push ebx
push 1
lea esi, [ebp + 0x400]
mov dword [ebp - 0x20], eax
call fcn.00402d55
push dword [ebp - 0x24]
lea esi, [ebp + 0x400]
push ebx
push edi
call fcn.00402a74
cmp dword [eax + 0x18], 8
jb 0x40fbdc
mov eax, dword [eax + 4]
jmp 0x40fbdf
add eax, 4
push eax
call fcn.0041cf3b
pop ecx
push ebx
push 1
lea esi, [ebp + 0x400]
mov edi, eax
call fcn.00402d55
call fcn.0041ef93
cdq
idiv dword [ebp - 0x20]
cmp edx, edi
jg 0x4148a0
or dword [ebp - 4], 0xffffffff
jmp 0x40fc19
mov edi, dword [ebp - 0x44]
push 1
lea eax, [ebp - 0x20]
lea esi, [edi + 0x1e0]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x52
call fcn.00407f10
cmp eax, 0xffffffff
push 1
lea eax, [ebp - 0x20]
setne byte [ebp - 0x49]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x41
call fcn.00407f10
cmp eax, 0xffffffff
push 1
lea eax, [ebp - 0x20]
setne byte [ebp - 0x3d]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x53
call fcn.00407f10
cmp eax, 0xffffffff
push 1
lea eax, [ebp - 0x20]
setne byte [ebp - 0x35]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x43
call fcn.00407f10
cmp eax, 0xffffffff
push 1
lea eax, [ebp - 0x20]
setne byte [ebp - 0x69]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x4e
call fcn.00407f10
cmp eax, 0xffffffff
push 1
lea eax, [ebp - 0x20]
setne byte [ebp - 0x6a]
push eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x20], 0x46
call fcn.00407f10
cmp eax, 0xffffffff
setne al
cmp dword [edi + 0x1d8], ebx
jbe 0x4148a0
cmp byte [ebp - 0x3d], bl
je 0x40fce9
cmp byte [ebp - 0x15], bl
je 0x4148a0
cmp al, bl
jne 0x411909
lea eax, [edi + 0x1c]
push eax
lea esi, [ebp + 0x454]
mov dword [ebp - 0x30], eax
call fcn.0040298e
mov dword [ebp - 4], 3
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x40fd1f
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x40fd50
or dword [ebp - 4], 0xffffffff
shr eax, 4
not eax
push ebx
and eax, 1
push 1
lea esi, [ebp + 0x454]
mov dword [ebp - 0x20], eax
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x40fe0d
call dword [0x431274]
cmp eax, 2
je 0x40fdf5
cmp eax, 3
je 0x40fdf5
cmp eax, 0x7b
je 0x40fdf5
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x40fd98
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x40fdda
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov dword [ebp - 0x20], ecx
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x40fdea
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor eax, eax
mov dword [ebp - 0x24], 1
cmp eax, ebx
jne 0x40fdf8
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x40ff2c
push 8
pop ecx
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 0x470], esp
push dword [ebp - 0x30]
xor eax, eax
mov dword [ebp + 0xba8], ebx
lea edi, [ebp + 0xbac]
rep stosd dword es:[edi], eax
call fcn.0040298e
lea ecx, [ebp + 0x454]
call fcn.0040ebd0
add esp, 0x1c
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x18], 8
jb 0x40fe5e
mov eax, dword [eax + 4]
jmp 0x40fe61
add eax, 4
lea ecx, [ebp + 0xba8]
push ecx
push ebx
push eax
call dword [0x43114c]
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x4c], ebx
jbe 0x40feb5
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 0x470], esp
push dword [ebp - 0x30]
call fcn.0040298e
lea ecx, [ebp + 0x400]
call fcn.0040e9fc
add esp, 0x1c
mov ecx, eax
mov byte [ebp - 4], 5
lea eax, [edi + 0x38]
mov dword [ebp - 0x2c], 1
call fcn.00407fbc
test al, al
jne 0x40fef1
cmp dword [ebp - 0x20], ebx
je 0x40fed7
cmp dword [edi + 0x6c], 8
jb 0x40fec5
mov eax, dword [edi + 0x58]
jmp 0x40fec8
lea eax, [edi + 0x58]
push eax
call fcn.0041cf3b
pop ecx
cmp dword [ebp + 0xbc8], eax
je 0x40fef1
cmp dword [ebp + 0x468], ebx
jbe 0x40fef7
lea ecx, [edi + 0x70]
lea eax, [ebp + 0x454]
call fcn.00407fbc
test al, al
je 0x40fef7
mov byte [ebp - 0x15], 1
jmp 0x40fefa
mov byte [ebp - 0x15], bl
test byte [ebp - 0x2c], 1
je 0x40ff0e
push ebx
push 1
lea esi, [ebp + 0x400]
call fcn.00402d55
cmp byte [ebp - 0x15], bl
je 0x40ff17
mov byte [ebp - 0x4a], 1
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov edi, dword [ebp - 0x44]
lea esi, [edi + 0x134]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
test eax, eax
jbe 0x4103a6
push dword [ebp - 0x28]
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x41037c
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x28]
add esi, 0x134
call fcn.00408a61
push eax
lea esi, [ebp + 0x400]
call fcn.0040298e
mov dword [ebp - 4], 6
push 7
pop eax
xor ecx, ecx
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x46c], eax
mov dword [ebp + 0x468], ebx
mov word [ebp + 0x458], cx
mov dword [ebp + 0x434], eax
xor eax, eax
mov dword [ebp + 0x430], ebx
mov word [ebp + 0x420], ax
mov eax, esi
push eax
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 8
call fcn.0040298e
push str.HKEY_CLASSES_ROOT
lea esi, [ebp + 0x3c8]
mov byte [ebp - 4], 9
call fcn.0040296e
push str.HKEY_CURRENT_USER
lea esi, [ebp + 0x390]
mov byte [ebp - 4], 0xa
call fcn.0040296e
push str.HKEY_LOCAL_MACHINE
lea esi, [ebp + 0x374]
mov byte [ebp - 4], 0xb
call fcn.0040296e
push str.HKEY_USERS
lea esi, [ebp + 0x3ac]
mov byte [ebp - 4], 0xc
call fcn.0040296e
push str.HKEY_PERFORMANCE_DATA
lea esi, [ebp + 0x358]
mov byte [ebp - 4], 0xd
call fcn.0040296e
push str.HKEY_CURRENT_CONFIG
lea esi, [ebp + 0x33c]
mov byte [ebp - 4], 0xe
call fcn.0040296e
push str.HKEY_DYN_DATA
lea esi, [ebp + 0x3e4]
mov byte [ebp - 4], 0xf
call fcn.0040296e
push 0x5c
pop edi
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x10
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x438]
call fcn.00402a74
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x11
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0xac]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x11
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0xbb0]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x41c]
mov byte [ebp - 4], 0x13
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x11
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0x88]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x454]
mov byte [ebp - 4], 0x14
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x11
call fcn.00402d55
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3c8]
call fcn.00407fbc
test al, al
je 0x41015e
mov dword [ebp - 0x30], SysStringLen
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x390]
call fcn.00407fbc
test al, al
je 0x41017f
mov dword [ebp - 0x30], SysStringLen
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x374]
call fcn.00407fbc
test al, al
je 0x41019d
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3ac]
call fcn.00407fbc
test al, al
je 0x4101bb
mov dword [ebp - 0x30], SysStringLen
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x358]
call fcn.00407fbc
test al, al
je 0x4101d9
mov dword [ebp - 0x30], SysStringLen
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x33c]
call fcn.00407fbc
test al, al
je 0x4101f7
mov dword [ebp - 0x30], SysStringLen
jmp 0x410213
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3e4]
call fcn.00407fbc
test al, al
je 0x410213
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysStringLen
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp + 0x438]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3e4]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x33c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x358]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3ac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x374]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x390]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3c8]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0x68]
call fcn.00402d55
cmp dword [ebp - 0x30], 0x80000001
jne 0x4102ab
lea eax, [ebp - 0x30]
push eax
push 0xf003f
call dword [0x43102c]
test eax, eax
je 0x4102ab
mov dword [ebp - 0x30], SysStringLen
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4102c0
lea eax, [ebp + 0x458]
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp - 0x30]
call dword [0x43103c]
test eax, eax
jne 0x410331
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x4102ed
lea eax, [ebp + 0x420]
mov esi, dword [0x431034]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x410328
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x410316
lea eax, [ebp + 0x420]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x410328
mov byte [ebp - 0x15], 1
push dword [ebp - 0x1c]
call dword [0x431038]
mov ecx, dword [ebp - 0x30]
mov eax, SysReAllocString
and ecx, eax
cmp ecx, eax
je 0x410348
push dword [ebp - 0x30]
call dword [0x431038]
push ebx
push edi
lea esi, [ebp + 0x41c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x454]
call fcn.00402d55
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea esi, [ebp + 0x400]
call fcn.00402d55
cmp byte [ebp - 0x15], bl
je 0x4148a0
mov esi, dword [ebp - 0x44]
mov eax, dword [esi + 0x144]
sub eax, dword [esi + 0x140]
add esi, 0x134
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x40ff49
mov edi, dword [ebp - 0x44]
lea esi, [edi + 0x14c]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
test eax, eax
jbe 0x410820
push dword [ebp - 0x28]
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x4107f6
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x28]
add esi, 0x14c
call fcn.00408a61
push eax
lea esi, [ebp + 0x3e4]
call fcn.0040298e
mov dword [ebp - 4], 0x15
push 7
pop eax
xor ecx, ecx
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x46c], eax
mov dword [ebp + 0x468], ebx
mov word [ebp + 0x458], cx
mov dword [ebp + 0x434], eax
xor eax, eax
mov dword [ebp + 0x430], ebx
mov word [ebp + 0x420], ax
mov eax, esi
push eax
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 0x17
call fcn.0040298e
push str.HKEY_CLASSES_ROOT
lea esi, [ebp + 0x33c]
mov byte [ebp - 4], 0x18
call fcn.0040296e
push str.HKEY_CURRENT_USER
lea esi, [ebp + 0x358]
mov byte [ebp - 4], 0x19
call fcn.0040296e
push str.HKEY_LOCAL_MACHINE
lea esi, [ebp + 0x3ac]
mov byte [ebp - 4], 0x1a
call fcn.0040296e
push str.HKEY_USERS
lea esi, [ebp + 0x374]
mov byte [ebp - 4], 0x1b
call fcn.0040296e
push str.HKEY_PERFORMANCE_DATA
lea esi, [ebp + 0x390]
mov byte [ebp - 4], 0x1c
call fcn.0040296e
push str.HKEY_CURRENT_CONFIG
lea esi, [ebp + 0x3c8]
mov byte [ebp - 4], 0x1d
call fcn.0040296e
push str.HKEY_DYN_DATA
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x1e
call fcn.0040296e
push 0x5c
pop edi
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x1f
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x438]
call fcn.00402a74
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x20
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0x88]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x21
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x20
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0xbb0]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x41c]
mov byte [ebp - 4], 0x22
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x20
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0xac]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x454]
mov byte [ebp - 4], 0x23
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x20
call fcn.00402d55
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x33c]
call fcn.00407fbc
test al, al
je 0x4105d8
mov dword [ebp - 0x30], SysStringLen
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x358]
call fcn.00407fbc
test al, al
je 0x4105f9
mov dword [ebp - 0x30], SysStringLen
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3ac]
call fcn.00407fbc
test al, al
je 0x410617
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x374]
call fcn.00407fbc
test al, al
je 0x410635
mov dword [ebp - 0x30], SysStringLen
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x390]
call fcn.00407fbc
test al, al
je 0x410653
mov dword [ebp - 0x30], SysStringLen
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3c8]
call fcn.00407fbc
test al, al
je 0x410671
mov dword [ebp - 0x30], SysStringLen
jmp 0x41068d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x400]
call fcn.00407fbc
test al, al
je 0x41068d
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysStringLen
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp + 0x438]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x400]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3c8]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x390]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x374]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3ac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x358]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x33c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0x68]
call fcn.00402d55
cmp dword [ebp - 0x30], 0x80000001
jne 0x410725
lea eax, [ebp - 0x30]
push eax
push 0xf003f
call dword [0x43102c]
test eax, eax
je 0x410725
mov dword [ebp - 0x30], SysStringLen
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x41073a
lea eax, [ebp + 0x458]
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp - 0x30]
call dword [0x43103c]
test eax, eax
jne 0x4107ab
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x410767
lea eax, [ebp + 0x420]
mov esi, dword [0x431034]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x4107a2
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x410790
lea eax, [ebp + 0x420]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x4107a2
mov byte [ebp - 0x15], 1
push dword [ebp - 0x1c]
call dword [0x431038]
mov ecx, dword [ebp - 0x30]
mov eax, SysReAllocString
and ecx, eax
cmp ecx, eax
je 0x4107c2
push dword [ebp - 0x30]
call dword [0x431038]
push ebx
push edi
lea esi, [ebp + 0x41c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x454]
call fcn.00402d55
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea esi, [ebp + 0x3e4]
call fcn.00402d55
cmp byte [ebp - 0x15], bl
jne 0x4148a0
mov esi, dword [ebp - 0x44]
mov eax, dword [esi + 0x15c]
sub eax, dword [esi + 0x158]
add esi, 0x14c
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x4103c3
mov edi, dword [ebp - 0x44]
mov eax, dword [edi + 0x174]
sub eax, dword [edi + 0x170]
add edi, 0x164
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
test eax, eax
jbe 0x410994
push dword [ebp - 0x28]
mov esi, edi
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x41097c
push dword [ebp - 0x28]
call fcn.00408a61
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
mov dword [ebp - 4], 0x24
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x410886
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x4108b7
or dword [ebp - 4], 0xffffffff
shr eax, 4
not eax
push ebx
and eax, 1
push 1
lea esi, [ebp + 0x454]
mov dword [ebp - 0x20], eax
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x410974
call dword [0x431274]
cmp eax, 2
je 0x41095c
cmp eax, 3
je 0x41095c
cmp eax, 0x7b
je 0x41095c
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x4108ff
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x410941
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov dword [ebp - 0x20], ecx
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x410951
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor eax, eax
mov dword [ebp - 0x24], 1
cmp eax, ebx
jne 0x41095f
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4148a0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x410843
mov edi, dword [ebp - 0x44]
mov eax, dword [edi + 0x18c]
sub eax, dword [edi + 0x188]
add edi, 0x17c
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
test eax, eax
jbe 0x410b0b
push dword [ebp - 0x28]
mov esi, edi
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x410af3
push dword [ebp - 0x28]
call fcn.00408a61
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
mov dword [ebp - 4], 0x25
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4109fd
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x410a2e
or dword [ebp - 4], 0xffffffff
shr eax, 4
not eax
push ebx
and eax, 1
push 1
lea esi, [ebp + 0x454]
mov dword [ebp - 0x20], eax
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x410aeb
call dword [0x431274]
cmp eax, 2
je 0x410ad3
cmp eax, 3
je 0x410ad3
cmp eax, 0x7b
je 0x410ad3
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x410a76
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x410ab8
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov dword [ebp - 0x20], ecx
call fcn.00402d55
mov eax, dword [ebp - 0x20]
jmp 0x410ac8
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor eax, eax
mov dword [ebp - 0x24], 1
cmp eax, ebx
jne 0x410ad6
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x4148a0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x4109ba
mov edi, dword [ebp - 0x44]
mov eax, dword [edi + 0x1a4]
sub eax, dword [edi + 0x1a0]
add edi, 0x194
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
test eax, eax
jbe 0x410c16
push dword [ebp - 0x28]
mov esi, edi
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x410bfe
push dword [ebp - 0x28]
call fcn.00408a61
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x14], ebx
xor esi, esi
call dword [0x431014]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x410bd9
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x410b89
lea eax, [ebp + 0x458]
push 0xf01ff
push eax
push dword [ebp - 0x2c]
call dword [0x431010]
mov esi, eax
cmp esi, ebx
je 0x410bd9
push 6
pop ecx
xor eax, eax
mov dword [ebp + 0x438], ebx
lea edi, [ebp + 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x438]
push eax
push esi
call dword [0x43100c]
test eax, eax
je 0x410bd3
cmp dword [ebp + 0x43c], 4
mov dword [ebp - 0x14], 1
je 0x410bd6
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x24]
push esi
mov esi, dword [0x431018]
call esi
push dword [ebp - 0x2c]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
cmp dword [ebp - 0x14], ebx
je 0x4148a0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x410b34
mov edi, dword [ebp - 0x44]
mov eax, dword [edi + 0x1bc]
sub eax, dword [edi + 0x1b8]
add edi, 0x1ac
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
test eax, eax
jbe 0x410d21
push dword [ebp - 0x28]
mov esi, edi
call fcn.00408a61
cmp dword [eax + 0x14], ebx
jbe 0x410d09
push dword [ebp - 0x28]
call fcn.00408a61
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x14], ebx
xor esi, esi
call dword [0x431014]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x410ce4
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x410c94
lea eax, [ebp + 0x458]
push 0xf01ff
push eax
push dword [ebp - 0x2c]
call dword [0x431010]
mov esi, eax
cmp esi, ebx
je 0x410ce4
push 6
pop ecx
xor eax, eax
mov dword [ebp + 0x438], ebx
lea edi, [ebp + 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x438]
push eax
push esi
call dword [0x43100c]
test eax, eax
je 0x410cde
cmp dword [ebp + 0x43c], 4
mov dword [ebp - 0x14], 1
je 0x410ce1
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x24]
push esi
mov esi, dword [0x431018]
call esi
push dword [ebp - 0x2c]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
cmp dword [ebp - 0x14], ebx
jne 0x4148a0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jb 0x410c3f
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xa0], ebx
jbe 0x411151
add eax, 0x8c
push eax
lea esi, [ebp + 0x3e4]
call fcn.0040298e
mov dword [ebp - 4], 0x26
push 7
pop eax
xor ecx, ecx
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x46c], eax
mov dword [ebp + 0x468], ebx
mov word [ebp + 0x458], cx
mov dword [ebp + 0x434], eax
xor eax, eax
mov dword [ebp + 0x430], ebx
mov word [ebp + 0x420], ax
mov eax, esi
push eax
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 0x28
call fcn.0040298e
push str.HKEY_CLASSES_ROOT
lea esi, [ebp + 0x33c]
mov byte [ebp - 4], 0x29
call fcn.0040296e
push str.HKEY_CURRENT_USER
lea esi, [ebp + 0x358]
mov byte [ebp - 4], 0x2a
call fcn.0040296e
push str.HKEY_LOCAL_MACHINE
lea esi, [ebp + 0x3ac]
mov byte [ebp - 4], 0x2b
call fcn.0040296e
push str.HKEY_USERS
lea esi, [ebp + 0x374]
mov byte [ebp - 4], 0x2c
call fcn.0040296e
push str.HKEY_PERFORMANCE_DATA
lea esi, [ebp + 0x390]
mov byte [ebp - 4], 0x2d
call fcn.0040296e
push str.HKEY_CURRENT_CONFIG
lea esi, [ebp + 0x3c8]
mov byte [ebp - 4], 0x2e
call fcn.0040296e
push str.HKEY_DYN_DATA
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x2f
call fcn.0040296e
push 0x5c
pop edi
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x30
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x438]
call fcn.00402a74
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x20], edi
push 1
lea eax, [ebp - 0x20]
push eax
xor eax, eax
lea ecx, [ebp - 0x68]
call fcn.00407f10
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0x88]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x32
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x31
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0xbb0]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x41c]
mov byte [ebp - 4], 0x33
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x31
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0xac]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x454]
mov byte [ebp - 4], 0x34
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x31
call fcn.00402d55
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x33c]
call fcn.00407fbc
test al, al
je 0x410f28
mov dword [ebp - 0x30], SysStringLen
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x358]
call fcn.00407fbc
test al, al
je 0x410f49
mov dword [ebp - 0x30], SysStringLen
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3ac]
call fcn.00407fbc
test al, al
je 0x410f67
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x374]
call fcn.00407fbc
test al, al
je 0x410f85
mov dword [ebp - 0x30], SysStringLen
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x390]
call fcn.00407fbc
test al, al
je 0x410fa3
mov dword [ebp - 0x30], SysStringLen
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3c8]
call fcn.00407fbc
test al, al
je 0x410fc1
mov dword [ebp - 0x30], SysStringLen
jmp 0x410fdd
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x400]
call fcn.00407fbc
test al, al
je 0x410fdd
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysStringLen
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x400]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x3c8]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x390]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x374]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x3ac]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x358]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x33c]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp - 0x68]
call fcn.00402d55
cmp dword [ebp - 0x30], 0x80000001
jne 0x41107b
lea eax, [ebp - 0x30]
push eax
push 0xf003f
call dword [0x43102c]
test eax, eax
je 0x41107b
mov dword [ebp - 0x30], SysStringLen
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x411090
lea eax, [ebp + 0x458]
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp - 0x30]
call dword [0x43103c]
test eax, eax
jne 0x411101
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x4110bd
lea eax, [ebp + 0x420]
mov esi, dword [0x431034]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x4110f8
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x4110e6
lea eax, [ebp + 0x420]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x4110f8
mov byte [ebp - 0x15], 1
push dword [ebp - 0x1c]
call dword [0x431038]
mov ecx, dword [ebp - 0x30]
mov eax, SysReAllocString
and ecx, eax
cmp ecx, eax
je 0x411118
push dword [ebp - 0x30]
call dword [0x431038]
push ebx
push 1
lea esi, [ebp + 0x41c]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x3e4]
call fcn.00402d55
cmp byte [ebp - 0x15], bl
je 0x4148a0
jmp 0x411154
push 0x5c
pop edi
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xbc], ebx
jbe 0x411573
add eax, 0xa8
push eax
lea esi, [ebp + 0x3e4]
call fcn.0040298e
mov dword [ebp - 4], 0x35
push 7
pop eax
xor ecx, ecx
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x46c], eax
mov dword [ebp + 0x468], ebx
mov word [ebp + 0x458], cx
mov dword [ebp + 0x434], eax
xor eax, eax
mov dword [ebp + 0x430], ebx
mov word [ebp + 0x420], ax
mov eax, esi
push eax
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 0x37
call fcn.0040298e
push str.HKEY_CLASSES_ROOT
lea esi, [ebp + 0x33c]
mov byte [ebp - 4], 0x38
call fcn.0040296e
push str.HKEY_CURRENT_USER
lea esi, [ebp + 0x358]
mov byte [ebp - 4], 0x39
call fcn.0040296e
push str.HKEY_LOCAL_MACHINE
lea esi, [ebp + 0x3ac]
mov byte [ebp - 4], 0x3a
call fcn.0040296e
push str.HKEY_USERS
lea esi, [ebp + 0x374]
mov byte [ebp - 4], 0x3b
call fcn.0040296e
push str.HKEY_PERFORMANCE_DATA
lea esi, [ebp + 0x390]
mov byte [ebp - 4], 0x3c
call fcn.0040296e
push str.HKEY_CURRENT_CONFIG
lea esi, [ebp + 0x3c8]
mov byte [ebp - 4], 0x3d
call fcn.0040296e
push str.HKEY_DYN_DATA
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x3e
call fcn.0040296e
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x3f
xor eax, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00407f10
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x438]
call fcn.00402a74
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x20], edi
push 1
lea eax, [ebp - 0x20]
push eax
xor eax, eax
lea ecx, [ebp - 0x68]
call fcn.00407f10
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0x88]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x41
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x40
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0xbb0]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x41c]
mov byte [ebp - 4], 0x42
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x40
call fcn.00402d55
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], edi
call fcn.00402cdc
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0xac]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x454]
mov byte [ebp - 4], 0x43
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x40
call fcn.00402d55
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x33c]
call fcn.00407fbc
test al, al
je 0x411358
mov dword [ebp - 0x30], SysStringLen
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x358]
call fcn.00407fbc
test al, al
je 0x411379
mov dword [ebp - 0x30], SysStringLen
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3ac]
call fcn.00407fbc
test al, al
je 0x411397
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x374]
call fcn.00407fbc
test al, al
je 0x4113b5
mov dword [ebp - 0x30], SysStringLen
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x390]
call fcn.00407fbc
test al, al
je 0x4113d3
mov dword [ebp - 0x30], SysStringLen
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x3c8]
call fcn.00407fbc
test al, al
je 0x4113f1
mov dword [ebp - 0x30], SysStringLen
jmp 0x41140d
lea ecx, [ebp + 0x438]
lea eax, [ebp + 0x400]
call fcn.00407fbc
test al, al
je 0x41140d
mov dword [ebp - 0x30], reloc.OLEAUT32.dll_SysStringLen
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp + 0x438]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x400]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3c8]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x390]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x374]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3ac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x358]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x33c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0x68]
call fcn.00402d55
mov esi, SysReAllocString
cmp dword [ebp - 0x30], esi
jne 0x4114a2
lea eax, [ebp - 0x30]
push eax
push 0xf003f
call dword [0x43102c]
test eax, eax
je 0x4114a2
mov dword [ebp - 0x30], esi
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4114b7
lea eax, [ebp + 0x458]
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp - 0x30]
call dword [0x43103c]
test eax, eax
jne 0x411528
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x4114e4
lea eax, [ebp + 0x420]
mov esi, dword [0x431034]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x41151f
cmp dword [ebp + 0x434], 8
mov eax, dword [ebp + 0x420]
jae 0x41150d
lea eax, [ebp + 0x420]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x41151f
mov byte [ebp - 0x15], 1
push dword [ebp - 0x1c]
call dword [0x431038]
mov ecx, dword [ebp - 0x30]
mov eax, SysReAllocString
and ecx, eax
cmp ecx, eax
je 0x41153f
push dword [ebp - 0x30]
call dword [0x431038]
push ebx
push edi
lea esi, [ebp + 0x41c]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x454]
call fcn.00402d55
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea esi, [ebp + 0x3e4]
call fcn.00402d55
cmp byte [ebp - 0x15], bl
jne 0x4148a0
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xd8], ebx
jbe 0x411683
add eax, 0xc4
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
mov dword [ebp - 4], 0x44
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4115af
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x4115ca
shr eax, 4
not eax
and eax, 1
mov edi, eax
jmp 0x411667
call dword [0x431274]
cmp eax, 2
je 0x411665
cmp eax, 3
je 0x411665
cmp eax, 0x7b
je 0x411665
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x41160e
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x41164c
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov edi, ecx
call fcn.00402d55
jmp 0x41165c
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor edi, edi
cmp edi, ebx
je 0x411665
xor edi, edi
inc edi
jmp 0x411667
xor edi, edi
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, edi
cmp eax, ebx
je 0x4148a0
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xf4], ebx
jbe 0x411793
add eax, 0xe0
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
mov dword [ebp - 4], 0x45
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4116bf
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x4116da
shr eax, 4
not eax
and eax, 1
mov edi, eax
jmp 0x411777
call dword [0x431274]
cmp eax, 2
je 0x411775
cmp eax, 3
je 0x411775
cmp eax, 0x7b
je 0x411775
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x41171e
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x41175c
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov edi, ecx
call fcn.00402d55
jmp 0x41176c
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor edi, edi
cmp edi, ebx
je 0x411775
xor edi, edi
inc edi
jmp 0x411777
xor edi, edi
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, edi
cmp eax, ebx
jne 0x4148a0
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x110], ebx
jbe 0x41184e
add eax, 0xfc
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
push 0xf003f
push ebx
push ebx
xor edi, edi
xor esi, esi
call dword [0x431014]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x41182a
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x4117e0
lea eax, [ebp + 0x458]
push 0xf01ff
push eax
push dword [ebp - 0x24]
call dword [0x431010]
mov esi, eax
cmp esi, ebx
je 0x41182a
push 6
pop ecx
xor eax, eax
mov dword [ebp + 0x438], ebx
lea edi, [ebp + 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x438]
push eax
push esi
call dword [0x43100c]
test eax, eax
je 0x411828
cmp dword [ebp + 0x43c], 4
jne 0x411828
xor edi, edi
inc edi
jmp 0x41182a
xor edi, edi
push esi
mov esi, dword [0x431018]
call esi
push dword [ebp - 0x24]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
cmp edi, ebx
je 0x4148a0
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x12c], ebx
jbe 0x411909
add eax, 0x118
push eax
lea esi, [ebp + 0x454]
call fcn.0040298e
push 0xf003f
push ebx
push ebx
xor edi, edi
xor esi, esi
call dword [0x431014]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x4118e5
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x41189b
lea eax, [ebp + 0x458]
push 0xf01ff
push eax
push dword [ebp - 0x24]
call dword [0x431010]
mov esi, eax
cmp esi, ebx
je 0x4118e5
push 6
pop ecx
xor eax, eax
mov dword [ebp + 0x438], ebx
lea edi, [ebp + 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x438]
push eax
push esi
call dword [0x43100c]
test eax, eax
je 0x4118e3
cmp dword [ebp + 0x43c], 4
jne 0x4118e3
xor edi, edi
inc edi
jmp 0x4118e5
xor edi, edi
push esi
mov esi, dword [0x431018]
call esi
push dword [ebp - 0x24]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
cmp edi, ebx
jne 0x4148a0
mov eax, dword [ebp - 0x44]
add eax, 0x1c
push eax
lea esi, [ebp + 0x454]
mov dword [ebp - 0x30], eax
call fcn.0040298e
mov dword [ebp - 4], 0x46
cmp dword [ebp + 0x46c], 8
mov eax, dword [ebp + 0x458]
jae 0x41193a
lea eax, [ebp + 0x458]
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x411955
shr eax, 4
not eax
and eax, 1
mov edi, eax
jmp 0x4119f2
call dword [0x431274]
cmp eax, 2
je 0x4119f0
cmp eax, 3
je 0x4119f0
cmp eax, 0x7b
je 0x4119f0
lea eax, [ebp + 0x454]
push eax
lea esi, [ebp + 0x438]
call fcn.0040298e
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x411999
lea eax, [ebp + 0x43c]
lea ecx, [ebp + 0x834]
push ecx
push eax
call dword [0x4312a8]
cmp eax, 0xffffffff
je 0x4119d7
push eax
call dword [0x4312b0]
xor eax, eax
cmp dword [ebp + 0x834], ebx
push ebx
setne al
xor ecx, ecx
push 1
lea esi, [ebp + 0x438]
cmp eax, ebx
sete cl
mov edi, ecx
call fcn.00402d55
jmp 0x4119e7
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
xor edi, edi
cmp edi, ebx
je 0x4119f0
xor edi, edi
inc edi
jmp 0x4119f2
xor edi, edi
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
mov eax, edi
cmp eax, ebx
je 0x412459
cmp byte [ebp - 0x35], bl
je 0x412459
push dword [ebp - 0x30]
lea esi, [ebp + 0x438]
call fcn.0040298e
xor eax, eax
mov dword [ebp - 4], 0x47
push 0x208
mov word [ebp + 0x478], ax
lea eax, [ebp + 0x47a]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
push 0x104
lea eax, [ebp + 0x478]
push eax
call dword [0x43113c]
lea eax, [ebp + 0x478]
push eax
lea esi, [ebp + 0x454]
call fcn.0040296e
push str._regsvr32.exe
mov eax, esi
push eax
mov byte [ebp - 4], 0x48
call fcn.004029bc
cmp dword [ebp + 0x450], 8
mov eax, dword [ebp + 0x43c]
jae 0x411a94
lea eax, [ebp + 0x43c]
push 0x4376d0
push eax
call fcn.0041de0a
pop ecx
pop ecx
test eax, eax
je 0x411b49
mov edi, 0x4376d4
push edi
lea esi, [ebp + 0x400]
call fcn.0040296e
mov dword [ebp - 0x20], eax
push edi
lea esi, [ebp - 0xac]
mov byte [ebp - 4], 0x49
call fcn.0040296e
lea ecx, [ebp + 0x438]
push ecx
push eax
lea eax, [ebp + 0xbb0]
push eax
mov byte [ebp - 4], 0x4a
call fcn.0041a04a
mov byte [ebp - 4], 0x4b
push dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041a04a
add esp, 0x18
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0x4c
call fcn.00402be0
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x88]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0xbb0]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0xac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x48
call fcn.00402d55
push str.__u
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push str.__s
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x438]
lea ecx, [ebp + 0x454]
call fcn.00402f35
push str.SYSTEM
call dword [0x431270]
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp - 0x88]
call fcn.0040e984
add esp, 0x1c
mov esi, eax
mov byte [ebp - 4], 0x4d
call fcn.0040dc83
pop ecx
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x88]
mov byte [ebp - 0x3d], al
mov byte [ebp - 4], 0x48
call fcn.00402d55
cmp byte [ebp - 0x3d], bl
je 0x4123c1
sub esp, 0x1c
lea eax, [ebp + 0x454]
mov esi, esp
mov dword [ebp + 0x470], esp
push eax
call fcn.0040298e
lea edi, [ebp - 0x88]
call fcn.0040120c
add esp, 0x1c
mov byte [ebp - 4], 0x4e
cmp dword [eax + 0x18], 0x10
jb 0x411c0d
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], esi
jmp 0x411c15
add eax, 4
mov dword [ebp - 0x24], eax
mov esi, eax
cmp esi, ebx
je 0x4123b1
push 0x103
lea eax, [ebp + 0xa85]
push ebx
push eax
mov byte [ebp + 0xa84], bl
call fcn.0041dd90
push esi
call fcn.0041d110
add esp, 0x10
cmp eax, 2
jbe 0x411c60
cmp byte [esi + 1], 0x3a
jne 0x411c60
push esi
lea eax, [ebp + 0xa84]
push 0x104
push eax
call fcn.0041efb5
add esp, 0xc
jmp 0x411c8e
push 0x104
lea eax, [ebp + 0xa84]
push eax
push ebx
call dword [0x431148]
lea eax, [ebp + 0xa84]
push eax
call dword [0x43133c]
push esi
lea eax, [ebp + 0xa84]
push eax
call dword [0x431340]
mov edi, 0x110
push edi
lea eax, [ebp + 4]
push ebx
push eax
call fcn.0041dd90
mov esi, dword [0x431140]
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
mov dword [ebp - 0x2c], ebx
call esi
test eax, eax
je 0x411cc8
cmp dword [ebp + 4], 6
jne 0x411cc8
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x2c], ebx
jne 0x411efa
push edi
lea eax, [ebp + 0x22c]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x228]
push eax
mov dword [ebp + 0x228], 0x114
call esi
test eax, eax
je 0x411d14
cmp dword [ebp + 0x22c], 5
jne 0x411d14
cmp dword [ebp + 0x230], ebx
je 0x411e28
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
push ebx
xor edi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
call fcn.0042df04
cmp eax, ebx
je 0x411d68
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x14], ebx
jbe 0x411d5a
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x411d52
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x14]
jb 0x411d43
jmp 0x411d5a
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x411d68
mov eax, esi
jmp 0x411d98
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x411d8b
call dword [0x431274]
jmp 0x411d98
lea ecx, [ebp - 0x34]
push ecx
push edi
call eax
cmp eax, ebx
je 0x411d83
xor eax, eax
cmp eax, ebx
je 0x412094
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x411dba
call dword [0x431274]
jmp 0x41208c
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x1c], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x411ea9
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x411e9e
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x411df7
jmp 0x411eb2
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
je 0x411daf
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x1c], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x411ea9
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x411e9e
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x411e74
jmp 0x411eb2
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x1c], ebx
jmp 0x411eb2
call dword [0x431274]
mov dword [ebp - 0x1c], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x411daf
lea eax, [ebp - 0x34]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
cmp eax, ebx
jne 0x411eef
call dword [0x431274]
mov dword [ebp - 0x1c], eax
push esi
call edi
mov eax, dword [ebp - 0x1c]
jmp 0x41208c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x28], ebx
xor edi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
call fcn.0042df04
cmp eax, ebx
je 0x411f51
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x14], ebx
jbe 0x411f43
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x411f3b
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x14]
jb 0x411f2c
jmp 0x411f43
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x411f51
mov eax, esi
jmp 0x411f81
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x411f74
call dword [0x431274]
jmp 0x411f81
lea ecx, [ebp - 0x28]
push ecx
push edi
call eax
cmp eax, ebx
je 0x411f6c
xor eax, eax
cmp eax, ebx
je 0x412065
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x411fa3
call dword [0x431274]
jmp 0x41205d
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x1c], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x412011
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x412006
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x411fdc
jmp 0x41201a
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x1c], ebx
jmp 0x41201a
call dword [0x431274]
mov dword [ebp - 0x1c], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x411f98
lea eax, [ebp - 0x28]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
cmp eax, ebx
jne 0x412057
call dword [0x431274]
mov dword [ebp - 0x1c], eax
push esi
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x4123a0
lea eax, [ebp + 0x470]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push 0x13
push dword [ebp - 0x28]
call dword [0x431084]
test eax, eax
mov eax, dword [ebp - 0x28]
je 0x412087
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp eax, ebx
jne 0x4123a0
push 0x40
lea eax, [ebp + 0xb8c]
push ebx
push eax
mov dword [ebp + 0xb88], 0x44
call fcn.0041dd90
xor eax, eax
mov dword [ebp + 0x428], ebx
add esp, 0xc
lea edi, [ebp + 0x42c]
stosd dword es:[edi], eax
mov esi, dword [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x470]
push eax
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x1c], ebx
mov byte [ebp + 0x470], bl
mov byte [ebp + 0x471], bl
mov byte [ebp + 0x472], bl
mov byte [ebp + 0x473], bl
mov byte [ebp + 0x474], bl
mov byte [ebp + 0x475], 5
call dword [0x431008]
test eax, eax
je 0x41218a
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 2
push esi
call dword [0x431084]
test eax, eax
jne 0x412131
call dword [0x431274]
cmp eax, 0x7a
jne 0x41218a
push dword [ebp - 0x28]
push 0x40
call dword [0x431144]
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push edi
push 2
push esi
call dword [0x431084]
test eax, eax
je 0x41217f
mov dword [ebp - 0x48], ebx
cmp dword [edi], ebx
jbe 0x41217f
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 0x1c]
call dword [0x431088]
test eax, eax
jne 0x41217b
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
add esi, 8
cmp eax, dword [edi]
jb 0x41215d
jmp 0x41217f
mov byte [ebp - 0x15], 1
cmp edi, ebx
je 0x41218a
push edi
call dword [0x4312c0]
cmp dword [ebp - 0x1c], ebx
je 0x412198
push dword [ebp - 0x1c]
call dword [0x431004]
cmp byte [ebp - 0x15], bl
jne 0x4122a3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], ebx
call fcn.0042df04
cmp eax, ebx
jne 0x41220b
push 0x110
lea eax, [ebp + 0x118]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x114]
push eax
mov dword [ebp + 0x114], 0x114
call dword [0x431140]
test eax, eax
je 0x412206
cmp dword [ebp + 0x118], 6
jne 0x412206
call dword [0x431274]
jmp 0x41223f
mov dword [ebp - 0x2c], ebx
jmp 0x412243
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x48], ebx
jbe 0x412237
lea ecx, [edx + 8]
cmp dword [ecx], ebx
je 0x41222c
inc eax
add ecx, 0xc
cmp eax, dword [ebp - 0x48]
jb 0x41221d
jmp 0x412237
imul eax, eax, 0xc
mov eax, dword [eax + edx]
mov dword [ebp - 0x2c], eax
xor esi, esi
push edx
call fcn.0042defe
mov eax, esi
cmp eax, ebx
jne 0x4122a3
lea eax, [ebp - 0x28]
push eax
push 0xa
call dword [0x431270]
push eax
call dword [0x43107c]
cmp dword [ebp - 0x28], ebx
je 0x4122a3
lea eax, [ebp - 0x1c]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x28]
call dword [0x431070]
push dword [ebp - 0x28]
cmp dword [ebp - 0x1c], ebx
jne 0x412282
call dword [0x431284]
jmp 0x4122a3
call dword [0x431284]
push 4
lea eax, [ebp - 0x2c]
push eax
push 0xc
push dword [ebp - 0x1c]
call dword [0x43105c]
test eax, eax
je 0x4122a3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
push str.userenv.dll
mov dword [ebp + 0xb90], str.Winsta0Default
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
call dword [0x4312a4]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x412307
mov esi, dword [0x431294]
push str.CreateEnvironmentBlock
push eax
call esi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov edi, eax
call esi
mov dword [ebp - 0x2c], eax
cmp edi, ebx
je 0x412307
push ebx
push dword [ebp - 0x34]
lea eax, [ebp - 0x14]
push eax
call edi
test eax, eax
je 0x412304
mov dword [ebp - 0x3c], 0x430
jmp 0x412307
mov dword [ebp - 0x14], ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x239]
push ebx
push eax
mov byte [ebp + 0x238], bl
call fcn.0041dd90
push dword [ebp - 0x24]
lea eax, [ebp + 0x238]
push esi
push eax
call fcn.0041efb5
add esp, 0x18
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push dword [ebp - 0x14]
lea eax, [ebp + 0x238]
push dword [ebp - 0x3c]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x34]
call dword [0x431078]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x428], ebx
je 0x412373
push dword [ebp + 0x428]
call dword [0x431284]
cmp dword [ebp + 0x42c], ebx
je 0x412387
push dword [ebp + 0x42c]
call dword [0x431284]
cmp dword [ebp - 0x2c], ebx
je 0x412392
push dword [ebp - 0x14]
call dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], ebx
je 0x4123a0
push dword [ebp - 0x1c]
call dword [0x431290]
cmp dword [ebp - 0x34], ebx
je 0x4123ae
push dword [ebp - 0x34]
call dword [0x431284]
mov eax, dword [ebp - 0x3c]
push ebx
push 1
lea ecx, [ebp - 0x88]
call fcn.00402b51
jmp 0x41242d
push 0x44
pop esi
push esi
lea eax, [ebp + 0xb88]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x454]
mov dword [ebp + 0xb88], esi
call fcn.00402a40
push eax
push ebx
call dword [0x43112c]
test eax, eax
je 0x41242d
push 0xdbba0
push dword [ebp + 0x428]
call dword [0x4310fc]
push dword [ebp + 0x428]
mov esi, dword [0x431284]
call esi
push dword [ebp + 0x42c]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
push 0x1388
call dword [0x43126c]
jmp 0x41255b
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 0x470], esp
push dword [ebp - 0x30]
call fcn.0040298e
lea ebx, [ebp - 0x68]
call fcn.0040dc3a
add esp, 0x1c
mov dword [ebp - 4], 0x4f
mov eax, dword [ebp - 0x54]
xor ebx, ebx
cmp eax, ebx
jbe 0x41254e
lea edi, [eax - 1]
lea eax, [ebp - 0x68]
call fcn.00402a20
cmp word [eax], 0x5c
jne 0x4124bd
mov edi, dword [ebp - 0x54]
dec edi
lea eax, [ebp - 0x68]
call fcn.00402a20
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x68]
call fcn.00402a40
lea ecx, [ebp - 0x68]
call fcn.00402c6c
cmp dword [ebp - 0x54], 3
jb 0x41254e
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x400]
call fcn.0040298e
mov eax, esi
call fcn.00402a40
push eax
call dword [0x431124]
cmp eax, 0xffffffff
je 0x4124f2
test al, 0x10
je 0x4124f2
xor edi, edi
inc edi
jmp 0x4124f4
xor edi, edi
push ebx
push 1
lea esi, [ebp + 0x400]
call fcn.00402d55
cmp edi, ebx
jne 0x41254e
sub esp, 0x1c
mov dword [ebp + 0x470], esp
mov ebx, esp
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov esi, esp
mov dword [ebp + 0x470], esp
push eax
call fcn.0040298e
call fcn.0040dca5
add esp, 0x1c
call fcn.0040dcef
add esp, 0x1c
test eax, eax
je 0x41254a
push 0
lea eax, [ebp - 0x68]
call fcn.00402a40
push eax
call dword [0x431120]
push 0
jmp 0x41254f
push ebx
push 1
lea esi, [ebp - 0x68]
call fcn.00402d55
xor ebx, ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], 0x400
mov dword [ebp - 4], 0x50
cmp byte [ebp - 0x4a], bl
jne 0x412a2c
mov eax, dword [ebp - 0x44]
add eax, 0x1c4
call fcn.00402a40
push 0x3ff
mov edi, eax
lea eax, [ebp + 0x685]
push ebx
push eax
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x34], ebx
mov byte [ebp + 0x684], bl
call fcn.0041dd90
or dword [ebp - 0x20], 0xffffffff
add esp, 0xc
lea esi, [ebp + 0x3e4]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x24], 0x3a98
call fcn.0040295b
lea esi, [ebp + 0x438]
call fcn.0040295b
push edi
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 0x52
call fcn.0040296e
push 0xffffffffffffffff
mov eax, esi
push 7
mov byte [ebp - 4], 0x53
push eax
lea esi, [ebp - 0x88]
mov dword [ebp - 0x3c], 0x50
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x54
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x53
call fcn.00402d55
xor edi, edi
cmp dword [ebp - 0x54], ebx
jbe 0x4126be
lea eax, [ebp - 0x68]
call fcn.00402a20
cmp word [eax], 0x3a
je 0x412662
lea eax, [ebp - 0x68]
call fcn.00402a20
cmp word [eax], 0x2f
je 0x412662
inc edi
cmp edi, dword [ebp - 0x54]
jb 0x41263e
jmp 0x4126be
push edi
push ebx
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0xbb0]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x3e4]
mov byte [ebp - 4], 0x55
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x53
call fcn.00402d55
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp - 0xac]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x56
call fcn.00402be0
push ebx
push 1
mov byte [ebp - 4], 0x53
call fcn.00402d55
xor edi, edi
lea eax, [ebp - 0x68]
call fcn.00402a20
cmp word [eax], 0x3a
jne 0x412753
inc edi
cmp dword [ebp - 0x54], edi
jbe 0x412753
lea eax, [ebp - 0x68]
call fcn.00402a20
cmp word [eax], 0x2f
je 0x4126ee
inc edi
cmp edi, dword [ebp - 0x54]
jb 0x4126d8
jmp 0x412753
push edi
push 1
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x400]
call fcn.00402a74
mov eax, esi
mov byte [ebp - 4], 0x57
call fcn.00402a40
push eax
call fcn.0041cf3b
pop ecx
movzx eax, ax
push 0xffffffffffffffff
mov dword [ebp - 0x3c], eax
push edi
lea eax, [ebp - 0x68]
push eax
lea esi, [ebp + 0x3c8]
call fcn.00402a74
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x58
call fcn.00402be0
push ebx
push 1
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x53
call fcn.00402d55
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x68]
lea ecx, [ebp + 0x438]
call fcn.00402be0
push ebx
push 1
lea esi, [ebp - 0x68]
call fcn.00402d55
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__rv:14.0__Gecko_20100101_Firefox_14.0.1
call dword [0x431480]
mov esi, dword [0x431490]
mov edi, eax
push 4
lea eax, [ebp - 0x24]
push eax
push 2
push edi
mov dword [ebp + 0x470], edi
call esi
push 4
lea eax, [ebp - 0x24]
push eax
push 8
push edi
call esi
push 4
lea eax, [ebp - 0x24]
push eax
push 7
push edi
call esi
cmp edi, ebx
je 0x4129ad
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x3c]
lea eax, [ebp + 0x3e4]
call fcn.00402a40
push eax
push edi
call dword [0x431498]
mov dword [ebp - 0x3c], eax
cmp eax, ebx
je 0x41298b
push ebx
push SysReAllocString
lea eax, [ebp + 0x430]
push eax
push ebx
push str.HTTP_1.0
lea eax, [ebp + 0x438]
mov dword [ebp + 0x430], str.text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_n
mov dword [ebp + 0x434], ebx
call fcn.00402a40
push eax
push 0x4333c0
push dword [ebp - 0x3c]
call dword [0x431488]
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x41298b
push ebx
push ebx
mov esi, str._r_n_r_n
push esi
call fcn.0041d19b
pop ecx
push eax
push esi
push dword [ebp - 0x34]
call dword [0x431494]
test eax, eax
je 0x41298b
mov edi, dword [0x43148c]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x20000013
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x41298b
cmp dword [ebp - 0x28], 0xc8
je 0x4128fe
cmp dword [ebp - 0x28], 0x12c
jbe 0x41298b
cmp dword [ebp - 0x28], 0x12f
ja 0x41298b
lea esi, [ebp + 0x454]
call fcn.0040295b
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x21
mov byte [ebp - 4], 0x59
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x4128eb
mov ecx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00402a4e
push ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.00402a40
push eax
push 0x21
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x4128eb
lea eax, [ebp - 0xc0]
push eax
mov eax, esi
call fcn.00402a40
push eax
call fcn.0040f4d5
pop ecx
pop ecx
mov byte [ebp - 0x15], al
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
jmp 0x41298b
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x20000005
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x41291e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov esi, dword [0x43149c]
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp + 0x684]
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0x14], ebx
call esi
jmp 0x41297f
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x412987
add dword [ebp - 0x2c], eax
lea ecx, [ebp + 0x684]
mov ebx, eax
push ecx
lea eax, [ebp - 0xc0]
call fcn.00401776
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], eax
jae 0x412985
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp + 0x684]
push eax
push dword [ebp - 0x34]
call esi
xor ebx, ebx
test eax, eax
jne 0x41293e
jmp 0x412987
xor ebx, ebx
mov byte [ebp - 0x15], 1
push dword [ebp + 0x470]
mov esi, dword [0x431484]
call esi
cmp dword [ebp - 0x3c], ebx
je 0x4129a3
push dword [ebp - 0x3c]
call esi
cmp dword [ebp - 0x34], ebx
je 0x4129ad
push dword [ebp - 0x34]
call esi
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x3e4]
mov byte [ebp - 4], 0x50
call fcn.00402d55
cmp byte [ebp - 0x15], bl
je 0x414895
xor ecx, ecx
inc ecx
xor edx, edx
lea eax, [ebp - 0xc0]
call fcn.0040ef7c
push 2
mov esi, eax
pop ecx
xor edx, edx
lea eax, [ebp - 0xc0]
call fcn.0040ef7c
cmp eax, ebx
mov dword [ebp - 0xb8], esi
jle 0x414895
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 0x470], esp
push dword [ebp - 0x30]
call fcn.0040298e
lea ecx, [ebp - 0xc0]
call fcn.0040ef9d
cmp al, bl
je 0x414895
cmp byte [ebp - 0x35], bl
je 0x413e87
push dword [ebp - 0x30]
lea esi, [ebp + 0x438]
call fcn.0040298e
xor eax, eax
mov byte [ebp - 4], 0x5a
push 0x208
mov word [ebp + 0x478], ax
lea eax, [ebp + 0x47a]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
push 0x104
lea eax, [ebp + 0x478]
push eax
call dword [0x43113c]
lea eax, [ebp + 0x478]
push eax
lea esi, [ebp + 0x454]
call fcn.0040296e
push str._regsvr32.exe
mov eax, esi
push eax
mov byte [ebp - 4], 0x5b
call fcn.004029bc
push 0x4376d0
lea eax, [ebp + 0x438]
call fcn.00402a40
push eax
call fcn.0041de0a
pop ecx
pop ecx
test eax, eax
je 0x412b5a
push 0x4376d4
lea esi, [ebp + 0x400]
call fcn.0040296e
mov edi, eax
push 0x4376d4
lea esi, [ebp - 0xac]
mov byte [ebp - 4], 0x5c
call fcn.0040296e
lea ecx, [ebp + 0x438]
push ecx
push eax
lea eax, [ebp + 0xbb0]
push eax
mov byte [ebp - 4], 0x5d
call fcn.0041a04a
push edi
push eax
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x5e
call fcn.0041a04a
add esp, 0x18
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0x5f
call fcn.00402be0
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x88]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0xbb0]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0xac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x5b
call fcn.00402d55
push str.__u
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push str.__s
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x438]
lea ecx, [ebp + 0x454]
call fcn.00402f35
push str.SYSTEM
call dword [0x431270]
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp - 0x88]
call fcn.0040e984
add esp, 0x1c
mov esi, eax
mov byte [ebp - 4], 0x60
call fcn.0040dc83
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x88]
mov byte [ebp - 0x3d], al
mov byte [ebp - 4], 0x5b
call fcn.00402d55
cmp byte [ebp - 0x3d], bl
je 0x4133d1
sub esp, 0x1c
lea eax, [ebp + 0x454]
mov esi, esp
mov dword [ebp + 0x470], esp
push eax
call fcn.0040298e
lea edi, [ebp - 0x88]
call fcn.0040120c
add esp, 0x1c
mov ecx, eax
mov byte [ebp - 4], 0x61
call fcn.0040294d
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x4133be
push 0x103
lea eax, [ebp + 0xa85]
push ebx
push eax
mov byte [ebp + 0xa84], bl
call fcn.0041dd90
mov esi, dword [ebp - 0x48]
push esi
call fcn.0041d110
add esp, 0x10
cmp eax, 2
jbe 0x412c6a
cmp byte [esi + 1], 0x3a
jne 0x412c6a
push esi
lea eax, [ebp + 0xa84]
push 0x104
push eax
call fcn.0041efb5
add esp, 0xc
jmp 0x412c98
push 0x104
lea eax, [ebp + 0xa84]
push eax
push ebx
call dword [0x431148]
lea eax, [ebp + 0xa84]
push eax
call dword [0x43133c]
push esi
lea eax, [ebp + 0xa84]
push eax
call dword [0x431340]
mov edi, 0x110
push edi
lea eax, [ebp + 0x118]
push ebx
push eax
call fcn.0041dd90
mov esi, dword [0x431140]
add esp, 0xc
lea eax, [ebp + 0x114]
push eax
mov dword [ebp + 0x114], 0x114
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
je 0x412cde
cmp dword [ebp + 0x118], 6
jne 0x412cde
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x20], ebx
jne 0x412f10
push edi
lea eax, [ebp + 0x22c]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x228]
push eax
mov dword [ebp + 0x228], 0x114
call esi
test eax, eax
je 0x412d2a
cmp dword [ebp + 0x22c], 5
jne 0x412d2a
cmp dword [ebp + 0x230], ebx
je 0x412e3e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
cmp eax, ebx
je 0x412d7e
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x412d70
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x412d68
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x412d59
jmp 0x412d70
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x412d7e
mov eax, esi
jmp 0x412dae
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x412da1
call dword [0x431274]
jmp 0x412dae
lea ecx, [ebp - 0x34]
push ecx
push edi
call eax
cmp eax, ebx
je 0x412d99
xor eax, eax
cmp eax, ebx
je 0x4130ad
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x412dd0
call dword [0x431274]
jmp 0x4130a5
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x412ebf
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x412eb4
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x412e0d
jmp 0x412ec8
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
je 0x412dc5
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x412ebf
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x412eb4
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x412e8a
jmp 0x412ec8
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x412ec8
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x412dc5
lea eax, [ebp - 0x34]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
cmp eax, ebx
jne 0x412f05
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
jmp 0x4130a5
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
cmp eax, ebx
je 0x412f67
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x412f59
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x412f51
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x412f42
jmp 0x412f59
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x412f67
mov eax, esi
jmp 0x412f97
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x412f8a
call dword [0x431274]
jmp 0x412f97
lea ecx, [ebp - 0x1c]
push ecx
push edi
call eax
cmp eax, ebx
je 0x412f82
xor eax, eax
cmp eax, ebx
je 0x41307b
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x412fb9
call dword [0x431274]
jmp 0x413073
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x413027
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x41301c
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x412ff2
jmp 0x413030
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x413030
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x412fae
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
cmp eax, ebx
jne 0x41306d
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x4133ad
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 0x470]
push eax
push 0x13
push dword [ebp - 0x1c]
call dword [0x431084]
test eax, eax
mov eax, dword [ebp - 0x1c]
je 0x4130a0
mov eax, dword [ebp + 0x470]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp eax, ebx
jne 0x4133ad
push 0x40
lea eax, [ebp + 0xb8c]
push ebx
push eax
mov dword [ebp + 0xb88], 0x44
call fcn.0041dd90
xor eax, eax
mov dword [ebp + 0x428], ebx
add esp, 0xc
lea edi, [ebp + 0x42c]
stosd dword es:[edi], eax
mov esi, dword [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x470]
push eax
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x14], ebx
mov byte [ebp + 0x470], bl
mov byte [ebp + 0x471], bl
mov byte [ebp + 0x472], bl
mov byte [ebp + 0x473], bl
mov byte [ebp + 0x474], bl
mov byte [ebp + 0x475], 5
call dword [0x431008]
test eax, eax
je 0x4131a3
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 2
push esi
call dword [0x431084]
test eax, eax
jne 0x41314a
call dword [0x431274]
cmp eax, 0x7a
jne 0x4131a3
push dword [ebp - 0x24]
push 0x40
call dword [0x431144]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push 2
push esi
call dword [0x431084]
test eax, eax
je 0x413198
mov dword [ebp - 0x2c], ebx
cmp dword [edi], ebx
jbe 0x413198
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 0x14]
call dword [0x431088]
test eax, eax
jne 0x413194
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add esi, 8
cmp eax, dword [edi]
jb 0x413176
jmp 0x413198
mov byte [ebp - 0x35], 1
cmp edi, ebx
je 0x4131a3
push edi
call dword [0x4312c0]
cmp dword [ebp - 0x14], ebx
je 0x4131b1
push dword [ebp - 0x14]
call dword [0x431004]
cmp byte [ebp - 0x35], bl
jne 0x4132b0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
cmp eax, ebx
jne 0x413218
push 0x110
lea eax, [ebp + 4]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [0x431140]
test eax, eax
je 0x413213
cmp dword [ebp + 4], 6
jne 0x413213
call dword [0x431274]
jmp 0x41324c
mov dword [ebp - 0x3c], ebx
jmp 0x413250
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x413244
lea ecx, [edx + 8]
cmp dword [ecx], ebx
je 0x413239
inc eax
add ecx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x41322a
jmp 0x413244
imul eax, eax, 0xc
mov eax, dword [eax + edx]
mov dword [ebp - 0x3c], eax
xor esi, esi
push edx
call fcn.0042defe
mov eax, esi
cmp eax, ebx
jne 0x4132b0
lea eax, [ebp - 0x1c]
push eax
push 0xa
call dword [0x431270]
push eax
call dword [0x43107c]
cmp dword [ebp - 0x1c], ebx
je 0x4132b0
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x1c]
call dword [0x431070]
push dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x41328f
call dword [0x431284]
jmp 0x4132b0
call dword [0x431284]
push 4
lea eax, [ebp - 0x3c]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [0x43105c]
test eax, eax
je 0x4132b0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
push str.userenv.dll
mov dword [ebp + 0xb90], str.Winsta0Default
mov dword [ebp - 0x20], 0x30
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [0x4312a4]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x413314
mov esi, dword [0x431294]
push str.CreateEnvironmentBlock
push eax
call esi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x14]
mov edi, eax
call esi
mov dword [ebp - 0x24], eax
cmp edi, ebx
je 0x413314
push ebx
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x413311
mov dword [ebp - 0x20], 0x430
jmp 0x413314
mov dword [ebp - 0x28], ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x239]
push ebx
push eax
mov byte [ebp + 0x238], bl
call fcn.0041dd90
push dword [ebp - 0x48]
lea eax, [ebp + 0x238]
push esi
push eax
call fcn.0041efb5
add esp, 0x18
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp + 0x238]
push dword [ebp - 0x20]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x34]
call dword [0x431078]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x428], ebx
je 0x413380
push dword [ebp + 0x428]
call dword [0x431284]
cmp dword [ebp + 0x42c], ebx
je 0x413394
push dword [ebp + 0x42c]
call dword [0x431284]
cmp dword [ebp - 0x24], ebx
je 0x41339f
push dword [ebp - 0x28]
call dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
je 0x4133ad
push dword [ebp - 0x14]
call dword [0x431290]
cmp dword [ebp - 0x34], ebx
je 0x4133bb
push dword [ebp - 0x34]
call dword [0x431284]
mov eax, dword [ebp - 0x3c]
push ebx
push 1
lea ecx, [ebp - 0x88]
call fcn.00402b51
xor edi, edi
inc edi
jmp 0x41343d
push 0x44
pop esi
push esi
lea eax, [ebp + 0xb88]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x454]
mov dword [ebp + 0xb88], esi
call fcn.00402a40
push eax
push ebx
call dword [0x43112c]
test eax, eax
je 0x41343d
push 0xdbba0
push dword [ebp + 0x428]
call dword [0x4310fc]
push dword [ebp + 0x428]
mov esi, dword [0x431284]
call esi
push dword [ebp + 0x42c]
call esi
push ebx
push edi
lea esi, [ebp + 0x454]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x438]
mov byte [ebp - 4], 0x50
call fcn.00402d55
push 0x1388
call dword [0x43126c]
push dword [ebp - 0x30]
lea esi, [ebp + 0x438]
call fcn.0040298e
xor eax, eax
mov byte [ebp - 4], 0x62
push 0x208
mov word [ebp + 0x478], ax
lea eax, [ebp + 0x47a]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
push 0x104
lea eax, [ebp + 0x478]
push eax
call dword [0x43113c]
lea eax, [ebp + 0x478]
push eax
lea esi, [ebp + 0x454]
call fcn.0040296e
push str._regsvr32.exe
mov eax, esi
push eax
mov byte [ebp - 4], 0x63
call fcn.004029bc
push 0x4376d0
lea eax, [ebp + 0x438]
call fcn.00402a40
push eax
call fcn.0041de0a
pop ecx
pop ecx
test eax, eax
je 0x413591
push 0x4376d4
lea esi, [ebp + 0x400]
call fcn.0040296e
mov dword [ebp + 0x470], eax
push 0x4376d4
lea esi, [ebp - 0xac]
mov byte [ebp - 4], 0x64
call fcn.0040296e
lea ecx, [ebp + 0x438]
push ecx
push eax
lea eax, [ebp + 0xbb0]
push eax
mov byte [ebp - 4], 0x65
call fcn.0041a04a
mov byte [ebp - 4], 0x66
push dword [ebp + 0x470]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041a04a
add esp, 0x18
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0x67
call fcn.00402be0
push ebx
push edi
lea esi, [ebp - 0x88]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0xbb0]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0xac]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x400]
mov byte [ebp - 4], 0x63
call fcn.00402d55
push 0x4376d8
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push str.__s
lea eax, [ebp + 0x454]
push eax
call fcn.004029bc
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x438]
lea ecx, [ebp + 0x454]
call fcn.00402f35
push str.SYSTEM
call dword [0x431270]
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp - 0x88]
call fcn.0040e984
add esp, 0x1c
mov esi, eax
mov byte [ebp - 4], 0x68
call fcn.0040dc83
pop ecx
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x88]
mov byte [ebp - 0x3d], al
mov byte [ebp - 4], 0x63
call fcn.00402d55
cmp byte [ebp - 0x3d], bl
je 0x413dfa
sub esp, 0x1c
lea eax, [ebp + 0x454]
mov esi, esp
mov dword [ebp + 0x470], esp
push eax
call fcn.0040298e
lea edi, [ebp - 0x88]
call fcn.0040120c
add esp, 0x1c
mov ecx, eax
mov byte [ebp - 4], 0x69
call fcn.0040294d
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x413dea
push 0x103
lea eax, [ebp + 0xa85]
push ebx
push eax
mov byte [ebp + 0xa84], bl
call fcn.0041dd90
mov esi, dword [ebp - 0x48]
push esi
call fcn.0041d110
add esp, 0x10
cmp eax, 2
jbe 0x41369f
cmp byte [esi + 1], 0x3a
jne 0x41369f
push esi
lea eax, [ebp + 0xa84]
push 0x104
push eax
call fcn.0041efb5
add esp, 0xc
jmp 0x4136cd
push 0x104
lea eax, [ebp + 0xa84]
push eax
push ebx
call dword [0x431148]
lea eax, [ebp + 0xa84]
push eax
call dword [0x43133c]
push esi
lea eax, [ebp + 0xa84]
push eax
call dword [0x431340]
mov esi, 0x110
push esi
lea eax, [ebp + 0x118]
push ebx
push eax
call fcn.0041dd90
mov edi, dword [0x431140]
add esp, 0xc
lea eax, [ebp + 0x114]
push eax
mov dword [ebp + 0x114], 0x114
mov dword [ebp - 0x20], ebx
call edi
test eax, eax
je 0x413713
cmp dword [ebp + 0x118], 6
jne 0x413713
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x20], ebx
jne 0x413942
push esi
lea eax, [ebp + 0x22c]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x228]
push eax
mov dword [ebp + 0x228], 0x114
call edi
test eax, eax
je 0x41375c
cmp dword [ebp + 0x22c], 5
jne 0x41375c
cmp dword [ebp + 0x230], ebx
je 0x413870
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
je 0x4137b0
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x4137a2
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x41379a
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x41378b
jmp 0x4137a2
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x4137b0
mov eax, esi
jmp 0x4137e0
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x4137d3
call dword [0x431274]
jmp 0x4137e0
lea ecx, [ebp - 0x34]
push ecx
push edi
call eax
test eax, eax
je 0x4137cb
xor eax, eax
cmp eax, ebx
je 0x413adf
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x413802
call dword [0x431274]
jmp 0x413ad7
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x4138f1
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x4138e6
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x41383f
jmp 0x4138fa
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
je 0x4137f7
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x4138f1
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x4138e6
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x4138bc
jmp 0x4138fa
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x4138fa
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x4137f7
lea eax, [ebp - 0x34]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
test eax, eax
jne 0x413937
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
jmp 0x413ad7
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
je 0x413999
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x41398b
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x413983
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x413974
jmp 0x41398b
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x413999
mov eax, esi
jmp 0x4139c9
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x4139bc
call dword [0x431274]
jmp 0x4139c9
lea ecx, [ebp - 0x1c]
push ecx
push edi
call eax
test eax, eax
je 0x4139b4
xor eax, eax
cmp eax, ebx
je 0x413aad
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x4139eb
call dword [0x431274]
jmp 0x413aa5
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x413a59
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x413a4e
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x413a24
jmp 0x413a62
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x413a62
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x4139e0
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
test eax, eax
jne 0x413a9f
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x413ddc
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 0x470]
push eax
push 0x13
push dword [ebp - 0x1c]
call dword [0x431084]
test eax, eax
mov eax, dword [ebp - 0x1c]
je 0x413ad2
mov eax, dword [ebp + 0x470]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp eax, ebx
jne 0x413ddc
push 0x40
lea eax, [ebp + 0xb8c]
push ebx
push eax
mov dword [ebp + 0xb88], 0x44
call fcn.0041dd90
xor eax, eax
mov dword [ebp + 0x428], ebx
add esp, 0xc
lea edi, [ebp + 0x42c]
stosd dword es:[edi], eax
mov esi, dword [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x470]
push eax
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x14], ebx
mov byte [ebp + 0x470], bl
mov byte [ebp + 0x471], bl
mov byte [ebp + 0x472], bl
mov byte [ebp + 0x473], bl
mov byte [ebp + 0x474], bl
mov byte [ebp + 0x475], 5
call dword [0x431008]
test eax, eax
je 0x413bd5
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 2
push esi
call dword [0x431084]
test eax, eax
jne 0x413b7c
call dword [0x431274]
cmp eax, 0x7a
jne 0x413bd5
push dword [ebp - 0x24]
push 0x40
call dword [0x431144]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push 2
push esi
call dword [0x431084]
test eax, eax
je 0x413bca
mov dword [ebp - 0x2c], ebx
cmp dword [edi], ebx
jbe 0x413bca
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 0x14]
call dword [0x431088]
test eax, eax
jne 0x413bc6
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add esi, 8
cmp eax, dword [edi]
jb 0x413ba8
jmp 0x413bca
mov byte [ebp - 0x35], 1
cmp edi, ebx
je 0x413bd5
push edi
call dword [0x4312c0]
cmp dword [ebp - 0x14], ebx
je 0x413be3
push dword [ebp - 0x14]
call dword [0x431004]
cmp byte [ebp - 0x35], bl
jne 0x413ce2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
jne 0x413c4a
push 0x110
lea eax, [ebp + 4]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [0x431140]
test eax, eax
je 0x413c45
cmp dword [ebp + 4], 6
jne 0x413c45
call dword [0x431274]
jmp 0x413c7e
mov dword [ebp - 0x3c], ebx
jmp 0x413c82
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x413c76
lea ecx, [edx + 8]
cmp dword [ecx], ebx
je 0x413c6b
inc eax
add ecx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x413c5c
jmp 0x413c76
imul eax, eax, 0xc
mov eax, dword [eax + edx]
mov dword [ebp - 0x3c], eax
xor esi, esi
push edx
call fcn.0042defe
mov eax, esi
cmp eax, ebx
jne 0x413ce2
lea eax, [ebp - 0x1c]
push eax
push 0xa
call dword [0x431270]
push eax
call dword [0x43107c]
cmp dword [ebp - 0x1c], ebx
je 0x413ce2
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x1c]
call dword [0x431070]
push dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x413cc1
call dword [0x431284]
jmp 0x413ce2
call dword [0x431284]
push 4
lea eax, [ebp - 0x3c]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [0x43105c]
test eax, eax
je 0x413ce2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
push str.userenv.dll
mov dword [ebp + 0xb90], str.Winsta0Default
mov dword [ebp - 0x20], 0x30
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [0x4312a4]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x413d46
mov esi, dword [0x431294]
push str.CreateEnvironmentBlock
push eax
call esi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x14]
mov edi, eax
call esi
mov dword [ebp - 0x24], eax
cmp edi, ebx
je 0x413d46
push ebx
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x413d43
mov dword [ebp - 0x20], 0x430
jmp 0x413d46
mov dword [ebp - 0x28], ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x239]
push ebx
push eax
mov byte [ebp + 0x238], bl
call fcn.0041dd90
push dword [ebp - 0x48]
lea eax, [ebp + 0x238]
push esi
push eax
call fcn.0041efb5
add esp, 0x18
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp + 0x238]
push dword [ebp - 0x20]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x34]
call dword [0x431078]
cmp dword [ebp + 0x428], ebx
je 0x413daf
push dword [ebp + 0x428]
call dword [0x431284]
cmp dword [ebp + 0x42c], ebx
je 0x413dc3
push dword [ebp + 0x42c]
call dword [0x431284]
cmp dword [ebp - 0x24], ebx
je 0x413dce
push dword [ebp - 0x28]
call dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
je 0x413ddc
push dword [ebp - 0x14]
call dword [0x431290]
cmp dword [ebp - 0x34], ebx
je 0x413dea
push dword [ebp - 0x34]
call dword [0x431284]
push ebx
push 1
lea ecx, [ebp - 0x88]
call fcn.00402b51
jmp 0x413e66
push 0x44
pop esi
push esi
lea eax, [ebp + 0xb88]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x454]
mov dword [ebp + 0xb88], esi
call fcn.00402a40
push eax
push ebx
call dword [0x43112c]
test eax, eax
je 0x413e66
push 0xdbba0
push dword [ebp + 0x428]
call dword [0x4310fc]
push dword [ebp + 0x428]
mov esi, dword [0x431284]
call esi
push dword [ebp + 0x42c]
call esi
push ebx
push 1
lea esi, [ebp + 0x454]
call fcn.00402d55
push ebx
push 1
lea esi, [ebp + 0x438]
call fcn.00402d55
jmp 0x414895
cmp byte [ebp - 0x49], bl
je 0x414819
mov edi, 0x4376d4
push edi
lea esi, [ebp - 0xac]
call fcn.0040296e
mov dword [ebp + 0x470], eax
push edi
lea esi, [ebp + 0xbb0]
mov byte [ebp - 4], 0x6a
call fcn.0040296e
mov byte [ebp - 4], 0x6b
push dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041a04a
mov byte [ebp - 4], 0x6c
push dword [ebp + 0x470]
push eax
lea eax, [ebp + 0x454]
push eax
call fcn.0041a04a
add esp, 0x18
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x88]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0xbb0]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp - 0xac]
mov byte [ebp - 4], 0x70
call fcn.00402d55
push 0x4376d0
lea esi, [ebp + 0x3c8]
call fcn.0040296e
mov ecx, dword [ebp - 0x44]
add ecx, 0x1fc
push ecx
push eax
lea eax, [ebp + 0x400]
push eax
mov byte [ebp - 4], 0x71
call fcn.0041a04a
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x454]
mov byte [ebp - 4], 0x72
call fcn.00402f35
push ebx
push edi
lea esi, [ebp + 0x400]
call fcn.00402d55
push ebx
push edi
lea esi, [ebp + 0x3c8]
mov byte [ebp - 4], 0x70
call fcn.00402d55
push str.SYSTEM
call dword [0x431270]
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp + 0x400]
call fcn.0040e984
add esp, 0x1c
mov esi, eax
mov byte [ebp - 4], 0x73
call fcn.0040dc83
pop ecx
xor ebx, ebx
push ebx
push edi
lea esi, [ebp + 0x400]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 0x70
call fcn.00402d55
cmp byte [ebp - 0x49], bl
je 0x4147a0
sub esp, 0x1c
lea eax, [ebp + 0x454]
mov esi, esp
mov dword [ebp + 0x470], esp
push eax
call fcn.0040298e
lea edi, [ebp + 0x400]
call fcn.0040120c
add esp, 0x1c
mov ecx, eax
mov byte [ebp - 4], 0x74
call fcn.0040294d
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x414793
push 0x103
lea eax, [ebp + 0xa85]
push ebx
push eax
mov byte [ebp + 0xa84], bl
call fcn.0041dd90
mov esi, dword [ebp - 0x48]
push esi
call fcn.0041d110
add esp, 0x10
cmp eax, 2
jbe 0x414048
cmp byte [esi + 1], 0x3a
jne 0x414048
push esi
lea eax, [ebp + 0xa84]
push 0x104
push eax
call fcn.0041efb5
add esp, 0xc
jmp 0x414076
push 0x104
lea eax, [ebp + 0xa84]
push eax
push ebx
call dword [0x431148]
lea eax, [ebp + 0xa84]
push eax
call dword [0x43133c]
push esi
lea eax, [ebp + 0xa84]
push eax
call dword [0x431340]
mov esi, 0x110
push esi
lea eax, [ebp + 0x118]
push ebx
push eax
call fcn.0041dd90
mov edi, dword [0x431140]
add esp, 0xc
lea eax, [ebp + 0x114]
push eax
mov dword [ebp + 0x114], 0x114
mov dword [ebp - 0x20], ebx
call edi
test eax, eax
je 0x4140bc
cmp dword [ebp + 0x118], 6
jne 0x4140bc
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x20], ebx
jne 0x4142eb
push esi
lea eax, [ebp + 0x22c]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x228]
push eax
mov dword [ebp + 0x228], 0x114
call edi
test eax, eax
je 0x414105
cmp dword [ebp + 0x22c], 5
jne 0x414105
cmp dword [ebp + 0x230], ebx
je 0x414219
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
je 0x414159
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x41414b
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x414143
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x414134
jmp 0x41414b
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x414159
mov eax, esi
jmp 0x414189
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x41417c
call dword [0x431274]
jmp 0x414189
lea ecx, [ebp - 0x34]
push ecx
push edi
call eax
test eax, eax
je 0x414174
xor eax, eax
cmp eax, ebx
je 0x414488
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x4141ab
call dword [0x431274]
jmp 0x414480
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x41429a
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x41428f
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x4141e8
jmp 0x4142a3
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
je 0x4141a0
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x41429a
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x41428f
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x414265
jmp 0x4142a3
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x4142a3
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x4141a0
lea eax, [ebp - 0x34]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
test eax, eax
jne 0x4142e0
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
jmp 0x414480
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
je 0x414342
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x414334
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x41432c
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x41431d
jmp 0x414334
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
xor esi, esi
push ecx
call fcn.0042defe
cmp esi, ebx
je 0x414342
mov eax, esi
jmp 0x414372
push str.wtsapi32.dll
call dword [0x4312a4]
push str.WTSQueryUserToken
push eax
call dword [0x431294]
cmp eax, ebx
jne 0x414365
call dword [0x431274]
jmp 0x414372
lea ecx, [ebp - 0x1c]
push ecx
push edi
call eax
test eax, eax
je 0x41435d
xor eax, eax
cmp eax, ebx
je 0x414456
push ebx
push 2
call fcn.0041c122
mov edi, eax
cmp edi, 0xffffffff
jne 0x414394
call dword [0x431274]
jmp 0x41444e
push 0x228
lea eax, [ebp + 0x85c]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x14], 0x490
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x858]
push eax
push edi
mov dword [ebp + 0x858], 0x22c
call fcn.0041c128
test eax, eax
je 0x414402
lea eax, [ebp + 0x87c]
push str.explorer.exe
push eax
call fcn.0041ead6
pop ecx
pop ecx
test eax, eax
je 0x4143f7
lea eax, [ebp + 0x858]
push eax
push edi
call fcn.0041c12e
test eax, eax
jne 0x4143cd
jmp 0x41440b
mov esi, dword [ebp + 0x860]
mov dword [ebp - 0x14], ebx
jmp 0x41440b
call dword [0x431274]
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [0x431284]
call edi
push esi
push ebx
push 0x400
call dword [0x431104]
mov esi, eax
cmp esi, ebx
je 0x414389
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
push esi
call dword [0x43107c]
test eax, eax
jne 0x414448
call dword [0x431274]
mov dword [ebp - 0x14], eax
push esi
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x414785
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 0x470]
push eax
push 0x13
push dword [ebp - 0x1c]
call dword [0x431084]
test eax, eax
mov eax, dword [ebp - 0x1c]
je 0x41447b
mov eax, dword [ebp + 0x470]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp eax, ebx
jne 0x414785
push 0x40
lea eax, [ebp + 0xb8c]
push ebx
push eax
mov dword [ebp + 0xb88], 0x44
call fcn.0041dd90
xor eax, eax
mov dword [ebp + 0x428], ebx
add esp, 0xc
lea edi, [ebp + 0x42c]
stosd dword es:[edi], eax
mov esi, dword [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x470]
push eax
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x14], ebx
mov byte [ebp + 0x470], bl
mov byte [ebp + 0x471], bl
mov byte [ebp + 0x472], bl
mov byte [ebp + 0x473], bl
mov byte [ebp + 0x474], bl
mov byte [ebp + 0x475], 5
call dword [0x431008]
test eax, eax
je 0x41457e
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 2
push esi
call dword [0x431084]
test eax, eax
jne 0x414525
call dword [0x431274]
cmp eax, 0x7a
jne 0x41457e
push dword [ebp - 0x24]
push 0x40
call dword [0x431144]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push 2
push esi
call dword [0x431084]
test eax, eax
je 0x414573
mov dword [ebp - 0x2c], ebx
cmp dword [edi], ebx
jbe 0x414573
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 0x14]
call dword [0x431088]
test eax, eax
jne 0x41456f
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add esi, 8
cmp eax, dword [edi]
jb 0x414551
jmp 0x414573
mov byte [ebp - 0x35], 1
cmp edi, ebx
je 0x41457e
push edi
call dword [0x4312c0]
cmp dword [ebp - 0x14], ebx
je 0x41458c
push dword [ebp - 0x14]
call dword [0x431004]
cmp byte [ebp - 0x35], bl
jne 0x41468b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
call fcn.0042df04
test eax, eax
jne 0x4145f3
push 0x110
lea eax, [ebp + 4]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [0x431140]
test eax, eax
je 0x4145ee
cmp dword [ebp + 4], 6
jne 0x4145ee
call dword [0x431274]
jmp 0x414627
mov dword [ebp - 0x3c], ebx
jmp 0x41462b
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov esi, 0x490
cmp dword [ebp - 0x24], ebx
jbe 0x41461f
lea ecx, [edx + 8]
cmp dword [ecx], ebx
je 0x414614
inc eax
add ecx, 0xc
cmp eax, dword [ebp - 0x24]
jb 0x414605
jmp 0x41461f
imul eax, eax, 0xc
mov eax, dword [eax + edx]
mov dword [ebp - 0x3c], eax
xor esi, esi
push edx
call fcn.0042defe
mov eax, esi
cmp eax, ebx
jne 0x41468b
lea eax, [ebp - 0x1c]
push eax
push 0xa
call dword [0x431270]
push eax
call dword [0x43107c]
cmp dword [ebp - 0x1c], ebx
je 0x41468b
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x1c]
call dword [0x431070]
push dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x41466a
call dword [0x431284]
jmp 0x41468b
call dword [0x431284]
push 4
lea eax, [ebp - 0x3c]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [0x43105c]
test eax, eax
je 0x41468b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
push str.userenv.dll
mov dword [ebp + 0xb90], str.Winsta0Default
mov dword [ebp - 0x20], 0x30
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [0x4312a4]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4146ef
mov esi, dword [0x431294]
push str.CreateEnvironmentBlock
push eax
call esi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x14]
mov edi, eax
call esi
mov dword [ebp - 0x24], eax
cmp edi, ebx
je 0x4146ef
push ebx
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4146ec
mov dword [ebp - 0x20], 0x430
jmp 0x4146ef
mov dword [ebp - 0x28], ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x239]
push ebx
push eax
mov byte [ebp + 0x238], bl
call fcn.0041dd90
push dword [ebp - 0x48]
lea eax, [ebp + 0x238]
push esi
push eax
call fcn.0041efb5
add esp, 0x18
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp + 0x238]
push dword [ebp - 0x20]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x34]
call dword [0x431078]
cmp dword [ebp + 0x428], ebx
je 0x414758
push dword [ebp + 0x428]
call dword [0x431284]
cmp dword [ebp + 0x42c], ebx
je 0x41476c
push dword [ebp + 0x42c]
call dword [0x431284]
cmp dword [ebp - 0x24], ebx
je 0x414777
push dword [ebp - 0x28]
call dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
je 0x414785
push dword [ebp - 0x14]
call dword [0x431290]
cmp dword [ebp - 0x34], ebx
je 0x414793
push dword [ebp - 0x34]
call dword [0x431284]
lea ecx, [ebp + 0x400]
call fcn.00402943
jmp 0x41480c
push 0x44
pop esi
push esi
lea eax, [ebp + 0xb88]
push ebx
push eax
call fcn.0041dd90
add esp, 0xc
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp + 0xb88]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x454]
mov dword [ebp + 0xb88], esi
call fcn.00402a40
push eax
push ebx
call dword [0x43112c]
test eax, eax
je 0x41480c
push 0xdbba0
push dword [ebp + 0x428]
call dword [0x4310fc]
push dword [ebp + 0x428]
mov esi, dword [0x431284]
call esi
push dword [ebp + 0x42c]
call esi
lea esi, [ebp + 0x454]
call fcn.004029b2
jmp 0x414895
cmp byte [ebp - 0x69], bl
je 0x414895
push str.SYSTEM
call dword [0x431270]
sub esp, 0x1c
mov ecx, eax
mov ebx, esp
mov dword [ebp + 0x470], esp
call fcn.0040ed93
lea ebx, [ebp - 0x88]
call fcn.0040e984
add esp, 0x1c
mov esi, eax
mov byte [ebp - 4], 0x75
call fcn.0040dc83
pop ecx
lea esi, [ebp - 0x88]
mov bl, al
call fcn.004029b2
test bl, bl
jne 0x414895
xor eax, eax
cmp byte [ebp - 0x6a], al
setne al
push eax
mov eax, dword [ebp - 0x44]
push 0
add eax, 0x1fc
call fcn.00402a40
push eax
mov eax, dword [ebp - 0x30]
call fcn.00402a40
push eax
push 0x4368ac
push 0
call dword [0x431300]
lea eax, [ebp - 0xc0]
call fcn.00401718
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xbcc]
xor ecx, ebp
call fcn.0041c82b
add ebp, 0xbd0
leave
ret 4