Function at 0x461d30
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Create thread
Link many functions at runtime
Print debug messages
Read .ini file
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5398cb
mov eax, dword fs:[0]
push eax
mov eax, 0x2d70
call fcn.004fa800
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2cb4], ecx
xor eax, eax
mov word [ebp - 0xa34], ax
push 0x3fe
push 0
lea ecx, [ebp - 0xa32]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x200
lea edx, [ebp - 0xa34]
push edx
mov ecx, dword [ebp - 0x2cb4]
call fcn.0046f7c0
mov dword [ebp - 0xe60], 0
mov dword [ebp - 0xe5c], 0
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x630], 0
push 0x548b6c
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.NtSuspendProcess
push 0x548b44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa40], eax
push str.NtResumeProcess
push 0x548b44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xe70], eax
push str.OpenDoc_Start_
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x10d8], 3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xa3c], ecx
cmp dword [ebp - 0xa3c], 0
jne 0x461e50
mov dword [ebp - 0x2cb8], 0
jmp 0x461f1a
mov edx, dword [ebp - 0xa3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x461e7b
mov dword [ebp - 0x2cbc], 0
jmp 0x461f0e
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x27a8], esp
mov eax, dword [ebp - 0x27ac]
mov dword [ebp - 0x2cbc], eax
cmp dword [ebp - 0x27a8], 0
je 0x461ea9
cmp dword [ebp - 0xa3c], 0
jne 0x461eb5
mov dword [ebp - 0x2cbc], 0
jmp 0x461f0e
mov ecx, dword [ebp - 0x27a8]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x27a8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa3c]
push ecx
push 0
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x27a4], eax
cmp dword [ebp - 0x27a4], 0
jne 0x461f02
mov dword [ebp - 0x2cbc], 0
jmp 0x461f0e
mov eax, dword [ebp - 0x27a8]
mov dword [ebp - 0x2cbc], eax
mov ecx, dword [ebp - 0x2cbc]
mov dword [ebp - 0x2cb8], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xa3c], edx
cmp dword [ebp - 0xa3c], 0
jne 0x461f3b
mov dword [ebp - 0x2cc0], 0
jmp 0x462005
mov eax, dword [ebp - 0xa3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x461f66
mov dword [ebp - 0x2cc4], 0
jmp 0x461ff9
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x27b4], esp
mov ecx, dword [ebp - 0x27b8]
mov dword [ebp - 0x2cc4], ecx
cmp dword [ebp - 0x27b4], 0
je 0x461f94
cmp dword [ebp - 0xa3c], 0
jne 0x461fa0
mov dword [ebp - 0x2cc4], 0
jmp 0x461ff9
mov edx, dword [ebp - 0x27b4]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x27b4]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa3c]
push edx
push 0
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x27b0], eax
cmp dword [ebp - 0x27b0], 0
jne 0x461fed
mov dword [ebp - 0x2cc4], 0
jmp 0x461ff9
mov ecx, dword [ebp - 0x27b4]
mov dword [ebp - 0x2cc4], ecx
mov edx, dword [ebp - 0x2cc4]
mov dword [ebp - 0x2cc0], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x462026
mov dword [ebp - 0x2cc8], 0
jmp 0x4620f0
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462051
mov dword [ebp - 0x2ccc], 0
jmp 0x4620e4
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x27c0], esp
mov edx, dword [ebp - 0x27c4]
mov dword [ebp - 0x2ccc], edx
cmp dword [ebp - 0x27c0], 0
je 0x46207f
cmp dword [ebp - 0xa3c], 0
jne 0x46208b
mov dword [ebp - 0x2ccc], 0
jmp 0x4620e4
mov eax, dword [ebp - 0x27c0]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x27c0]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x27bc], eax
cmp dword [ebp - 0x27bc], 0
jne 0x4620d8
mov dword [ebp - 0x2ccc], 0
jmp 0x4620e4
mov edx, dword [ebp - 0x27c0]
mov dword [ebp - 0x2ccc], edx
mov eax, dword [ebp - 0x2ccc]
mov dword [ebp - 0x2cc8], eax
mov ecx, dword [ebp - 0x2cb8]
push ecx
mov edx, dword [ebp - 0x2cc0]
push edx
mov eax, dword [ebp - 0x2cc8]
push eax
push str.OpenDoc
call fcn.0047c040
add esp, 0x10
mov ecx, dword [ebp - 0x2cb4]
cmp dword [ecx + 0x41c], 0
jne 0x46213a
lea edx, [ebp - 0xa34]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x2cb4]
mov dword [ecx + 0x41c], eax
mov edx, dword [ebp - 0x2cb4]
mov eax, dword [edx + 0x41c]
mov dword [ebp - 0xe58], eax
cmp dword [ebp - 0xe58], 0
jne 0x462264
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10ec], eax
lea ecx, [ebp - 0x2738]
mov dword [ebp - 0x273c], ecx
push 3
lea edx, [ebp - 0xa34]
push edx
lea ecx, [ebp - 0x273c]
call fcn.00470670
lea eax, [ebp - 0x273c]
mov dword [ebp - 0x2cd0], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x2cd0]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10ec]
push ecx
push str.1178_Error__d__LoadLibrary___s_
call fcn.0047c040
add esp, 0x8c
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x273c]
mov dword [ebp - 0x27c8], edx
lea eax, [ebp - 0x2738]
cmp dword [ebp - 0x27c8], eax
je 0x4621f4
mov ecx, dword [ebp - 0x27c8]
push ecx
call fcn.004f84cf
add esp, 4
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x10e8]
call fcn.004514d0
mov dword [ebp - 4], 1
lea edx, [ebp - 0xa34]
push edx
push 0x548ac4
lea eax, [ebp - 0x10e8]
push eax
call fcn.00451560
add esp, 0xc
push 0x10
push 0x548abc
mov ecx, dword [ebp - 0x10e8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x2740], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e8]
call fcn.0044f990
mov eax, dword [ebp - 0x2740]
jmp 0x464e18
push str.CControlDll_Add
mov edx, dword [ebp - 0xe58]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xe60], eax
push str.CControlDll_GetNum
mov eax, dword [ebp - 0xe58]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xe5c], eax
push str.CControlDll_Del
mov ecx, dword [ebp - 0xe58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x634], eax
push str.CControlDll_GetByPwd
mov edx, dword [ebp - 0xe58]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xe60], 0
je 0x4622e6
cmp dword [ebp - 0xe5c], 0
je 0x4622e6
cmp dword [ebp - 0x634], 0
je 0x4622e6
cmp dword [ebp - 0x18], 0
jne 0x4623a4
push str.1201_FreeLibrary_error
call fcn.0047c040
add esp, 4
push 1
lea eax, [ebp - 0x2744]
push eax
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2cd4], eax
mov ecx, dword [ebp - 0x2cd4]
mov dword [ebp - 0x27d0], ecx
mov dword [ebp - 4], 2
push 0x34
lea edx, [ebp - 0x2748]
push edx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x27d8], eax
mov eax, dword [ebp - 0x27d0]
mov ecx, dword [eax]
mov dword [ebp - 0x27d4], ecx
mov edx, dword [ebp - 0x27d8]
mov eax, dword [edx]
mov dword [ebp - 0x27dc], eax
push 0x10
mov ecx, dword [ebp - 0x27d4]
push ecx
mov edx, dword [ebp - 0x27dc]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2748]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2744]
call fcn.0044f990
lea eax, [ebp - 0xa34]
push eax
push 0x548a38
call fcn.0047c040
add esp, 8
xor eax, eax
jmp 0x464e18
call dword [ebp - 0xe5c]
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 8
jl 0x462467
push 1
lea ecx, [ebp - 0x274c]
push ecx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2cd8], eax
mov edx, dword [ebp - 0x2cd8]
mov dword [ebp - 0x27e8], edx
mov dword [ebp - 4], 3
push 0x39
lea eax, [ebp - 0x2750]
push eax
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x27f0], eax
mov ecx, dword [ebp - 0x27e8]
mov edx, dword [ecx]
mov dword [ebp - 0x27ec], edx
mov eax, dword [ebp - 0x27f0]
mov ecx, dword [eax]
mov dword [ebp - 0x27f4], ecx
push 0x10
mov edx, dword [ebp - 0x27ec]
push edx
mov eax, dword [ebp - 0x27f4]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2750]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274c]
call fcn.0044f990
push 0x548a18
call fcn.0047c040
add esp, 4
xor eax, eax
jmp 0x464e18
mov ecx, dword [ebp + 8]
push ecx
call fcn.00476860
add esp, 4
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10e4], eax
call fcn.0047bee0
test eax, eax
je 0x4624af
push ecx
mov ecx, esp
mov dword [ebp - 0x2754], esp
mov edx, dword [ebp + 8]
push edx
call fcn.0044f380
mov dword [ebp - 0x2cdc], eax
call fcn.0047bf30
add esp, 4
mov dword [ebp - 0x2ce0], eax
xor eax, eax
mov word [ebp - 0xe54], ax
push 0x3fe
push 0
lea ecx, [ebp - 0xe52]
push ecx
call fcn.004f8090
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xe54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x10d4], 0
push 0x40
push 0
lea ecx, [ebp - 0x10d0]
push ecx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x10d4], 0x44
mov edx, 5
mov word [ebp - 0x10a4], dx
mov dword [ebp - 0xa54], 0
xor eax, eax
mov dword [ebp - 0xa50], eax
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], eax
push 0x10
push 0
lea ecx, [ebp - 0xa54]
push ecx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xe64], 0
mov dword [ebp - 0x1088], 0
push 0x548a04
call fcn.0047c040
add esp, 4
xor edx, edx
mov word [ebp - 0x1084], dx
push 0x200
push 0
lea eax, [ebp - 0x1082]
push eax
call fcn.004f8090
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x1084]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.004fad12
add esp, 0x24
mov dword [ebp - 0xe78], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x4625d9
mov dword [ebp - 0x2ce4], 0
jmp 0x4626a3
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462604
mov dword [ebp - 0x2ce8], 0
jmp 0x462697
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x280c], esp
mov edx, dword [ebp - 0x2810]
mov dword [ebp - 0x2ce8], edx
cmp dword [ebp - 0x280c], 0
je 0x462632
cmp dword [ebp - 0xa3c], 0
jne 0x46263e
mov dword [ebp - 0x2ce8], 0
jmp 0x462697
mov eax, dword [ebp - 0x280c]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x280c]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2808], eax
cmp dword [ebp - 0x2808], 0
jne 0x46268b
mov dword [ebp - 0x2ce8], 0
jmp 0x462697
mov edx, dword [ebp - 0x280c]
mov dword [ebp - 0x2ce8], edx
mov eax, dword [ebp - 0x2ce8]
mov dword [ebp - 0x2ce4], eax
mov ecx, dword [ebp - 0x2ce4]
push ecx
push 0x5489f4
call fcn.0047c040
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xe74]
call fcn.0044f380
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xe74]
call fcn.0046f900
mov dword [ebp - 0xa38], 0
push 0
push str.WINWORD.EXE
lea ecx, [ebp - 0xe74]
call fcn.0046f880
test eax, eax
jne 0x462728
push 0
push str.EXCEL.EXE
lea ecx, [ebp - 0xe74]
call fcn.0046f880
test eax, eax
jne 0x462728
push 0
push 0x5489ac
lea ecx, [ebp - 0xe74]
call fcn.0046f880
test eax, eax
je 0x463257
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0x10f0], 0
mov byte [ebp - 4], 5
push 0x5489a0
call fcn.0047c040
add esp, 4
push 0x2001f
push str.SOFTWAREMicrosoftOffice12.0MOC
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10f4]
call fcn.00464ec0
test eax, eax
jne 0x4631da
push 0x548948
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x18fc], 0x400
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x1900]
call fcn.004514d0
mov byte [ebp - 4], 6
mov eax, str.C:Program_FilesMicrosoft_OfficeOffice12_
test eax, eax
jne 0x4627b0
mov dword [ebp - 0x2858], 0
jmp 0x4627c3
push str.C:Program_FilesMicrosoft_OfficeOffice12_
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x2858], eax
mov ecx, dword [ebp - 0x2858]
push ecx
push str.C:Program_FilesMicrosoft_OfficeOffice12_
lea ecx, [ebp - 0x1900]
call fcn.0044fb50
push str.OFFICE12
push str.OFFICE11
lea ecx, [ebp - 0x1900]
call fcn.00459400
mov edx, dword [ebp - 0x1900]
sub edx, 0x10
mov dword [ebp - 0x2898], edx
mov eax, dword [ebp - 0x2898]
push eax
call fcn.0044fd30
add esp, 4
mov dword [ebp - 0x289c], eax
mov ecx, dword [ebp - 0x289c]
add ecx, 0x10
mov dword [ebp - 0x18f8], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0xe74]
mov dword [ebp - 0x28a0], edx
mov eax, dword [ebp - 0x28a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x1904]
call fcn.0044f380
mov byte [ebp - 4], 8
xor ecx, ecx
jl 0x46286b
mov edx, dword [ebp - 0x1904]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x28ac], eax
cmp dword [ebp - 0x28ac], 0
jge 0x462875
push 0x80070057
call fcn.0044ee20
xor ecx, ecx
shl ecx, 1
mov edx, dword [ebp - 0x1904]
mov ax, word [edx + ecx]
mov word [ebp - 0x28ae], ax
movzx ecx, word [ebp - 0x28ae]
mov dword [ebp - 0x2cec], ecx
mov edx, dword [ebp - 0x2cec]
sub edx, 0x45
mov dword [ebp - 0x2cec], edx
cmp dword [ebp - 0x2cec], 0x32
ja case.0x4628c0.1
mov eax, dword [ebp - 0x2cec]
movzx ecx, byte [eax + 0x464e4c]
jmp dword [ecx*4 + 0x464e3c]
mov edx, str.Wordconv.exe
test edx, edx
jne 0x4628dc
mov dword [ebp - 0x28b4], 0
jmp 0x4628ef
push str.Wordconv.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 0x28b4]
push eax
push str.Wordconv.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov ecx, dword [ebp - 0x1900]
mov dword [ebp - 0x28b8], ecx
mov edx, dword [ebp - 0x28b8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462a38
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x46294b
mov dword [ebp - 0x2cf0], 0
jmp 0x462a15
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462976
mov dword [ebp - 0x2cf4], 0
jmp 0x462a09
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x28c0], esp
mov edx, dword [ebp - 0x28c4]
mov dword [ebp - 0x2cf4], edx
cmp dword [ebp - 0x28c0], 0
je 0x4629a4
cmp dword [ebp - 0xa3c], 0
jne 0x4629b0
mov dword [ebp - 0x2cf4], 0
jmp 0x462a09
mov eax, dword [ebp - 0x28c0]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x28c0]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28bc], eax
cmp dword [ebp - 0x28bc], 0
jne 0x4629fd
mov dword [ebp - 0x2cf4], 0
jmp 0x462a09
mov edx, dword [ebp - 0x28c0]
mov dword [ebp - 0x2cf4], edx
mov eax, dword [ebp - 0x2cf4]
mov dword [ebp - 0x2cf0], eax
mov ecx, dword [ebp - 0x2cf0]
push ecx
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov dword [ebp - 0xa38], 1
jmp 0x462bb2
lea edx, [ebp - 0x18f8]
push edx
lea ecx, [ebp - 0x1900]
call fcn.0044f9d0
mov eax, str.wordconv.exe
test eax, eax
jne 0x462a5f
mov dword [ebp - 0x28c8], 0
jmp 0x462a72
push str.wordconv.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x28c8], eax
mov ecx, dword [ebp - 0x28c8]
push ecx
push str.wordconv.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov edx, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], edx
cmp dword [ebp - 0xa3c], 0
jne 0x462aad
mov dword [ebp - 0x2cf8], 0
jmp 0x462b77
mov eax, dword [ebp - 0xa3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462ad8
mov dword [ebp - 0x2cfc], 0
jmp 0x462b6b
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x28d0], esp
mov ecx, dword [ebp - 0x28d4]
mov dword [ebp - 0x2cfc], ecx
cmp dword [ebp - 0x28d0], 0
je 0x462b06
cmp dword [ebp - 0xa3c], 0
jne 0x462b12
mov dword [ebp - 0x2cfc], 0
jmp 0x462b6b
mov edx, dword [ebp - 0x28d0]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x28d0]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa3c]
push edx
push 0
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28cc], eax
cmp dword [ebp - 0x28cc], 0
jne 0x462b5f
mov dword [ebp - 0x2cfc], 0
jmp 0x462b6b
mov ecx, dword [ebp - 0x28d0]
mov dword [ebp - 0x2cfc], ecx
mov edx, dword [ebp - 0x2cfc]
mov dword [ebp - 0x2cf8], edx
mov eax, dword [ebp - 0x2cf8]
push eax
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov ecx, dword [ebp - 0x1900]
mov dword [ebp - 0x28d8], ecx
mov edx, dword [ebp - 0x28d8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462bb2
mov dword [ebp - 0xa38], 1
jmp case.0x4628c0.1
mov eax, str.Excelcnv.exe
test eax, eax
jne 0x462bcc
mov dword [ebp - 0x28dc], 0
jmp 0x462bdf
push str.Excelcnv.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x28dc], eax
mov ecx, dword [ebp - 0x28dc]
push ecx
push str.Excelcnv.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov edx, dword [ebp - 0x1900]
mov dword [ebp - 0x28e0], edx
mov eax, dword [ebp - 0x28e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462d28
mov ecx, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], ecx
cmp dword [ebp - 0xa3c], 0
jne 0x462c3b
mov dword [ebp - 0x2d00], 0
jmp 0x462d05
mov edx, dword [ebp - 0xa3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462c66
mov dword [ebp - 0x2d04], 0
jmp 0x462cf9
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x28e8], esp
mov eax, dword [ebp - 0x28ec]
mov dword [ebp - 0x2d04], eax
cmp dword [ebp - 0x28e8], 0
je 0x462c94
cmp dword [ebp - 0xa3c], 0
jne 0x462ca0
mov dword [ebp - 0x2d04], 0
jmp 0x462cf9
mov ecx, dword [ebp - 0x28e8]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x28e8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa3c]
push ecx
push 0
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28e4], eax
cmp dword [ebp - 0x28e4], 0
jne 0x462ced
mov dword [ebp - 0x2d04], 0
jmp 0x462cf9
mov eax, dword [ebp - 0x28e8]
mov dword [ebp - 0x2d04], eax
mov ecx, dword [ebp - 0x2d04]
mov dword [ebp - 0x2d00], ecx
mov edx, dword [ebp - 0x2d00]
push edx
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov dword [ebp - 0xa38], 1
jmp 0x462ea2
lea eax, [ebp - 0x18f8]
push eax
lea ecx, [ebp - 0x1900]
call fcn.0044f9d0
mov ecx, str.excelcnv.exe
test ecx, ecx
jne 0x462d4f
mov dword [ebp - 0x28f0], 0
jmp 0x462d62
push str.excelcnv.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x28f0], eax
mov edx, dword [ebp - 0x28f0]
push edx
push str.excelcnv.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x462d9d
mov dword [ebp - 0x2d08], 0
jmp 0x462e67
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462dc8
mov dword [ebp - 0x2d0c], 0
jmp 0x462e5b
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x28f8], esp
mov edx, dword [ebp - 0x28fc]
mov dword [ebp - 0x2d0c], edx
cmp dword [ebp - 0x28f8], 0
je 0x462df6
cmp dword [ebp - 0xa3c], 0
jne 0x462e02
mov dword [ebp - 0x2d0c], 0
jmp 0x462e5b
mov eax, dword [ebp - 0x28f8]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x28f8]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28f4], eax
cmp dword [ebp - 0x28f4], 0
jne 0x462e4f
mov dword [ebp - 0x2d0c], 0
jmp 0x462e5b
mov edx, dword [ebp - 0x28f8]
mov dword [ebp - 0x2d0c], edx
mov eax, dword [ebp - 0x2d0c]
mov dword [ebp - 0x2d08], eax
mov ecx, dword [ebp - 0x2d08]
push ecx
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov edx, dword [ebp - 0x1900]
mov dword [ebp - 0x2900], edx
mov eax, dword [ebp - 0x2900]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462ea2
mov dword [ebp - 0xa38], 1
jmp case.0x4628c0.1
mov ecx, str.PPCNVCOM.exe
test ecx, ecx
jne 0x462ebc
mov dword [ebp - 0x2904], 0
jmp 0x462ecf
push str.PPCNVCOM.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x2904], eax
mov edx, dword [ebp - 0x2904]
push edx
push str.PPCNVCOM.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0x2908], eax
mov ecx, dword [ebp - 0x2908]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463018
mov edx, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], edx
cmp dword [ebp - 0xa3c], 0
jne 0x462f2b
mov dword [ebp - 0x2d10], 0
jmp 0x462ff5
mov eax, dword [ebp - 0xa3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x462f56
mov dword [ebp - 0x2d14], 0
jmp 0x462fe9
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2910], esp
mov ecx, dword [ebp - 0x2914]
mov dword [ebp - 0x2d14], ecx
cmp dword [ebp - 0x2910], 0
je 0x462f84
cmp dword [ebp - 0xa3c], 0
jne 0x462f90
mov dword [ebp - 0x2d14], 0
jmp 0x462fe9
mov edx, dword [ebp - 0x2910]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x2910]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa3c]
push edx
push 0
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x290c], eax
cmp dword [ebp - 0x290c], 0
jne 0x462fdd
mov dword [ebp - 0x2d14], 0
jmp 0x462fe9
mov ecx, dword [ebp - 0x2910]
mov dword [ebp - 0x2d14], ecx
mov edx, dword [ebp - 0x2d14]
mov dword [ebp - 0x2d10], edx
mov eax, dword [ebp - 0x2d10]
push eax
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov dword [ebp - 0xa38], 1
jmp case.0x4628c0.1
lea ecx, [ebp - 0x18f8]
push ecx
lea ecx, [ebp - 0x1900]
call fcn.0044f9d0
mov edx, str.ppcnvcom.exe
test edx, edx
jne 0x46303f
mov dword [ebp - 0x2918], 0
jmp 0x463052
push str.ppcnvcom.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x2918], eax
mov eax, dword [ebp - 0x2918]
push eax
push str.ppcnvcom.exe
lea ecx, [ebp - 0x1900]
call fcn.0044ecb0
mov ecx, dword [ebp - 0x1900]
mov dword [ebp - 0xa3c], ecx
cmp dword [ebp - 0xa3c], 0
jne 0x46308d
mov dword [ebp - 0x2d18], 0
jmp 0x463157
mov edx, dword [ebp - 0xa3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x4630b8
mov dword [ebp - 0x2d1c], 0
jmp 0x46314b
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2920], esp
mov eax, dword [ebp - 0x2924]
mov dword [ebp - 0x2d1c], eax
cmp dword [ebp - 0x2920], 0
je 0x4630e6
cmp dword [ebp - 0xa3c], 0
jne 0x4630f2
mov dword [ebp - 0x2d1c], 0
jmp 0x46314b
mov ecx, dword [ebp - 0x2920]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x2920]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa3c]
push ecx
push 0
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x291c], eax
cmp dword [ebp - 0x291c], 0
jne 0x46313f
mov dword [ebp - 0x2d1c], 0
jmp 0x46314b
mov eax, dword [ebp - 0x2920]
mov dword [ebp - 0x2d1c], eax
mov ecx, dword [ebp - 0x2d1c]
mov dword [ebp - 0x2d18], ecx
mov edx, dword [ebp - 0x2d18]
push edx
push str.office_InstallRoot:_s
call fcn.0047c040
add esp, 8
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0x2928], eax
mov ecx, dword [ebp - 0x2928]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je case.0x4628c0.1
mov dword [ebp - 0xa38], 1
cmp dword [ebp - 0xa38], 1
jne 0x4631ad
lea edx, [ebp - 0xa34]
push edx
mov ecx, dword [ebp - 0x2cb4]
call fcn.00461b10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1904]
call fcn.0044f990
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18f8]
call fcn.0044f990
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1900]
call fcn.0044f990
mov dword [ebp - 0x2938], 0
cmp dword [ebp - 0x10f4], 0
je 0x46320a
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2938], eax
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0x10f0], 0
mov byte [ebp - 4], 4
mov dword [ebp - 0x293c], 0
cmp dword [ebp - 0x10f4], 0
je 0x463248
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x293c], eax
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0x10f0], 0
jmp 0x46337e
push str..dwg
lea edx, [ebp - 0x1084]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46337e
call fcn.0047bee0
test eax, eax
je 0x46337e
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11d8], 0
je 0x4632a0
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11d8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11e0], 0
je 0x46331c
push 0x2710
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11d8], 0
je 0x4632f9
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2cb4]
mov dword [eax + 0x11d8], 0
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2cb4]
mov dword [eax + 0x11e0], 0
mov ecx, dword [ebp - 0x2cb4]
cmp dword [ecx + 0x11d8], 0
jne 0x463345
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x2cb4]
mov dword [edx + 0x11d8], eax
push 0
push 4
mov eax, dword [ebp - 0x2cb4]
push eax
push 0x461a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x2cb4]
mov dword [ecx + 0x11e0], eax
mov edx, dword [ebp - 0x2cb4]
mov eax, dword [edx + 0x11e0]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4644f3
push 0x599eb0
lea ecx, [ebp - 0x2110]
call fcn.0044f380
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x2110]
mov dword [ebp - 0x2954], ecx
push 0x2e
mov edx, dword [ebp - 0x2954]
push edx
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x2950], eax
cmp dword [ebp - 0x2950], 0
jne 0x4633d4
mov dword [ebp - 0x2d20], 0xffffffff
jmp 0x4633e8
mov eax, dword [ebp - 0x2950]
sub eax, dword [ebp - 0x2110]
sar eax, 1
mov dword [ebp - 0x2d20], eax
mov ecx, dword [ebp - 0x2d20]
mov dword [ebp - 0x2120], ecx
push 5
mov edx, dword [ebp - 0x2120]
push edx
lea eax, [ebp - 0x211c]
push eax
lea ecx, [ebp - 0x2110]
call fcn.00451010
mov byte [ebp - 4], 0xa
push 0x546398
lea ecx, [ebp - 0x211c]
call fcn.0046fa60
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2128]
call fcn.0044f380
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x2128]
mov dword [ebp - 0x297c], edx
push 0x5c
mov eax, dword [ebp - 0x297c]
push eax
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x2978], eax
cmp dword [ebp - 0x2978], 0
jne 0x46346e
mov dword [ebp - 0x2d24], 0xffffffff
jmp 0x463482
mov ecx, dword [ebp - 0x2978]
sub ecx, dword [ebp - 0x2128]
sar ecx, 1
mov dword [ebp - 0x2d24], ecx
mov edx, dword [ebp - 0x2d24]
mov dword [ebp - 0x210c], edx
mov eax, dword [ebp - 0x210c]
add eax, 1
push eax
lea ecx, [ebp - 0x2124]
push ecx
lea ecx, [ebp - 0x2128]
call fcn.00450fc0
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2108], 1
push ecx
mov edx, esp
mov dword [ebp - 0x2758], esp
mov dword [ebp - 0x2988], edx
mov eax, dword [ebp - 0x211c]
sub eax, 0x10
mov dword [ebp - 0x2980], eax
mov ecx, dword [ebp - 0x2980]
push ecx
call fcn.0044fd30
add esp, 4
mov dword [ebp - 0x2984], eax
mov edx, dword [ebp - 0x2984]
add edx, 0x10
mov eax, dword [ebp - 0x2988]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2988]
mov dword [ebp - 0x2d28], ecx
mov byte [ebp - 4], 0xd
push ecx
mov edx, esp
mov dword [ebp - 0x275c], esp
mov dword [ebp - 0x2994], edx
mov eax, dword [ebp - 0x2124]
sub eax, 0x10
mov dword [ebp - 0x298c], eax
mov ecx, dword [ebp - 0x298c]
push ecx
call fcn.0044fd30
add esp, 4
mov dword [ebp - 0x2990], eax
mov edx, dword [ebp - 0x2990]
add edx, 0x10
mov eax, dword [ebp - 0x2994]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2994]
mov dword [ebp - 0x2d2c], ecx
mov byte [ebp - 4], 0xc
call fcn.0045a3a0
add esp, 8
mov dword [ebp - 0x2d30], eax
mov edx, dword [ebp - 0x2d30]
mov dword [ebp - 0x2108], edx
xor eax, eax
mov word [ebp - 0x2104], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x2102]
push ecx
call fcn.004f8090
add esp, 0xc
cmp dword [ebp - 0x2108], 0
jne 0x4635c2
mov edx, dword [ebp + 0x10]
push edx
push str.NOTEPAD.EXE
push str.__s___s
lea eax, [ebp - 0x2104]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x4635ed
push str.dzh_szMyCommandLine
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xe54]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.__s___s
lea eax, [ebp - 0x2104]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x2114], 0
mov ecx, dword [ebp - 0x2124]
sub ecx, 0x10
mov dword [ebp - 0x2998], ecx
mov edx, dword [ebp - 0x2998]
push edx
call fcn.0044fd30
add esp, 4
mov dword [ebp - 0x299c], eax
mov eax, dword [ebp - 0x299c]
add eax, 0x10
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2118]
call fcn.0046f9b0
push str.dzh_for_test
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x2124]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea edx, [ebp - 0x2104]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push str.powerpnt.exe
lea ecx, [ebp - 0x2118]
call fcn.0046f880
cmp eax, 0xffffffff
je 0x46379e
push str.dzh_for_test_2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.RealCreateProcessW_before_InjectDllByAppPath
call fcn.0047c040
add esp, 4
lea eax, [ebp - 0x2104]
push eax
lea ecx, [ebp - 0x2764]
call fcn.0044f380
mov dword [ebp - 0x2d34], eax
mov ecx, dword [ebp - 0x2d34]
mov dword [ebp - 0x2d38], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x2768]
call fcn.0044f380
mov dword [ebp - 0x2d3c], eax
mov eax, dword [ebp - 0x2d3c]
mov dword [ebp - 0x2d40], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa54]
push ecx
mov edx, dword [ebp - 0x2d38]
push edx
mov eax, dword [ebp - 0x2d40]
push eax
call fcn.0045bc30
add esp, 0xc
mov dword [ebp - 0x2760], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2768]
call fcn.0044f990
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2764]
call fcn.0044f990
cmp dword [ebp - 0x2760], 0
je 0x463781
mov dword [ebp - 0x2114], 1
lea ecx, [ebp - 0x212c]
call fcn.0044f320
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xa48]
push ecx
mov edx, dword [ebp - 0xa4c]
push edx
push str.RealCreateProcessW_InjectDllByAppPath_ProcessID_d_ThreadID_d
lea eax, [ebp - 0x212c]
push eax
call fcn.00451560
add esp, 0x10
mov ecx, dword [ebp - 0x212c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x212c]
call fcn.0044f990
jmp 0x463799
push 0x546a18
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.RealCreateProcessW__InjectDllByAppPath
call fcn.0047c040
add esp, 4
jmp 0x464221
push 0
push str.acrord32.exe
lea ecx, [ebp - 0x2118]
call fcn.0046f880
cmp eax, 0xffffffff
jne 0x4637d0
push 0
push str.acad.exe
lea ecx, [ebp - 0x2118]
call fcn.0046f880
cmp eax, 0xffffffff
je 0x4641ef
push str.ProcessMulti.dll_deal_1_1_1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ecx
mov ecx, esp
mov dword [ebp - 0x276c], esp
mov edx, dword [ebp + 8]
push edx
call fcn.0044f380
mov dword [ebp - 0x2d44], eax
call fcn.0047bf30
add esp, 4
mov dword [ebp - 0x2d48], eax
cmp dword [ebp - 0x2d48], 0
je 0x463e31
push str.ProcessMulti.dll_deal_1_1_1_IsExe64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x104
lea eax, [ebp - 0x2384]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x2384]
push ecx
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x23b0], eax
cmp dword [ebp - 0x23b0], 0
je 0x463859
xor edx, edx
mov eax, dword [ebp - 0x23b0]
mov word [eax + 2], dx
lea ecx, [ebp - 0x2398]
call fcn.0044f320
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2178]
push ecx
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x4638f5
movzx edx, byte [ebp - 0x2169]
push edx
movzx eax, byte [ebp - 0x216b]
push eax
movzx ecx, byte [ebp - 0x216d]
push ecx
movzx edx, byte [ebp - 0x216f]
push edx
movzx eax, word [ebp - 0x2172]
push eax
movzx ecx, word [ebp - 0x2174]
push ecx
push str._04X_04X_02X_02X_02X_02X
lea edx, [ebp - 0x2454]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [ebp - 0x2454]
push eax
lea ecx, [ebp - 0x2458]
call fcn.0044f460
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2458]
push ecx
lea ecx, [ebp - 0x2398]
call fcn.0044f9d0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2458]
call fcn.0044f990
mov edx, dword [ebp - 0x2398]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x23ac]
call fcn.0044f380
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xe54]
push ecx
lea ecx, [ebp - 0x2420]
call fcn.0044f380
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x2384]
push edx
lea ecx, [ebp - 0x23a0]
call fcn.0044f380
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x2398]
push eax
lea ecx, [ebp - 0x23a0]
push ecx
lea edx, [ebp - 0x2770]
push edx
call fcn.00451150
add esp, 0xc
mov dword [ebp - 0x2d4c], eax
mov eax, dword [ebp - 0x2d4c]
mov dword [ebp - 0x2d50], eax
mov byte [ebp - 4], 0x17
push str..ini
mov ecx, dword [ebp - 0x2d50]
push ecx
lea edx, [ebp - 0x2390]
push edx
call fcn.0044e7e0
add esp, 0xc
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x2770]
call fcn.0044f990
lea ecx, [ebp - 0x238c]
call fcn.0044f320
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x23ac]
push eax
push 0x5486dc
lea ecx, [ebp - 0x238c]
push ecx
call fcn.00451560
add esp, 0xc
mov edx, dword [ebp - 0x2390]
mov dword [ebp - 0x2a74], edx
mov eax, dword [ebp - 0x2a74]
push eax
mov ecx, dword [ebp - 0x238c]
push ecx
push str.ExePath
push str.ProcessInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x2420]
push edx
push 0x5486dc
lea eax, [ebp - 0x238c]
push eax
call fcn.00451560
add esp, 0xc
mov ecx, dword [ebp - 0x2390]
mov dword [ebp - 0x2a78], ecx
mov edx, dword [ebp - 0x2a78]
push edx
mov eax, dword [ebp - 0x238c]
push eax
push str.OpenFilePath
push str.ProcessInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x3c
push 0
lea ecx, [ebp - 0x2168]
push ecx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2168], 0x3c
mov dword [ebp - 0x2164], 0x440
mov dword [ebp - 0x2160], 0
mov dword [ebp - 0x215c], str.open
mov dword [ebp - 0x2158], 0x548670
mov edx, dword [ebp - 0x2398]
mov dword [ebp - 0x2154], edx
lea eax, [ebp - 0x2384]
mov dword [ebp - 0x2150], eax
mov dword [ebp - 0x214c], 5
mov dword [ebp - 0x2144], 0
mov dword [ebp - 0x2140], 0
mov dword [ebp - 0x213c], 0
mov dword [ebp - 0x2138], 0
mov dword [ebp - 0x2130], 0
lea ecx, [ebp - 0x2168]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x463aec
push str._ShellExecuteEx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x2130], 0
je 0x463b1c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2130]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x548630
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ecx, ecx
mov word [ebp - 0x241c], cx
push 0x62
push 0
lea edx, [ebp - 0x241a]
push edx
call fcn.004f8090
add esp, 0xc
mov eax, dword [ebp - 0x2390]
push eax
push 0x200
lea ecx, [ebp - 0x241c]
push ecx
push 0x54862c
push 0x548624
push str.ProcessInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x241c]
push edx
lea ecx, [ebp - 0x23a4]
call fcn.0044f380
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x23a4]
mov dword [ebp - 0x2a8c], eax
mov ecx, dword [ebp - 0x2a8c]
push ecx
call fcn.004fbf6e
add esp, 4
mov dword [ebp - 0x2394], eax
mov edx, dword [ebp - 0x23a4]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x32
push 0
lea eax, [ebp - 0x241c]
push eax
call fcn.004f8090
add esp, 0xc
mov ecx, dword [ebp - 0x2390]
push ecx
push 0x200
lea edx, [ebp - 0x241c]
push edx
push 0x54862c
push 0x54861c
push str.ProcessInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x241c]
push eax
lea ecx, [ebp - 0x2388]
call fcn.0044f380
mov ecx, dword [ebp - 0x2388]
mov dword [ebp - 0x2aa0], ecx
mov edx, dword [ebp - 0x2aa0]
push edx
call fcn.004fbf6e
add esp, 4
mov dword [ebp - 0x239c], eax
cmp dword [ebp - 0x2394], 0
je 0x463c28
cmp dword [ebp - 0x239c], 0
jne 0x463d0e
mov dword [ebp - 0x2774], 0
lea ecx, [ebp - 0x2388]
call fcn.0044f990
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x23a4]
call fcn.0044f990
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x238c]
call fcn.0044f990
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2390]
call fcn.0044f990
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x23a0]
call fcn.0044f990
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2420]
call fcn.0044f990
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x23ac]
call fcn.0044f990
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2398]
call fcn.0044f990
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2118]
call fcn.0044f990
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2124]
call fcn.0044f990
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2128]
call fcn.0044f990
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x211c]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2110]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x2774]
jmp 0x464e18
mov eax, dword [ebp - 0x2394]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x217c], eax
mov ecx, dword [ebp - 0x2394]
mov dword [ebp - 0xa4c], ecx
mov edx, dword [ebp - 0x217c]
mov dword [ebp - 0xa54], edx
mov eax, dword [ebp - 0x239c]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x23a8], eax
mov ecx, dword [ebp - 0x239c]
mov dword [ebp - 0xa48], ecx
mov edx, dword [ebp - 0x23a8]
mov dword [ebp - 0xa50], edx
mov dword [ebp - 0x217c], 0
mov dword [ebp - 0x23a8], 0
cmp dword [ebp - 0xa54], 0
jne 0x463d9a
push str.pi.hProcess
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0xa50], 0
jne 0x463dae
push str.pi.hThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x2114], 1
lea ecx, [ebp - 0x2388]
call fcn.0044f990
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x23a4]
call fcn.0044f990
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x238c]
call fcn.0044f990
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2390]
call fcn.0044f990
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x23a0]
call fcn.0044f990
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2420]
call fcn.0044f990
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x23ac]
call fcn.0044f990
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2398]
call fcn.0044f990
jmp 0x4641ed
push str.ProcessMulti.dll_deal_1_1_1__IsExe64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x2104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x104
lea ecx, [ebp - 0x2664]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x2664]
push edx
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x266c], eax
cmp dword [ebp - 0x266c], 0
je 0x463e89
xor eax, eax
mov ecx, dword [ebp - 0x266c]
mov word [ecx + 2], ax
push 0x546960
lea edx, [ebp - 0x2664]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2664]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x463ebf
mov dword [ebp - 0x2d54], 0
jmp 0x463f89
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x463eea
mov dword [ebp - 0x2d58], 0
jmp 0x463f7d
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2b00], esp
mov edx, dword [ebp - 0x2b04]
mov dword [ebp - 0x2d58], edx
cmp dword [ebp - 0x2b00], 0
je 0x463f18
cmp dword [ebp - 0xa3c], 0
jne 0x463f24
mov dword [ebp - 0x2d58], 0
jmp 0x463f7d
mov eax, dword [ebp - 0x2b00]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x2b00]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2afc], eax
cmp dword [ebp - 0x2afc], 0
jne 0x463f71
mov dword [ebp - 0x2d58], 0
jmp 0x463f7d
mov edx, dword [ebp - 0x2b00]
mov dword [ebp - 0x2d58], edx
mov eax, dword [ebp - 0x2d58]
mov dword [ebp - 0x2d54], eax
mov ecx, dword [ebp - 0x2d54]
push ecx
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x245c], 0
lea edx, [ebp - 0x2664]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x2664]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2668], eax
push str.ProcessMulti.dll_deal_1_2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x2668], 0
jne 0x4640ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2670], eax
lea ecx, [ebp - 0x2674]
call fcn.0044f320
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x2670]
push ecx
push str.ProcessMulti.dll_deal_2_dwErr_d
lea edx, [ebp - 0x2674]
push edx
call fcn.00451560
add esp, 0xc
mov eax, dword [ebp - 0x2674]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.DZH_POWERPNT.EXE_NULL__hDll
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x2778], 1
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2674]
call fcn.0044f990
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2118]
call fcn.0044f990
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2124]
call fcn.0044f990
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2128]
call fcn.0044f990
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x211c]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2110]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x2778]
jmp 0x464e18
push str.DZH_POWERPNT.EXE_after_LoadLibrary
call fcn.0047c040
add esp, 4
push 0x546870
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.CreateProcessInjectDllW
mov ecx, dword [ebp - 0x2668]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x245c], eax
cmp dword [ebp - 0x245c], 0
jne 0x464172
push str.ProcessMulti.dll_deal_3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x2668]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x277c], 1
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2118]
call fcn.0044f990
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2124]
call fcn.0044f990
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2128]
call fcn.0044f990
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x211c]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2110]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x277c]
jmp 0x464e18
push str.ProcessMulti.dll_deal_3_1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
lea eax, [ebp - 0x2664]
push eax
lea ecx, [ebp - 0xa54]
push ecx
lea edx, [ebp - 0x10d4]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x2104]
push eax
push 0
call dword [ebp - 0x245c]
mov dword [ebp - 0x2114], eax
cmp dword [ebp - 0x2114], 0
je 0x4641cb
push str.ProcessMulti.dll_deal_4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4641d6
push str.ProcessMulti.dll_deal_5
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x2668]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x2668], 0
jmp 0x464221
lea edx, [ebp - 0xa54]
push edx
lea eax, [ebp - 0x10d4]
push eax
push 0x566e0c
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x2104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x2114], eax
lea edx, [ebp - 0xe54]
mov dword [ebp - 0xa3c], edx
cmp dword [ebp - 0xa3c], 0
jne 0x464245
mov dword [ebp - 0x2d5c], 0
jmp 0x46430f
mov eax, dword [ebp - 0xa3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x464270
mov dword [ebp - 0x2d60], 0
jmp 0x464303
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2b4c], esp
mov ecx, dword [ebp - 0x2b50]
mov dword [ebp - 0x2d60], ecx
cmp dword [ebp - 0x2b4c], 0
je 0x46429e
cmp dword [ebp - 0xa3c], 0
jne 0x4642aa
mov dword [ebp - 0x2d60], 0
jmp 0x464303
mov edx, dword [ebp - 0x2b4c]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x2b4c]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa3c]
push edx
push 0
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2b48], eax
cmp dword [ebp - 0x2b48], 0
jne 0x4642f7
mov dword [ebp - 0x2d60], 0
jmp 0x464303
mov ecx, dword [ebp - 0x2b4c]
mov dword [ebp - 0x2d60], ecx
mov edx, dword [ebp - 0x2d60]
mov dword [ebp - 0x2d5c], edx
lea eax, [ebp - 0x2104]
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
jne 0x464333
mov dword [ebp - 0x2d64], 0
jmp 0x4643fd
mov ecx, dword [ebp - 0xa3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x46435e
mov dword [ebp - 0x2d68], 0
jmp 0x4643f1
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2b58], esp
mov edx, dword [ebp - 0x2b5c]
mov dword [ebp - 0x2d68], edx
cmp dword [ebp - 0x2b58], 0
je 0x46438c
cmp dword [ebp - 0xa3c], 0
jne 0x464398
mov dword [ebp - 0x2d68], 0
jmp 0x4643f1
mov eax, dword [ebp - 0x2b58]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x2b58]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa3c]
push eax
push 0
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2b54], eax
cmp dword [ebp - 0x2b54], 0
jne 0x4643e5
mov dword [ebp - 0x2d68], 0
jmp 0x4643f1
mov edx, dword [ebp - 0x2b58]
mov dword [ebp - 0x2d68], edx
mov eax, dword [ebp - 0x2d68]
mov dword [ebp - 0x2d64], eax
mov ecx, dword [ebp - 0xa4c]
push ecx
mov edx, dword [ebp - 0x2d5c]
push edx
mov eax, dword [ebp - 0x2d64]
push eax
push str.CreateProcess
call fcn.0047c040
add esp, 0x10
cmp dword [ebp - 0x2114], 0
je 0x46448d
push str.bSuccess_is_true_dwProcessId__pi.dwProcessId_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xa4c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2678], eax
cmp dword [ebp - 0x2678], 0
jne 0x464465
mov dword [ebp - 0x14], 0xffffffff
jmp 0x464472
mov eax, dword [ebp - 0x2678]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xa50]
mov dword [ebp - 0x1088], ecx
push 0x548498
call fcn.0047c040
add esp, 4
jmp 0x4644a8
mov dword [ebp - 0x14], 0xffffffff
lea edx, [ebp - 0x2104]
push edx
push 0x548480
call fcn.0047c040
add esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2118]
call fcn.0044f990
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2124]
call fcn.0044f990
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2128]
call fcn.0044f990
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x211c]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2110]
call fcn.0044f990
cmp dword [ebp - 0x14], 0xffffffff
jne 0x464628
push 0x54846c
call fcn.0047c040
add esp, 4
push 0x3c
push 0
lea eax, [ebp - 0x26b4]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x26b4], 0x3c
mov dword [ebp - 0x26b0], 0x440
mov dword [ebp - 0x26ac], 0
mov dword [ebp - 0x26a8], str.open
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x26a4], ecx
lea edx, [ebp - 0xe54]
mov dword [ebp - 0x26a0], edx
mov dword [ebp - 0x269c], 0x566e0c
mov dword [ebp - 0x2698], 3
mov dword [ebp - 0x2690], 0
mov dword [ebp - 0x268c], 0
mov dword [ebp - 0x2688], 0
mov dword [ebp - 0x2684], 0
mov dword [ebp - 0x267c], 0
push 0x548458
call fcn.0047c040
add esp, 4
lea eax, [ebp - 0x26b4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x464609
mov ecx, dword [ebp - 0x267c]
push ecx
call dword [ebp - 0xa40]
mov edx, dword [ebp - 0x267c]
push edx
mov ecx, dword [ebp - 0x2cb4]
call fcn.004651c0
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call fcn.00403c50
add esp, 8
mov ecx, dword [ebp - 0x267c]
mov dword [ebp - 0xe64], ecx
push str.ShellExecuteEx
call fcn.0047c040
add esp, 4
jmp 0x464628
lea edx, [ebp - 0xe54]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x54841c
call fcn.0047c040
add esp, 0xc
mov dword [ebp - 0x14], 0xffffffff
push 0x548408
call fcn.0047c040
add esp, 4
cmp dword [ebp - 0x14], 0xffffffff
jne 0x46470e
push 1
lea ecx, [ebp - 0x2780]
push ecx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2d6c], eax
mov edx, dword [ebp - 0x2d6c]
mov dword [ebp - 0x2b74], edx
mov byte [ebp - 4], 0x1d
push 0x36
lea eax, [ebp - 0x2784]
push eax
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2b7c], eax
mov ecx, dword [ebp - 0x2b74]
mov edx, dword [ecx]
mov dword [ebp - 0x2b78], edx
mov eax, dword [ebp - 0x2b7c]
mov ecx, dword [eax]
mov dword [ebp - 0x2b80], ecx
push 0x10
mov edx, dword [ebp - 0x2b78]
push edx
mov eax, dword [ebp - 0x2b80]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2784]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2780]
call fcn.0044f990
lea ecx, [ebp - 0xe54]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5483e8
call fcn.0047c040
add esp, 0xc
mov dword [ebp - 0x2788], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x2788]
jmp 0x464e18
mov dword [ebp - 0xe68], 0
push 1
mov eax, dword [ebp - 0x14]
push eax
call fcn.00403c50
add esp, 8
mov dword [ebp - 0xe68], eax
cmp dword [ebp - 0xe68], 0
jne 0x464742
push str.CryptDiskSetAccessProcessId_failure
call fcn.0047c040
add esp, 4
mov ecx, dword [ebp - 0x2cb4]
add ecx, 0x424
mov dword [ebp - 0xa3c], ecx
jne 0x464765
mov dword [ebp - 0x2d70], 0
jmp 0x46482f
mov edx, dword [ebp - 0xa3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x464790
mov dword [ebp - 0x2d74], 0
jmp 0x464823
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.004f86f0
mov dword [ebp - 0x2b94], esp
mov eax, dword [ebp - 0x2b98]
mov dword [ebp - 0x2d74], eax
cmp dword [ebp - 0x2b94], 0
je 0x4647be
cmp dword [ebp - 0xa3c], 0
jne 0x4647ca
mov dword [ebp - 0x2d74], 0
jmp 0x464823
mov ecx, dword [ebp - 0x2b94]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x2b94]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa3c]
push ecx
push 0
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2b90], eax
cmp dword [ebp - 0x2b90], 0
jne 0x464817
mov dword [ebp - 0x2d74], 0
jmp 0x464823
mov eax, dword [ebp - 0x2b94]
mov dword [ebp - 0x2d74], eax
mov ecx, dword [ebp - 0x2d74]
mov dword [ebp - 0x2d70], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2d70]
push eax
push 0x548394
call fcn.0047c040
add esp, 0xc
mov dword [ebp - 0x62c], 0
push 0x608
push 0
lea ecx, [ebp - 0x628]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x60c
push 0
lea edx, [ebp - 0x62c]
push edx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x2cb4]
movzx ecx, byte [eax + 0x957]
mov dword [ebp - 0x61c], ecx
mov dword [ebp - 0x620], 0
mov edx, dword [ebp - 0x2cb4]
mov eax, dword [edx + 0x94f]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x2cb4]
add ecx, 0x958
push ecx
lea edx, [ebp - 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
mov eax, dword [ebp - 0x2cb4]
add eax, 0xa58
push eax
lea ecx, [ebp - 0xc8]
push ecx
call fcn.004f8140
add esp, 0xc
mov edx, dword [ebp - 0x2cb4]
mov eax, dword [edx + 0xab4]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x2cb4]
mov dl, byte [ecx + 0xaca]
mov byte [ebp - 0x68], dl
mov eax, dword [ebp - 0x2cb4]
movzx ecx, byte [eax + 0x953]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x2cb4]
mov al, byte [edx + 0xacb]
mov byte [ebp - 0x60], al
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x2cb4]
add eax, 0x424
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x628], edx
lea eax, [ebp - 0x62c]
push eax
call dword [ebp - 0xe60]
add esp, 4
cmp dword [ebp - 0x10e4], 0
je 0x464993
lea ecx, [ebp - 0xa34]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00476c00
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
push 0x548368
call fcn.0047c040
add esp, 8
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xa44], eax
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x2cb4]
call fcn.0046f240
cmp dword [ebp - 0xa38], 0
je 0x464ad7
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11d8], 0
je 0x4649f9
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11d8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11e0], 0
je 0x464a75
push 0x2710
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2cb4]
cmp dword [eax + 0x11d8], 0
je 0x464a52
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2cb4]
mov dword [eax + 0x11d8], 0
mov ecx, dword [ebp - 0x2cb4]
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2cb4]
mov dword [eax + 0x11e0], 0
mov ecx, dword [ebp - 0x2cb4]
cmp dword [ecx + 0x11d8], 0
jne 0x464a9e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x2cb4]
mov dword [edx + 0x11d8], eax
push 0
push 4
mov eax, dword [ebp - 0x2cb4]
push eax
push 0x461a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x2cb4]
mov dword [ecx + 0x11e0], eax
mov edx, dword [ebp - 0x2cb4]
mov eax, dword [edx + 0x11e0]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push str.SuspendThread_before_::ResumeThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x1088], 0
je 0x464b03
push str.SuspendThread_::ResumeThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x1088]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 0xe64], 0
je 0x464b22
cmp dword [ebp - 0xe70], 0
je 0x464b22
mov edx, dword [ebp - 0xe64]
push edx
call dword [ebp - 0xe70]
cmp dword [ebp - 0xa50], 0
je 0x464b38
mov eax, dword [ebp - 0xa50]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa54], 0
je 0x464b4e
mov ecx, dword [ebp - 0xa54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xe64], 0
je 0x464b64
mov edx, dword [ebp - 0xe64]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa44], 0
jne 0x464c28
push 1
lea eax, [ebp - 0x278c]
push eax
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2d78], eax
mov ecx, dword [ebp - 0x2d78]
mov dword [ebp - 0x2b9c], ecx
mov byte [ebp - 4], 0x1e
push 0x36
lea edx, [ebp - 0x2790]
push edx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2ba4], eax
mov eax, dword [ebp - 0x2b9c]
mov ecx, dword [eax]
mov dword [ebp - 0x2ba0], ecx
mov edx, dword [ebp - 0x2ba4]
mov eax, dword [edx]
mov dword [ebp - 0x2ba8], eax
push 0x10
mov ecx, dword [ebp - 0x2ba0]
push ecx
mov edx, dword [ebp - 0x2ba8]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2790]
call fcn.0044f990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x278c]
call fcn.0044f990
mov dword [ebp - 0x2794], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x2794]
jmp 0x464e18
mov eax, dword [ebp - 0xa44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x10e0]
call fcn.0044f380
mov byte [ebp - 4], 0x1f
push 0
push str..igs
lea ecx, [ebp - 0x10e0]
call fcn.0046f880
cmp eax, 0xffffffff
jne 0x464c79
push 0
push str..igs
lea ecx, [ebp - 0x10e0]
call fcn.0046f880
test eax, eax
jne 0x464d65
lea ecx, [ebp - 0x26b8]
call fcn.0044f320
mov byte [ebp - 4], 0x20
push 0x4f
lea edx, [ebp - 0x2798]
push edx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2d7c], eax
mov eax, dword [ebp - 0x2d7c]
mov dword [ebp - 0x2c68], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x2c68]
push ecx
lea ecx, [ebp - 0x26b8]
call fcn.0044f9d0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2798]
call fcn.0044f990
cmp dword [ebp + 0x10], 0
jne 0x464ce4
mov dword [ebp - 0x2c70], 0
jmp 0x464cf6
mov edx, dword [ebp + 0x10]
push edx
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x2c70], eax
mov eax, dword [ebp - 0x2c70]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x26b8]
call fcn.0044ecb0
push 2
lea edx, [ebp - 0x279c]
push edx
mov ecx, 0x59a55c
call fcn.00494360
mov dword [ebp - 0x2c9c], eax
mov eax, dword [ebp - 0x2c9c]
mov ecx, dword [eax]
mov dword [ebp - 0x2ca0], ecx
push 0
mov edx, dword [ebp - 0x2ca0]
push edx
mov eax, dword [ebp - 0x26b8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x279c]
call fcn.0044f990
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x26b8]
call fcn.0044f990
cmp dword [ebp + 0x18], 0
je 0x464d86
mov ecx, dword [ebp - 0x2cb4]
mov dword [ecx + 0x11f0], 1
mov ecx, dword [ebp - 0x2cb4]
call fcn.0046ba00
mov edx, dword [ebp - 0x2cb4]
cmp dword [edx + 0x11d8], 0
je 0x464da8
mov eax, dword [ebp - 0x2cb4]
mov ecx, dword [eax + 0x11d8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp - 0x2cb4]
cmp dword [edx + 0x11dc], 0
je 0x464dda
mov eax, dword [ebp - 0x2cb4]
mov ecx, dword [eax + 0x11dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x2cb4]
mov dword [edx + 0x11dc], 0
push str.OpenDoc_Finsh_
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x27a0], 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10e0]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.0044f990
mov eax, dword [ebp - 0x27a0]
lea esp, [ebp - 0x2d88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret 0x14