Function at 0x4180ce
Capabilities:
Check for foreground window switch
Create thread
Get disk information
Load ntoskrnl
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b4
call fcn.00452960
push ebx
push esi
push edi
mov eax, dword [0x704c20]
mov dword [ebp - 0x428], eax
mov eax, dword [0x481894]
mov dword [ebp - 0x30c], eax
mov eax, dword [0x48188c]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x481888]
mov dword [ebp - 0x54], eax
mov eax, dword [0x481890]
mov dword [ebp - 0xc], eax
mov eax, dword [0x99e954]
mov dword [ebp - 0x424], eax
mov eax, dword [0x506e00]
mov dword [ebp - 0x50], eax
mov eax, dword [0x5f93c8]
mov dword [ebp - 0x448], eax
mov eax, dword [0x5ad3c0]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x494], 0x506e20
mov dword [ebp - 0x444], 0x507740
mov dword [ebp - 0x414], 0x505e60
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x3fc], 0
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x404], 0
mov eax, dword [0x4817ec]
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x414]
mov byte [eax], 0
mov eax, dword [ebp - 0x444]
mov byte [eax], 0
cmp dword [0x45e03c], 0
je 0x418273
cmp dword [0x462280], 0
je 0x418273
push str._n_r___VM_SDXX
call fcn.00452380
add esp, 4
cmp dword [0x462310], 0
jne 0x4182e9
push 0
call fcn.00452990
add esp, 4
add eax, 2
mov dword [ebp - 0x41c], eax
mov edx, dword [0x4621d0]
mov edi, dword [ebp - 0x30c]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x4a
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x418333
cmp dword [0x462254], 0
je 0x418333
cmp dword [0x462310], 0
jne 0x418333
lea eax, [ebp - 0x498]
push eax
push 0
push 0
push 0x435f3d
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x49c], eax
call fcn.00451d30
cmp dword [0x4622c8], 0
jne 0x41e3e6
mov dword [ebp - 0x3fc], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x40], 0
cmp dword [0x462120], 0
je 0x4186af
cmp dword [0x462e8c], 0
je 0x4185b0
mov dword [0x462e8c], 0
mov dword [ebp - 0x4ac], 0
push 0x470a1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x4b0], eax
cmp dword [0x45e03c], 0
je 0x4183f3
push 0x470a2c
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
mov eax, dword [ebp - 0x4b0]
push eax
push str._n_rhNT__x__n_ra__x_
call fcn.00452380
add esp, 0xc
push 0x470a58
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push str._n_rb___x_
call fcn.00452380
add esp, 8
push str.ObfDereferenceObject
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4a0], eax
push str.PoRequestPowerIrp
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x45e03c], 0
je 0x418471
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x4a4]
push eax
push str._n_ra___b____x_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0x4a0]
push eax
push str._n_rb___a____x_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x4a0], 0
je 0x41848b
cmp dword [ebp - 0x4a4], 0
jne 0x4184b4
mov dword [ebp - 0x4a8], 0
cmp dword [0x45e03c], 0
je 0x4184af
push str._n_rc_is_not_possible
call fcn.00452380
add esp, 4
jmp 0x418537
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4ac], 1
cmp dword [ebp - 0x4a8], 0x16f000
jbe 0x4184fc
mov eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4ac], 2
cmp dword [ebp - 0x4a8], 0x17f000
jbe 0x418537
cmp dword [0x45e03c], 0
je 0x41852d
mov eax, dword [ebp - 0x4a8]
push eax
push str._n_rc__x__is_invalid
call fcn.00452380
add esp, 8
mov dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0xc0
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x4a8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x4ac]
mov dword [eax + 8], ecx
cmp dword [0x45e03c], 0
je 0x41857f
mov eax, dword [ebp - 0x4ac]
push eax
push str._nd__d_
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x462318], 0
je 0x4186af
push 0
call fcn.00452990
add esp, 4
cmp eax, dword [0x462318]
jbe 0x4186af
mov eax, 0x38f
xor edx, edx
int 0x2e
cmp dword [0x45e03c], 0
je 0x418600
mov eax, dword [0x462090]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rVIDEO_STATUS___x_
call fcn.00452380
add esp, 8
mov eax, dword [0x462090]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xff
je 0x41869d
mov eax, dword [0x462090]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 1
jle 0x418636
mov dword [0x462094], 1
jmp 0x418640
mov dword [0x462094], 0
cmp dword [0x45e03c], 0
je 0x418693
mov eax, dword [0x462094]
cmp dword [0x462098], eax
je 0x418693
mov eax, 0x470b08
mov ecx, 0x470b0c
xor edx, edx
cmp dword [0x462094], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
mov eax, dword [0x462090]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_riPower_Mode___x___power_is___s_
call fcn.00452380
add esp, 0xc
mov eax, dword [0x462094]
mov dword [0x462098], eax
push 0
call fcn.00452990
add esp, 4
add eax, 2
mov dword [0x462318], eax
mov byte [ebp - 0x308], 0
inc dword [0x46230c]
cmp dword [0x4622c8], 0
je 0x41872c
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x96
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x41871d
push str._nIIIIIIIIIIIII_out_1
call fcn.00452380
add esp, 4
mov dword [0x4621c8], 1
jmp 0x41e470
push 4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x44]
mov ecx, 0x2710
mov eax, dword [ebp - 0x44]
cdq
idiv ecx
test edx, edx
jne 0x418763
cmp dword [0x462f30], 0
jne 0x41875c
call fcn.00428e0f
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x408], 0
mov edi, dword [ebp - 0x30c]
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x30c]
mov byte [eax], 1
mov edi, dword [ebp - 0x3c]
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 0x330], 0
mov eax, dword [ebp - 0x3c]
add eax, 0x334
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [0x45e03c], 0
je 0x418818
cmp dword [0x4621d0], 0x400
je 0x4187f1
push 0x470b4c
call fcn.00452380
add esp, 4
mov dword [0x4621d0], 0x400
cmp dword [0x4621d4], 0x1000
je 0x418818
push 0x470b5c
call fcn.00452380
add esp, 4
mov dword [0x4621d4], 0x1000
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x4622c8], 0
je 0x41885c
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0
mov dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x4188db
cmp dword [0x4621f8], 0
je 0x4188db
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x71
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x4188db
mov dword [ebp - 0x418], 1
cmp dword [0x462314], 0
jne 0x4188f9
mov eax, dword [0x4622bc]
or eax, dword [0x46211c]
je 0x418a91
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x418a91
cmp dword [0x46211c], 0
je 0x41899e
mov dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x3c]
add eax, 0xc
mov dword [0x462e90], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [0x462e98], eax
lea eax, [ebp - 0x4b4]
push eax
push 0
push 0
push 0x436e2e
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x462e98]
cmp dword [eax + 8], ecx
jne 0x41899e
inc dword [ebp - 0x4b8]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x4b8], 0xde
jle 0x418987
jmp 0x41899e
cmp dword [0x4622c8], 0
je 0x418999
jmp 0x41899e
jmp 0x418952
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
mov eax, dword [ebp - 0x30c]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0x118], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x410], 0
cmp dword [0x45e03c], 0
je 0x418a50
cmp dword [0x46211c], 0
jne 0x418a50
mov eax, dword [ebp - 0x3c]
add eax, 0xc
push eax
push str._n_rSkipping___S___excluded_process
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41dc2b
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x3c]
add eax, 0x334
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x418b12
mov eax, dword [ebp - 0x4bc]
movsx eax, byte [eax + 2]
cmp eax, 0x3d
jne 0x418b12
mov eax, dword [ebp - 0x4bc]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x418b12
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x4bc]
mov byte [eax + 2], 0x5e
cmp dword [0x46224c], 0
je 0x418b31
cmp dword [0x4622f4], 0
jne 0x418b31
call fcn.00434201
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax + 0x334]
cmp ecx, 0x23
jne 0x418b64
cmp dword [0x45e03c], 0
je 0x418b5f
push str._n_rX_R_I32__
call fcn.00452380
add esp, 4
jmp 0x418db2
cmp dword [0x462264], 0
jne 0x418db2
mov eax, dword [ebp - 0x3c]
add eax, 0x64
push eax
push 0x470ba0
mov eax, dword [ebp - 0x448]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x470ba4
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x418bb8
mov dword [ebp - 0x408], 0
jmp 0x418bde
push 0x470bb0
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x418bde
mov dword [ebp - 0x408], 1
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jbe 0x418caa
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
dec eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jle 0x418caa
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x418c57
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x418c9f
inc dword [ebp - 0x40c]
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x448]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x448]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x40c], 0
jmp 0x418ca5
dec dword [ebp - 0x40c]
jmp 0x418c16
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x418cf2
mov eax, dword [ebp - 0x448]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x418cf2
cmp dword [0x45e03c], 0
je 0x418ced
push str._n_rAltISkip.xp
call fcn.00452380
add esp, 4
jmp 0x418db2
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x418d3f
push 0x470bc8
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x418d3f
cmp dword [0x45e03c], 0
je 0x418d3a
push str._n_rAltISkipDLL.xp
call fcn.00452380
add esp, 4
jmp 0x418db2
push 0x470be4
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x418d84
mov dword [0x462208], 1
cmp dword [0x45e03c], 0
je 0x418d7f
push str._r_nAltChomeSuper.xp
call fcn.00452380
add esp, 4
jmp 0x418d8e
mov dword [0x462208], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x408]
push eax
call fcn.0044ee61
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x418df9
mov eax, dword [ebp - 0x318]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x118]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xf0]
push eax
mov eax, dword [ebp - 0x3c]
add eax, 0xc
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str._n__x_xp.Can_I_Lock___S___loc__x____parent__x_a120_d
call fcn.00452380
add esp, 0x18
cmp dword [0x45e03c], 0
je 0x418e39
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax + 0x334]
test ecx, ecx
je 0x418e39
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x330]
push eax
mov eax, dword [ebp - 0x3c]
add eax, 0x334
push eax
push str._nCMDL___s_._x
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x330]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x418e83
mov eax, dword [ebp - 0x430]
and al, 0xf
cmp al, 8
jne 0x418e6c
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x430]
and al, 0xf
cmp al, 2
jne 0x418e83
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x3c]
add eax, 0x334
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x458], 0
mov byte [ebp - 0x3e0], 0
lea eax, [ebp - 0x3e0]
push eax
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x414]
mov byte [eax], 0
cmp dword [0x46206c], 0
je 0x418fb4
mov eax, dword [ebp - 0x3c]
add eax, 0x334
push eax
push 0x470c48
push 0x168
mov eax, dword [ebp - 0x3c]
add eax, 0x7d0
push eax
call fcn.00452660
add esp, 0x10
mov eax, dword [ebp - 0x3c]
add eax, 0x334
push eax
push 0x470c4c
push 0xfa0
mov eax, dword [ebp - 0x444]
push eax
call fcn.00452660
add esp, 0x10
push 0x470c50
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x418f91
push 0x470c54
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x418f91
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x3c]
add eax, 0x7d0
push eax
mov eax, dword [ebp - 0x3c]
add eax, 0x64
push eax
call fcn.0042c245
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x418fb4
mov eax, dword [ebp - 0x3c]
add eax, 0x7d0
push eax
push str._r_nXP_WCH_CBJFLDF___S_
call fcn.00452380
add esp, 8
cmp dword [0x462298], 0
je 0x419016
mov eax, dword [ebp - 0x3c]
add eax, 0x7d0
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4c4]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x419016
mov eax, dword [ebp - 0x4c4]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x419016
mov eax, dword [ebp - 0x4c4]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x419016
mov eax, dword [ebp - 0x414]
push eax
call fcn.0042dec7
add esp, 4
cmp dword [0x4620f8], 0
je 0x4190c4
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x4190c4
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x4190c4
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x4190c4
mov eax, dword [ebp - 0x4c0]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x4d0], al
mov eax, dword [ebp - 0x4c0]
mov al, byte [eax + 0xe]
mov byte [ebp - 0x4cf], al
mov eax, dword [ebp - 0x4c0]
mov al, byte [eax + 0x10]
mov byte [ebp - 0x4ce], al
mov eax, dword [ebp - 0x4c0]
mov al, byte [eax + 0x12]
mov byte [ebp - 0x4cd], al
mov byte [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.004536a0
add esp, 4
push eax
mov eax, dword [ebp - 0x414]
push eax
call fcn.0042ca9c
add esp, 0xc
mov dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x3c]
add eax, 0x64
push eax
push 0x470c70
mov eax, dword [ebp - 0x448]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x470c74
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x419153
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x419153
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 2]
cmp eax, 0x5e
jne 0x419153
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x419153
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043fb13
add esp, 4
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax]
cmp eax, 0x23
jne 0x41927b
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 2]
cmp eax, 0x2b
jne 0x41927b
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 4]
cmp eax, 0x23
jne 0x41927b
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x4191d7
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x31
jne 0x4191d7
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x31
jne 0x4191d7
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2e]
cmp eax, 0x23
je 0x419249
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x419210
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x33
jne 0x419210
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x23
je 0x419249
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x28]
cmp eax, 0x23
jne 0x41927b
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2a]
cmp eax, 0x31
jne 0x41927b
mov eax, dword [ebp - 0x4c0]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x23
jne 0x41927b
mov eax, dword [ebp - 0x3c]
add eax, 0x64
push eax
push 0x470ca4
mov eax, dword [ebp - 0x448]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042e1ad
add esp, 8
mov eax, dword [ebp - 0x458]
push eax
mov eax, dword [ebp - 0x434]
push eax
call fcn.0043e02d
add esp, 8
cmp dword [0x45e03c], 0
je 0x4192b2
lea eax, [ebp - 0x3e0]
push eax
push str._nPPID_.xp_Name___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x334
push eax
push 0x470cbc
push 0xfa0
mov eax, dword [ebp - 0x444]
push eax
call fcn.00452660
add esp, 0x10
push 0x470cc0
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41931b
mov dword [ebp - 0x5c], 1
movsx eax, byte [ebp - 0x3e0]
test eax, eax
je 0x419384
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x470cc4]
mov dword [edi - 1], eax
lea edi, [ebp - 0x3e0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x3e0], 0
jmp 0x41939b
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x470cc8]
mov dword [edi - 1], eax
mov eax, dword [ebp - 0x414]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41940e
mov edi, dword [ebp - 0x414]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x419405
mov eax, dword [ebp - 0x414]
push eax
push str._r_nBMLA_.xp_Code___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x414]
mov byte [eax], 0
push 0x470ce4
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x419439
mov eax, dword [ebp - 0x444]
push eax
call fcn.004485d6
add esp, 4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x404], 0
mov edx, dword [0x4621e4]
mov edi, dword [ebp - 0x50]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [0x462078], 0
je 0x419547
cmp dword [0x46227c], 0
jne 0x41949b
cmp dword [0x462270], 0
je 0x4194fb
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x118], 0
je 0x4194fb
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x118]
push eax
call dword [0x462078]
mov dword [ebp - 0x4d4], eax
cmp dword [0x45e03c], 0
je 0x4194fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x4d4]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x118]
push eax
push str._n_rW3K_Parent_PID___x__Session___d__Rc___d__GLE___d_
call fcn.00452380
add esp, 0x14
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call dword [0x462078]
cmp dword [0x45e03c], 0
je 0x41953b
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
push str._n_rXP_Session_ID_Fixup:PID__x__was___x__is_now___x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x100], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x43c], 0
cmp dword [ebp - 0x418], 0
jne 0x419599
push 0
push 0
mov eax, dword [0x4621e8]
push eax
mov eax, dword [ebp - 0x448]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x3c]
add eax, 0xc
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x41db03
cmp dword [ebp - 0x418], 0
je 0x4195d1
mov edi, dword [ebp - 0x3c]
add edi, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x448]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x419618
cmp dword [ebp - 0x418], 0
je 0x419604
mov eax, dword [ebp - 0x448]
push eax
push str._nLock_Check_for_DLL___s_
call fcn.00452380
add esp, 8
jmp 0x419618
mov eax, dword [ebp - 0x448]
push eax
push str._nLock_Check___s_
call fcn.00452380
add esp, 8
push 0x470d8c
mov eax, dword [ebp - 0x448]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x3f8], eax
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x3f8]
jne 0x419670
mov dword [ebp - 0x58], 1
cmp dword [0x462ea8], 0
je 0x4196cd
push 0
call fcn.00452990
add esp, 4
cmp eax, dword [0x462ea8]
jae 0x4196a9
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0x58], 0
jmp 0x4196cd
mov dword [0x462ea8], 0
cmp dword [0x45e03c], 0
je 0x4196cd
push 0x470d90
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x3f8], 0
je 0x4196fa
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x3f8]
jne 0x419704
cmp dword [ebp - 0x58], 0
je 0x41dae9
cmp dword [ebp - 0x58], 0
jne 0x419834
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
mov ax, word [eax + ecx - 1]
mov word [ebp - 0x47c], ax
mov byte [ebp - 0x47a], 0
lea edi, [ebp - 0x47c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x470db8]
mov word [edi - 1], ax
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x40c], eax
cmp dword [0x45e03c], 0
je 0x419785
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x40c]
push eax
push 0x470dbc
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x10b0], eax
jmp 0x4197f9
mov dword [ebp - 0x440], 1
jmp 0x41982f
cmp dword [0x4622e4], 0
je 0x4197e0
mov dword [ebp - 0x440], 1
cmp dword [0x45e03c], 0
je 0x4197e0
push 0x470dd4
call fcn.00452380
add esp, 4
jmp 0x41982f
mov dword [ebp - 0x440], 0
jmp 0x41982f
cmp dword [ebp - 0x10b0], 6
ja case.default.0x41980c
mov eax, dword [ebp - 0x10b0]
jmp dword [eax*4 + 0x419813]
jmp 0x41983e
mov dword [ebp - 0x440], 1
cmp dword [0x462180], 0
jne 0x419858
cmp dword [0x462184], 0
je 0x4199e7
push 0x470df4
mov eax, dword [ebp - 0x448]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
mov ax, word [eax + ecx - 1]
mov word [ebp - 0x47c], ax
mov byte [ebp - 0x47a], 0
lea edi, [ebp - 0x47c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x470df8]
mov word [edi - 1], ax
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x10b4], eax
jmp 0x419992
cmp dword [0x462180], 0
je 0x419910
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x404], 1
cmp dword [0x45e03c], 0
je 0x419910
mov eax, dword [ebp - 0x40c]
push eax
push 0x470dfc
call fcn.00452380
add esp, 8
jmp 0x4199cb
push 0x470e14
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41994d
push 0x470e28
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x419988
cmp dword [0x462184], 0
je 0x419988
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x404], 1
cmp dword [0x45e03c], 0
je 0x419988
push 0x470e3c
call fcn.00452380
add esp, 4
jmp 0x4199cb
cmp dword [ebp - 0x10b4], 6
ja case.0x4199ad.3
mov eax, dword [ebp - 0x10b4]
xor ecx, ecx
mov cl, byte [eax + 0x4199c4]
jmp dword [ecx*4 + 0x4199b4]
cmp dword [ebp - 0x5c], 0
je 0x4199e7
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
cmp dword [ebp - 0x440], 0
je 0x41dae4
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x22
jne 0x419c4e
push 0x470e8c
mov eax, dword [ebp - 0x448]
inc eax
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 5
jle 0x419c49
sub dword [ebp - 0x40c], 3
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
mov eax, dword [eax + ecx]
mov dword [ebp - 0x47c], eax
mov byte [ebp - 0x478], 0
cmp dword [0x45e03c], 0
je 0x419a79
lea eax, [ebp - 0x47c]
push eax
push str._nComp___s_
call fcn.00452380
add esp, 8
push 0x470e9c
lea eax, [ebp - 0x47c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x419ab1
push 0x470ea4
lea eax, [ebp - 0x47c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x419c49
mov eax, dword [ebp - 0x40c]
add eax, 4
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x40c], 0
jle 0x419c49
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x419b01
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x419c3e
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x200], 0x77
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x201], 0xbb
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x202], 0x11
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x203], 0xaa
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax + 2]
cmp ecx, 0x3a
jne 0x419b79
mov eax, dword [ebp - 0x40c]
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x50]
add edi, 0x208
add esi, 3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x206], 0
jmp 0x419bae
mov eax, dword [ebp - 0x40c]
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x50]
add edi, 0x208
inc esi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x207], 0
cmp dword [0x45e03c], 0
je 0x419bd1
mov eax, dword [ebp - 0x50]
add eax, 0x208
push eax
push str._n_rFPATH01___s__n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x40c]
inc ecx
add ecx, dword [ebp - 0x448]
mov edi, dword [ebp - 0x20]
mov esi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx - 1], 0
cmp dword [0x45e03c], 0
je 0x419c2f
mov eax, dword [ebp - 0x20]
push eax
push str._nFN_w__s_to_SEND___s_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x40c], 0
jmp 0x419c44
dec dword [ebp - 0x40c]
jmp 0x419ac0
jmp 0x41a398
cmp dword [ebp - 0x418], 0
jne 0x41a370
cmp dword [0x45e03c], 0
je 0x419c86
cmp dword [ebp - 0x58], 0
je 0x419c86
mov eax, dword [ebp - 0x448]
push eax
push str._n_rFNCheck___s___np_
call fcn.00452380
add esp, 8
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x40c], 0
push 0x470ee8
mov eax, dword [ebp - 0x448]
push eax
call fcn.00453660
add esp, 8
cmp eax, dword [ebp - 0x3f8]
je 0x419cf1
push 0x470eec
mov eax, dword [ebp - 0x448]
push eax
call fcn.00453660
add esp, 8
cmp eax, dword [ebp - 0x3f8]
je 0x419cf1
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x40c], eax
jge 0x419f74
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
mov eax, dword [eax + ecx]
mov dword [ebp - 0x47c], eax
mov byte [ebp - 0x478], 0
push 0x470ef0
lea eax, [ebp - 0x47c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x419d57
push 0x470ef8
lea eax, [ebp - 0x47c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x419f69
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x3f8], eax
add dword [ebp - 0x40c], 4
cmp dword [0x45e03c], 0
je 0x419d84
push str._n_rEXE_or_COM_found
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x3f8], 0
jle 0x419f55
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x419dc5
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x419efc
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x200], 0x77
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x201], 0xbb
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x202], 0x11
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x203], 0xaa
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x3a
jne 0x419e3d
mov eax, dword [ebp - 0x3f8]
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x50]
add edi, 0x208
add esi, 2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x207], 0
jmp 0x419e71
mov eax, dword [ebp - 0x3f8]
mov edi, dword [ebp - 0x50]
add edi, 0x208
mov esi, dword [ebp - 0x448]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x209], 0
cmp dword [0x45e03c], 0
je 0x419e94
mov eax, dword [ebp - 0x50]
add eax, 0x208
push eax
push str._n_rFPATH02___s__n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x3f8]
inc ecx
add ecx, dword [ebp - 0x448]
mov edi, dword [ebp - 0x20]
mov esi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx - 1], 0
cmp dword [0x45e03c], 0
je 0x419ef2
mov eax, dword [ebp - 0x20]
push eax
push str._nFN_w_o__s_to_SEND___s_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x3f8], 0
dec dword [ebp - 0x3f8]
jne 0x419f50
mov eax, dword [ebp - 0x40c]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x448]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx], 0
cmp dword [0x45e03c], 0
je 0x419f50
mov eax, dword [ebp - 0x20]
push eax
push str._nFN_w_o_slashes_to_SEND___s_
call fcn.00452380
add esp, 8
jmp 0x419d84
mov dword [ebp - 0x40c], 0x63
mov dword [ebp - 0x3f8], 0
inc dword [ebp - 0x40c]
jmp 0x419cf1
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x41a02d
lea eax, [ebp - 0x4fc]
push eax
mov eax, dword [ebp - 0x448]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0
je 0x419fd2
cmp dword [0x45e03c], 0
je 0x419fcd
mov eax, dword [ebp - 0x448]
push eax
push str._n_rstat_failed____s__is_not_a_file
call fcn.00452380
add esp, 8
jmp 0x41a02d
cmp dword [0x45e03c], 0
je 0x419ff3
mov eax, dword [ebp - 0x448]
push eax
push str._n_rstat_says_IS_A_FILE___with_no_.EXE_or_.COM____s_
call fcn.00452380
add esp, 8
cmp dword [0x462108], 0
je 0x41a02d
cmp dword [0x45e03c], 0
je 0x41a01a
push str._n_rWill_BLOCK_THIS_ONE_from_running__no_executable_file_extension
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x448]
mov byte [eax], 0
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x41a36b
cmp dword [0x45e03c], 0
je 0x41a056
push str._nFN_has_no_EXE_ext_search_for_____
call fcn.00452380
add esp, 4
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x40c], eax
jge 0x41a36b
cmp dword [0x4622c8], 0
je 0x41a09e
jmp 0x41a36b
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x448]
mov ax, word [eax + ecx]
mov word [ebp - 0x47c], ax
mov byte [ebp - 0x47a], 0
push 0x47101c
lea eax, [ebp - 0x47c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a360
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x3f8], eax
add dword [ebp - 0x40c], 2
cmp dword [0x45e03c], 0
je 0x41a105
push str._n_r_____found
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x3f8], 0
jle 0x41a33a
cmp dword [0x4622c8], 0
je 0x41a124
jmp 0x41a33a
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x5c
je 0x41a158
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov dl, byte [eax + ecx]
cmp edx, 0x2f
jne 0x41a2ab
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x200], 0x77
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x201], 0xbb
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x202], 0x11
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x203], 0xaa
mov eax, dword [ebp - 0x448]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x3a
jne 0x41a1d0
mov eax, dword [ebp - 0x3f8]
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x50]
add edi, 0x208
add esi, 2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x207], 0
jmp 0x41a204
mov eax, dword [ebp - 0x3f8]
mov edi, dword [ebp - 0x50]
add edi, 0x208
mov esi, dword [ebp - 0x448]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x50]
mov byte [eax + ecx + 0x209], 0
cmp dword [0x45e03c], 0
je 0x41a227
mov eax, dword [ebp - 0x50]
add eax, 0x208
push eax
push str._n_rFPATH03___s__n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x3f8]
inc ecx
add ecx, dword [ebp - 0x448]
mov edi, dword [ebp - 0x20]
mov esi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx - 3], 0
mov edx, 0x471040
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov al, byte [edx + 4]
mov byte [edi + 4], al
cmp dword [0x45e03c], 0
je 0x41a2a1
mov eax, dword [ebp - 0x20]
push eax
push str._n____FN_w_o__s_to_SEND___s_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x3f8], 0
dec dword [ebp - 0x3f8]
jne 0x41a335
mov eax, dword [ebp - 0x40c]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x448]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40c], 1
jle 0x41a2f4
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx - 2], 0
jmp 0x41a2fb
mov eax, dword [ebp - 0x20]
mov byte [eax + 1], 0
mov edx, 0x471064
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov al, byte [edx + 4]
mov byte [edi + 4], al
cmp dword [0x45e03c], 0
je 0x41a335
mov eax, dword [ebp - 0x20]
push eax
push str._n____FN_w_o_slashes_to_SEND___s_
call fcn.00452380
add esp, 8
jmp 0x41a105
cmp dword [0x4622c8], 0
je 0x41a34c
jmp 0x41a36b
mov dword [ebp - 0x40c], 0x63
mov dword [ebp - 0x3f8], 0
inc dword [ebp - 0x40c]
jmp 0x41a07a
jmp 0x41a398
mov edi, dword [ebp - 0x448]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x20]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x41a3ba
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._n_rProceed_..._x
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x4c], 0
jne 0x41a3fd
push 0x99e960
mov eax, dword [ebp - 0x20]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a3fd
cmp dword [0x45e03c], 0
je 0x41a3f7
push str._n_____pass_1_
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
push 0x99e920
mov eax, dword [ebp - 0x20]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a436
cmp dword [0x45e03c], 0
je 0x41a430
push str._n_____pass_2_
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [0x462220]
cmp dword [ebp - 0x1c], eax
jle 0x41a4b8
xor eax, eax
sub eax, dword [0x462220]
neg eax
sub dword [ebp - 0x1c], eax
cmp dword [0x45e03c], 0
je 0x41a479
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x448]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._n_nryy__d___s_
call fcn.00452380
add esp, 0xc
push 0x4ff660
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x448]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a4b8
cmp dword [0x45e03c], 0
je 0x41a4b2
push str._n_____pass_3
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [ebp - 0x20]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x41a4d2
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41a4fd
push 0
mov eax, dword [ebp - 0x20]
push eax
call fcn.00417dbf
add esp, 8
test eax, eax
je 0x41a4fd
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41dae4
mov eax, dword [0x4622c0]
push eax
call fcn.00413b0b
add esp, 4
cmp dword [0x45e03c], 0
je 0x41a56f
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [0x46224c]
push eax
push str._nHWND16_is___x__PID___x_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x20]
push eax
push str._nFN_SEND_TO_SERVER___s_
call fcn.00452380
add esp, 8
mov eax, dword [0x462254]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
push str._nTSE_id___d__stat_d
call fcn.00452380
add esp, 0xc
push str.slui.exe
mov eax, dword [ebp - 0x20]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a5a5
inc dword [ebp - 0x18]
cmp dword [0x45e03c], 0
je 0x41a5a5
push 0x47113c
call fcn.00452380
add esp, 4
push str.lpremove.exe
mov eax, dword [ebp - 0x20]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41a5df
mov dword [ebp - 0x18], 2
cmp dword [0x45e03c], 0
je 0x41a5df
push str._n
call fcn.00452380
add esp, 4
mov edi, dword [ebp - 0x50]
xor eax, eax
mov ecx, 0x7e
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
cmp dword [0x462254], 0
je 0x41a604
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x45
jmp 0x41a60a
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x25
cmp dword [0x462254], 0
je 0x41a663
cmp dword [0x46225c], 0
jne 0x41a663
mov dword [0x46225c], 1
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x44
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
jmp 0x41a6c4
cmp dword [0x462254], 0
jne 0x41a6c4
cmp dword [0x46225c], 0
jne 0x41a6c4
cmp dword [0x46224c], 0
jne 0x41a6c4
mov dword [0x46225c], 1
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xa4
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
cmp dword [0x462254], 0
jne 0x41a6d8
mov eax, dword [ebp - 0x50]
mov byte [eax + 1], 0x44
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x5d
jle 0x41a737
sub dword [ebp - 0x40c], 0x5d
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x20]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x20]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x5d], 0
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 2
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x9854e0
mov edi, dword [ebp - 0x50]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 0xbe], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
cmp dword [0x46224c], 0
je 0x41b605
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x3c]
mov al, byte [eax + 0xfc]
push eax
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xbd], 0
cmp dword [0x462254], 0
je 0x41a896
mov dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x420]
mov dword [eax + 0x7c], ecx
mov eax, dword [ebp - 0x428]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xbd], 0x8a
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [0x4622e4], 0
je 0x41a8b2
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xbc], 0x9f
jmp 0x41a8bc
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xbc], 0
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x25
mov dword [ebp - 0x468], 0x100
mov dword [ebp - 0x464], 0x320
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x50]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x578
jne 0x41a985
cmp dword [0x45e03c], 0
je 0x41a962
push 0x47115c
call fcn.00452380
add esp, 4
push 0x10
push 0x471178
push 0x471194
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x400], 2
jmp 0x41a985
cmp dword [0x4622b0], 0
je 0x41aa6a
push 0x471254
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41aa3a
push 0x471264
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41aa3a
push 0x471270
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41aa3a
push 0x47127c
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41aa3a
push 0x471288
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x41aa3a
push 0x471294
mov eax, dword [ebp - 0x448]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41aa6a
push 1
call fcn.004359b5
add esp, 4
cmp dword [0x45e03c], 0
je 0x41aa6a
mov eax, dword [ebp - 0x448]
push eax
push 0x5086e0
push str._n_rNDS_Name_for_Browser_Audit___s___s
call fcn.00452380
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x41aa92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x400]
push eax
push 0x4712c8
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x400], 0
jne 0x41aabf
mov eax, 5
cmp eax, dword [ebp - 0x400]
mov eax, 2
adc eax, 0xffffffff
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.00417dbf
add esp, 8
mov eax, dword [ebp - 0x30c]
add eax, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x30c]
add eax, 0x125
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [ebp - 0x400], 5
jbe 0x41ada7
mov dword [ebp - 0x468], 0x155
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3ec], eax
cmp dword [0x45e03c], 0
je 0x41ab65
mov eax, dword [ebp - 0x3ec]
push eax
push 0x4712ec
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x3ec], 0x55
jne 0x41ada7
cmp dword [0x45e03c], 0
je 0x41ab8c
push 0x47130c
call fcn.00452380
add esp, 4
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x93
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x400]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xc], eax
cmp dword [0x45e03c], 0
je 0x41abeb
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 4]
push eax
push 0x471320
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x41ac3b
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push 0x471340
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41ad9d
cmp dword [0x45e03c], 0
je 0x41ac64
push 0x47134c
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x5c], 0
je 0x41ac80
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x30c]
add eax, 8
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x400], 2
cmp dword [0x4622f4], 0
jne 0x41acc3
call fcn.00434201
mov edi, 0x4818a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4fa0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x41ad15
push 0x40010
push 0x47136c
push 0x5f4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41ad98
mov dword [ebp - 8], 0
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x314]
mov dword [0x462e9c], eax
mov dword [0x462ea0], 0x10
lea eax, [ebp - 0x3e8]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0x430702
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], 0
cmp dword [ebp - 0x46c], 0
je 0x41ad98
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jle 0x41ad93
mov dword [ebp - 0x46c], 0
jmp 0x41ad64
jmp 0x41ada7
mov dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x400], 5
jbe 0x41b55f
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 1
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x400]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
cmp dword [0x462254], 0
je 0x41ae15
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0xe8], ecx
jmp 0x41ae25
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
mov dword [ebp - 0x468], 0x125
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
cmp dword [0x45e03c], 0
je 0x41ae83
mov eax, dword [ebp - 0x400]
push eax
push str._n_rGet_idle_stuff_returned___x_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x400], 0
je 0x41aed3
mov dword [ebp - 0x14], 0x12345678
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x400]
mov dword [eax + 0x10], ecx
cmp dword [0x45e03c], 0
je 0x41aed3
mov eax, dword [ebp - 0x400]
push eax
push str._n_rIdle_Detection_in_Response...__x_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x468], 0x126
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
cmp dword [0x45e03c], 0
je 0x41af31
mov eax, dword [ebp - 0x400]
push eax
push str._n_rGet_Timekeeping_stuff_returned___x_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x400], 0
je 0x41b55a
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xc2
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621e0]
push eax
mov eax, dword [ebp - 0x424]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x41af8f
push str._n_rGot_C2
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x424]
xor ecx, ecx
mov cl, byte [eax + 8]
test ecx, ecx
je 0x41b55a
mov byte [ebp - 0x308], 0
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 8]
mov byte [ebp - 0x307], al
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x41afe8
xor eax, eax
mov al, byte [ebp - 0x307]
test al, 4
je 0x41afe8
xor eax, eax
mov al, byte [ebp - 0x307]
or al, 8
mov byte [ebp - 0x307], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 9]
mov byte [ebp - 0x306], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xa]
mov byte [ebp - 0x305], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xb]
mov byte [ebp - 0x304], al
mov edi, dword [ebp - 0x424]
add edi, 0x10
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x2ec]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x41b0e1
xor eax, eax
mov al, byte [ebp - 0x306]
test al, 4
je 0x41b08d
mov byte [ebp - 0x308], 1
mov eax, 0x471408
lea ecx, [ebp - 0x269]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
jmp 0x41b0dc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x4817e8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x3e4], eax
lea eax, [ebp - 0x308]
push eax
push 0x432b4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x471418
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x3e4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x41b28e
mov dword [ebp - 8], 0
cmp dword [0x45e03c], 0
je 0x41b10e
mov eax, dword [ebp - 0x424]
xor ecx, ecx
mov cl, byte [eax + 0xb]
push ecx
push str._n_r_n_NW_TSE_STATUS_PRE_REPLY_7__TK_Pulse___d_
call fcn.00452380
add esp, 8
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 0x30c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x54]
mov byte [eax], 7
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 8]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x12], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 9]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x13], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xa]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x14], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xb]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x15], al
lea edi, [ebp - 0x2ec]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x54]
add edi, 0x1a
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x41b1b7
push 0x47145c
call fcn.00452380
add esp, 4
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621dc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4621d8]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0x12a]
mov dword [ecx + 0x12a], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x48]
mov dword [eax + 0x12e], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
lea eax, [ebp - 0x3e8]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0x4334e2
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], 0
cmp dword [ebp - 0x46c], 0
je 0x41b287
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jle 0x41b282
mov dword [ebp - 0x46c], 0
jmp 0x41b253
mov byte [ebp - 0x308], 0x44
cmp dword [0x45e03c], 0
je 0x41b2b0
movsx eax, byte [ebp - 0x308]
push eax
push str._n_rMove_TK_P___d_
call fcn.00452380
add esp, 8
movsx eax, byte [ebp - 0x308]
cmp eax, 1
jne 0x41b35a
mov al, byte [ebp - 0x304]
mov ecx, dword [ebp - 0x30c]
mov byte [ecx + 0x125], al
mov eax, dword [ebp - 0x30c]
add eax, 0x126
push eax
call fcn.00417c72
add esp, 4
mov eax, dword [ebp - 0x30c]
mov byte [eax + 0x12a], 0xc2
lea edi, [ebp - 0x269]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x30c]
add edi, 0x12b
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x30c]
add edi, 0x15f
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b55a
movsx eax, byte [ebp - 0x308]
cmp eax, 3
jne 0x41b55a
cmp dword [0x45e03c], 0
je 0x41b384
push 0x471478
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x94
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0xe8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xc], eax
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [ebp - 0x5c], 0
je 0x41b404
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41b418
jmp 0x41b518
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
push 0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x48]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0x86
mov eax, dword [ebp - 0x3c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov esi, 0x9854e0
mov edi, dword [ebp - 0x3c]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
cmp dword [0x45e03c], 0
je 0x41b4a3
push str._n_rSend_Cancel_Packet_to_NW_Server
call fcn.00452380
add esp, 4
mov dword [ebp - 0x468], 0x300
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x3c]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x30c]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
cmp dword [ebp - 0x5c], 0
je 0x41b55a
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
jmp 0x41b57b
mov al, byte [ebp - 0x400]
mov ecx, dword [ebp - 0x30c]
mov byte [ecx + 1], al
mov eax, dword [ebp - 0x30c]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
cmp dword [0x462254], 0
je 0x41b5cc
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0xe8], ecx
jmp 0x41b5dc
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
cmp dword [0x45e03c], 0
je 0x41b600
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xf0]
push eax
push str._n_rNW_Move_on_2___240___x_
call fcn.00452380
add esp, 8
jmp 0x41d92e
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x3c]
mov al, byte [eax + 0xfc]
push eax
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
cmp dword [0x462254], 0
je 0x41bfdb
mov dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x420]
mov dword [eax + 0x7c], ecx
mov eax, dword [ebp - 0x428]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
mov dword [0x462ea4], 0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax + 0xfc]
mov dword [0x462ea4], ecx
cmp dword [0x45e03c], 0
je 0x41b72d
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
push str.TSE_ID__x____d_.
call fcn.00452380
add esp, 8
cmp dword [0x462260], 0
je 0x41b756
cmp dword [0x462270], 0
jne 0x41b756
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xdb], 0x76
jmp 0x41b760
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xdb], 0
cmp dword [0x462270], 0
je 0x41b784
cmp dword [0x462278], 0
jne 0x41b784
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xdb], 0x76
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax + 0xdb]
test ecx, ecx
jne 0x41b7d5
mov eax, dword [ebp - 0x50]
add eax, 0xe6
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0043d6ab
add esp, 8
cmp dword [0x45e03c], 0
je 0x41b7d5
mov eax, dword [ebp - 0x50]
add eax, 0xe6
push eax
push 0x4714f4
call fcn.00452380
add esp, 8
cmp dword [0x4622e4], 0
je 0x41b7f1
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xda], 0x9f
jmp 0x41b7fb
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xda], 0
cmp dword [0x462ea4], 0
je 0x41b817
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xd9], 0x7e
jmp 0x41b821
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xd9], 0
lea eax, [ebp - 0x450]
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [ebp - 0x48c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x50]
add eax, 0xc3
push eax
lea eax, [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0044af6c
add esp, 0xc
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0xc3], 0
jne 0x41ba0b
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x100], 0
je 0x41ba0b
push 0x471510
mov eax, dword [ebp - 0x428]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x41b937
push 0x471518
mov eax, dword [ebp - 0x428]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x41b937
push 0x471528
mov eax, dword [ebp - 0x428]
push eax
call fcn.00452540
add esp, 8
test eax, eax
je 0x41b937
mov eax, dword [ebp - 0x428]
push eax
push 0x471538
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x41b937
mov eax, dword [ebp - 0x428]
push eax
push 0x471540
call fcn.0040a186
add esp, 8
test eax, eax
jne 0x41b937
push 0x471548
mov eax, dword [ebp - 0x428]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x41b93c
jmp 0x41ba0b
cmp dword [0x45e03c], 0
je 0x41b972
mov eax, dword [ebp - 0x428]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
push str._n_r_Axp_NULL_TIME_SESSION__d___x___s_
call fcn.00452380
add esp, 0x10
push 0x46d
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x50]
add eax, 0xc3
push eax
lea eax, [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
call fcn.0044af6c
add esp, 0xc
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0xc3], 0
jne 0x41ba0b
cmp dword [0x45e03c], 0
je 0x41b9de
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
push str._n_r_Bxp_NULL_TIME_SESSION__d___x
call fcn.00452380
add esp, 0xc
push 0x3d5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x50]
add eax, 0xc3
push eax
lea eax, [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
call fcn.0044af6c
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x41ba65
xor eax, eax
mov al, byte [ebp - 0x487]
push eax
xor eax, eax
mov al, byte [ebp - 0x488]
push eax
xor eax, eax
mov al, byte [ebp - 0x489]
push eax
xor eax, eax
mov al, byte [ebp - 0x48a]
push eax
xor eax, eax
mov al, byte [ebp - 0x48b]
push eax
xor eax, eax
mov al, byte [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xdc]
push eax
push str._n_rUser_Login_Time_sid__d_
call fcn.00452380
add esp, 0x20
lea eax, [ebp - 0x48c]
mov ecx, dword [ebp - 0x50]
add ecx, 0xbc
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x5d
jle 0x41bb05
sub dword [ebp - 0x40c], 0x5d
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x20]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x20]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x5d], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x462304]
mov dword [eax + 2], ecx
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 6
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x9854e0
mov ecx, dword [ebp - 0x50]
add ecx, 0x64
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
xor eax, eax
mov ax, word [0x462324]
push eax
xor eax, eax
mov ax, word [0x462330]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cx, word [eax]
push ecx
push str._n_rOFSz___x_____X__ogx_XP___d._d_
call fcn.00452380
add esp, 0x14
xor eax, eax
mov ax, word [0x462330]
test eax, eax
jne 0x41bbad
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x41bc16
lea eax, [ebp - 0x9fc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x8fc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x6fc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0xac4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
jmp 0x41bc7c
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x9fc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0043d4f6
add esp, 0x14
xor eax, eax
mov al, byte [ebp - 0x8fc]
test eax, eax
jne 0x41bc7c
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x9fc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0043d4f6
add esp, 0x14
cmp dword [0x45e03c], 0
je 0x41bcab
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0x8fc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
push 0x471620
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfa], 0x11
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfb], 0x88
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfc], 0xcc
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfd], 0xaa
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x200], 0xaa11bb77
jne 0x41bd40
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax + 0x208]
test ecx, ecx
jne 0x41bd0a
mov eax, dword [ebp - 0x50]
mov cx, word [0x471638]
mov word [eax + 0x208], cx
mov edi, dword [ebp - 0x50]
add edi, 0x208
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x104
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41bd51
mov eax, dword [ebp - 0x50]
mov cx, word [0x47163c]
mov word [eax + 0x104], cx
mov edi, dword [ebp - 0x50]
add edi, 0x104
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x470], eax
inc dword [ebp - 0x470]
lea edi, [ebp - 0x8fc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jae 0x41bd9e
mov ax, word [0x471640]
mov word [ebp - 0x8fc], ax
lea edi, [ebp - 0x8fc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x470]
add ebx, 0x104
add ebx, dword [ebp - 0x50]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x470]
add eax, 0x104
add eax, dword [ebp - 0x50]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x490], eax
inc dword [ebp - 0x490]
mov edi, 0x508800
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x470]
add ebx, dword [ebp - 0x490]
add ebx, 0x104
add ebx, dword [ebp - 0x50]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x430]
mov dword [eax + 0x394], ecx
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x398
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], 0
je 0x41be9e
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043f397
add esp, 0xc
mov dword [ebp - 0x40], 0
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x50]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
cmp ecx, 0xfe
jne 0x41bf9b
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
cmp dword [0x45e03c], 0
je 0x41bf3c
push 0x471644
call fcn.00452380
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x50]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 2
jle 0x41bf96
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0xf1
jmp 0x41beda
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0xf1
jne 0x41bfd6
cmp dword [0x45e03c], 0
je 0x41bfcc
push str._n_rPipe_F1___out
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
jmp 0x41c471
mov dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x428]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, 0x9a3720
mov ecx, dword [ebp - 0x50]
add ecx, 0xb4
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x44
jne 0x41c0ad
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x462304]
mov dword [eax + 2], ecx
mov edi, dword [ebp - 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 6
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x9854e0
mov edi, dword [ebp - 0x50]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
cmp dword [0x45e03c], 0
je 0x41c0ce
mov eax, dword [ebp - 0x428]
push eax
push str._n_r_USER_name_FOUND___s_
call fcn.00452380
add esp, 8
cmp dword [0x4622e4], 0
je 0x41c0ea
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xda], 0x9f
jmp 0x41c0f4
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xda], 0
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xec4]
push eax
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0043d4f6
add esp, 0x14
xor eax, eax
mov al, byte [ebp - 0xec4]
test eax, eax
jne 0x41c15a
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xec4]
push eax
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
call fcn.0043d4f6
add esp, 0x14
cmp dword [0x45e03c], 0
je 0x41c189
lea eax, [ebp - 0xfc4]
push eax
lea eax, [ebp - 0xec4]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
push str._n_rPID__d____s___s__r_n
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfa], 0x11
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfb], 0x88
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfc], 0xcc
mov eax, dword [ebp - 0x50]
mov byte [eax + 0xfd], 0xaa
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x200], 0xaa11bb77
jne 0x41c21e
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax + 0x208]
test ecx, ecx
jne 0x41c1e8
mov eax, dword [ebp - 0x50]
mov cx, word [0x471690]
mov word [eax + 0x208], cx
mov edi, dword [ebp - 0x50]
add edi, 0x208
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x104
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41c22f
mov eax, dword [ebp - 0x50]
mov cx, word [0x471694]
mov word [eax + 0x104], cx
mov edi, dword [ebp - 0x50]
add edi, 0x104
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x470], eax
inc dword [ebp - 0x470]
lea edi, [ebp - 0xec4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 5
jae 0x41c27c
mov ax, word [0x471698]
mov word [ebp - 0xec4], ax
lea edi, [ebp - 0xec4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x470]
add ebx, 0x104
add ebx, dword [ebp - 0x50]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x470]
add eax, 0x104
add eax, dword [ebp - 0x50]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x490], eax
inc dword [ebp - 0x490]
mov edi, 0x508800
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov ebx, dword [ebp - 0x470]
add ebx, dword [ebp - 0x490]
add ebx, 0x104
add ebx, dword [ebp - 0x50]
mov edi, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x430]
mov dword [eax + 0x394], ecx
mov edi, dword [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x50]
add edi, 0x398
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x50]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
cmp ecx, 0xfe
jne 0x41c451
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x64
push 0x5ad3e0
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
cmp dword [0x45e03c], 0
je 0x41c3f2
push 0x47169c
call fcn.00452380
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
inc eax
push eax
push 0x546
mov eax, dword [ebp - 0x50]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xe
jle 0x41c44c
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0xf2
jmp 0x41c390
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3fc], 0
je 0x41d6b1
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x41c510
cmp dword [ebp - 0x454], 0
je 0x41c510
mov eax, dword [ebp - 0x3c]
add eax, 0x334
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x1090]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x109c], al
mov eax, dword [ebp - 0x1090]
mov al, byte [eax + 0xe]
mov byte [ebp - 0x109b], al
mov eax, dword [ebp - 0x1090]
mov al, byte [eax + 0x10]
mov byte [ebp - 0x109a], al
mov eax, dword [ebp - 0x1090]
mov al, byte [eax + 0x12]
mov byte [ebp - 0x1099], al
mov byte [ebp - 0x1098], 0
lea eax, [ebp - 0x109c]
push eax
mov eax, dword [ebp - 0x454]
push eax
call fcn.0042f96e
add esp, 8
mov dword [ebp - 0x454], 0
push str.powergeopak
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41c531
jmp 0x41c635
push 0x4716b4
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41c59e
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043eb1a
add esp, 0xc
mov eax, dword [ebp - 0x448]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043e4c8
add esp, 0x10
jmp 0x41c635
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 0
je 0x41c635
push 0x4716bc
mov eax, dword [ebp - 0x444]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x41c635
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 3]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043ec28
add esp, 0x10
test eax, eax
je 0x41c60d
mov eax, dword [ebp - 0x30c]
mov dword [eax + 3], 0
mov eax, dword [ebp - 0x448]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043e4c8
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x41c671
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
push ecx
push 0
call fcn.00452990
add esp, 4
push eax
push str._n__x__PIPE_WORKED_cc__x__lsid__x_
call fcn.00452380
add esp, 0x10
cmp dword [0x462190], 0
je 0x41c72d
cmp dword [ebp - 0x430], 0
jne 0x41c72d
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x4621b0]
add ecx, 0xf
cmp eax, ecx
jae 0x41c6ab
jmp 0x41c728
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x41c728
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 0
je 0x41c728
cmp dword [0x45e03c], 0
je 0x41c6f5
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 0x20]
push ecx
push str._r_r_A32__1159pm___X_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x30c]
mov al, byte [eax + 0x20]
push eax
mov eax, dword [0x462190]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0040d924
add esp, 0x14
jmp 0x41c7ba
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 0x20]
test ecx, ecx
je 0x41c7ba
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 1]
test ecx, ecx
jne 0x41c7ba
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 0
je 0x41c7ba
cmp dword [0x45e03c], 0
je 0x41c78a
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 0x20]
push ecx
push str._r_r_B32__1159pm___X_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x30c]
mov al, byte [eax + 0x20]
push eax
mov eax, dword [0x462190]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 3]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0040d924
add esp, 0x14
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 0
jne 0x41c7e6
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 1
sbb eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.00417dbf
add esp, 8
cmp dword [ebp - 0x418], 0
je 0x41c808
mov edi, dword [ebp - 0x30c]
add edi, 9
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x18], 2
jne 0x41c81c
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x29
jne 0x41c861
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 0x67]
push eax
call fcn.004253f4
add esp, 0x10
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
jne 0x41cab7
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 0x15], 0x11223344
jne 0x41c896
mov dword [ebp - 0x310], 1
jmp 0x41c8a0
mov dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 0x1f]
cmp ecx, 0x55
jne 0x41caa8
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x93
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 3]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xc], eax
cmp dword [0x45e03c], 0
je 0x41c916
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 4]
push eax
push str._nMuxCheck_LSID___x__PID___x_
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41caa3
cmp dword [0x45e03c], 0
je 0x41c96d
push 0x471730
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x30c]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [ebp - 0x310], 0
cmp dword [ebp - 0x5c], 0
je 0x41c9b0
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
cmp dword [0x4622f4], 0
jne 0x41c9c2
call fcn.00434201
mov edi, 0x4818a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4fa0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x462254], 0
jne 0x41ca14
push 0x40010
push 0x471750
push 0x5f4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41caa3
mov dword [ebp - 0x10a0], 0
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x314]
mov dword [0x462e9c], eax
mov dword [0x462ea0], 0x10
lea eax, [ebp - 0x3e8]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0x430702
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10a0], 0
cmp dword [ebp - 0x46c], 0
je 0x41caa3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x10a0]
cmp dword [ebp - 0x10a0], 0x1f4
jle 0x41ca9e
mov dword [ebp - 0x46c], 0
jmp 0x41ca69
jmp 0x41cab2
mov dword [ebp - 0x3ec], 0
jmp 0x41cacb
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x3ec], 0
cmp dword [0x45e03c], 0
je 0x41cafe
mov eax, dword [ebp - 0x3ec]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str._n__x_tk_reply__d_____Stop_Mux___x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 0x21]
mov dword [0x462230], eax
cmp dword [0x45e03c], 0
je 0x41cb2c
mov eax, dword [0x462230]
push eax
push 0x471798
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
jne 0x41cb71
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 3], 0
je 0x41cb67
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 1
jmp 0x41cb71
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 1
jle 0x41cbb4
cmp dword [0x45e03c], 0
je 0x41cb9f
push str._n_rOFSz_120001
call fcn.00452380
add esp, 4
push 0xca
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x46222c], 1
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 9], 0x12345678
jne 0x41cc71
cmp dword [0x45e03c], 0
je 0x41cbe1
push 0x4717b4
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x30c]
add eax, 9
lea ecx, [ebp - 0x34]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x30c]
add ecx, 0xc
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
push 0
call fcn.00452990
add esp, 4
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x480]
mov dword [eax + 0x18], ecx
cmp dword [0x45e03c], 0
je 0x41cc6c
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 0x12]
push ecx
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cx, word [eax + 0x10]
push ecx
push str._n_rIdle_Warn___d__Kill___d_
call fcn.00452380
add esp, 0xc
jmp 0x41ccb2
cmp dword [0x45e03c], 0
je 0x41cc95
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 9]
push eax
push 0x4717f0
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x30c]
add eax, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 3]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
cmp dword [0x462254], 0
je 0x41cd0c
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0xe8], ecx
jmp 0x41cd1c
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
mov eax, dword [ebp - 0x30c]
add eax, 0x125
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [ebp - 0x310], 0
je 0x41d6ac
cmp dword [0x45e03c], 0
je 0x41cd61
push 0x47180c
call fcn.00452380
add esp, 4
mov dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x25
mov eax, dword [ebp - 0x50]
mov byte [eax + 1], 0x43
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov edi, dword [ebp - 0x424]
xor eax, eax
mov ecx, 0x66
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x19a
mov eax, dword [ebp - 0x424]
push eax
push 0x14
mov eax, dword [ebp - 0x50]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
je 0x41d6ac
mov eax, dword [ebp - 0x424]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x41cdf8
mov eax, dword [ebp - 0x424]
cmp dword [eax + 4], 0x11223344
je 0x41ce1d
mov eax, dword [ebp - 0x424]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x41d6ac
mov eax, dword [ebp - 0x424]
cmp dword [eax + 4], 0x11223355
jne 0x41d6ac
mov eax, dword [ebp - 0x424]
cmp dword [eax + 0x190], 0x33aa4411
jne 0x41ce50
mov eax, dword [ebp - 0x424]
mov ecx, dword [0x462348]
cmp dword [eax + 0x194], ecx
je 0x41ce50
call fcn.00410dd4
mov eax, dword [ebp - 0x424]
cmp dword [eax + 4], 0x11223355
jne 0x41ce72
mov dword [ebp - 0x3f4], 1
jmp 0x41ce7c
mov dword [ebp - 0x3f4], 0
cmp dword [0x45e03c], 0
je 0x41cec4
push 0
call fcn.00452990
add esp, 4
push eax
push str._n_r__x_Pipe_for_TK_worked_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x424]
add eax, 0x10
push eax
push str._n_rTimekeeper_Prompt_is___s___d_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x3f4], 0
je 0x41ced1
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 1
jne 0x41d6ac
mov byte [ebp - 0x308], 0
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 8]
mov byte [ebp - 0x307], al
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x41cf2b
xor eax, eax
mov al, byte [ebp - 0x307]
test al, 4
je 0x41cf2b
xor eax, eax
mov al, byte [ebp - 0x307]
or al, 8
mov byte [ebp - 0x307], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 9]
mov byte [ebp - 0x306], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xa]
mov byte [ebp - 0x305], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xb]
mov byte [ebp - 0x304], al
mov eax, dword [ebp - 0x424]
mov byte [eax + 0x7e], 0
mov edi, dword [ebp - 0x424]
add edi, 0x10
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x2ec]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3f4], 0
je 0x41d004
mov edi, dword [ebp - 0x424]
add edi, 0x82
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x160]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x424]
add edi, 0x104
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0xde]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41d014
lea eax, [ebp - 0x160]
mov dword [eax], 0
mov byte [eax + 4], 0
cmp dword [0x462254], 0
jne 0x41d0b2
xor eax, eax
mov al, byte [ebp - 0x306]
test al, 4
je 0x41d05e
mov byte [ebp - 0x308], 1
mov eax, 0x471890
lea ecx, [ebp - 0x269]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
jmp 0x41d0ad
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x3e4], eax
mov dword [0x4817e8], 0
lea eax, [ebp - 0x308]
push eax
push 0x432b4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x4718a0
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x3e4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x41d29f
mov dword [ebp - 8], 0
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 0x30c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x54]
mov byte [eax], 7
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 8]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x12], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 9]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x13], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xa]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x14], al
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xb]
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x15], al
lea edi, [ebp - 0x2ec]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x54]
add edi, 0x1a
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [ebp - 0x3f4], 0
je 0x41d1b6
lea edi, [ebp - 0x160]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x54]
add edi, 0x190
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xde]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x54]
add edi, 0x226
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41d1c8
mov eax, dword [ebp - 0x54]
add eax, 0x190
mov dword [eax], 0
mov byte [eax + 4], 0
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621dc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4621d8]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0x12a]
mov dword [ecx + 0x12a], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x48]
mov dword [eax + 0x12e], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
lea eax, [ebp - 0x3e8]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0x4334e2
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], 0
cmp dword [ebp - 0x46c], 0
je 0x41d298
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jle 0x41d293
mov dword [ebp - 0x46c], 0
jmp 0x41d264
mov byte [ebp - 0x308], 0x44
movsx eax, byte [ebp - 0x308]
cmp eax, 1
jne 0x41d34c
mov eax, dword [ebp - 0x424]
mov al, byte [eax + 0xb]
mov ecx, dword [ebp - 0x30c]
mov byte [ecx + 0x125], al
mov eax, dword [ebp - 0x30c]
add eax, 0x126
push eax
call fcn.00417c72
add esp, 4
mov eax, dword [ebp - 0x30c]
mov byte [eax + 0x12a], 0xc2
lea edi, [ebp - 0x269]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x30c]
add edi, 0x12b
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x30c]
add edi, 0x15f
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41d6ac
movsx eax, byte [ebp - 0x308]
cmp eax, 3
jne 0x41d6ac
cmp dword [0x45e03c], 0
je 0x41d376
push 0x4718b4
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x50]
mov byte [eax], 0x94
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0xe8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xc], eax
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621e4]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41d408
cmp dword [0x45e03c], 0
je 0x41d403
push 0x4718d8
call fcn.00452380
add esp, 4
jmp 0x41d66a
cmp dword [0x45e03c], 0
je 0x41d422
push 0x4718f0
call fcn.00452380
add esp, 4
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
push 0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x48]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
cmp dword [0x462254], 0
je 0x41d47d
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0x85
jmp 0x41d483
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0x86
mov eax, dword [ebp - 0x3c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov esi, 0x9854e0
mov edi, dword [ebp - 0x3c]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0xd9], 0
cmp dword [0x462254], 0
je 0x41d5f3
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0x78], ecx
cmp dword [0x462078], 0
je 0x41d4ec
mov eax, dword [ebp - 0x3c]
add eax, 0x7c
push eax
mov eax, dword [ebp - 0x48]
push eax
call dword [0x462078]
cmp dword [0x45e03c], 0
je 0x41d518
mov eax, dword [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x7c]
push eax
mov eax, dword [ebp - 0x48]
push eax
push str._r_n85x:_p__d_ti__d___sid:_x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x428]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x3c]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x3c]
add eax, 0xbc
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x424]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffff9c
add eax, 0xe4
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
jmp 0x41d65d
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x424]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffffb0
add eax, 0xe4
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3fc], 0
je 0x41d66a
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
mov eax, dword [ebp - 0x30c]
add eax, 9
mov dword [eax], 0
mov byte [eax + 4], 0
cmp dword [ebp - 0x5c], 0
je 0x41d6ac
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
jmp 0x41d92e
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
mov eax, dword [ebp - 0x30c]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
cmp dword [0x45e03c], 0
je 0x41d754
cmp dword [0x462f30], 0
je 0x41d740
push str._nPIPE_FAILED_____POWER_SUSPENDED
call fcn.00452380
add esp, 4
jmp 0x41d754
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.PIPE_FAILED_GLE___d__n
call fcn.00452380
add esp, 8
cmp dword [0x4622a0], 0
je 0x41d7b2
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [0x4622a0]
shl ecx, 2
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
add eax, ecx
mov dword [0x462ea8], eax
cmp dword [0x45e03c], 0
je 0x41d7b2
mov eax, dword [0x462ea8]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [0x4622a0]
push eax
push 0x471960
call fcn.00452380
add esp, 0x10
cmp dword [0x4622a8], 0
je 0x41d92e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
jne 0x41d92e
cmp dword [0x462ea8], 0
je 0x41d7ff
mov dword [0x462ea8], 0
cmp dword [0x45e03c], 0
je 0x41d7ff
push 0x471998
call fcn.00452380
add esp, 4
cmp dword [0x462254], 0
je 0x41d819
cmp dword [0x462260], 0
je 0x41d92e
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
cmp dword [ebp - 0x5c], 0
je 0x41d83f
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
call fcn.0041e874
add esp, 4
cmp dword [0x462254], 0
je 0x41d917
mov dword [ebp - 0x10a4], 0
mov esi, 0x4719ac
mov edi, 0x5acc20
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
mov ax, word [eax + 0x100]
mov word [0x462eec], ax
lea eax, [ebp - 0x10a8]
push eax
push 0
lea eax, [ebp - 0x10a4]
push eax
push 0x4327d3
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41d8cc
cmp dword [0x45e03c], 0
je 0x41d8c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_n_a_CTW_FAILED___d_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x10a4], 1
cmp dword [ebp - 0x10a4], 0
jne 0x41d8f8
cmp dword [0x4622c8], 0
je 0x41d8eb
jmp 0x41d8f8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d8cc
cmp dword [0x45e03c], 0
je 0x41d912
push str._r_n_a_CTW_Complete
call fcn.00452380
add esp, 4
jmp 0x41d92e
push 0x40010
push 0x471a10
push 0x471a24
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [ebp - 0x308]
cmp eax, 0x44
je 0x41dac0
push 0
call fcn.00452990
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x41d995
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
push eax
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x30c]
xor ecx, ecx
mov cl, byte [eax]
push ecx
movsx eax, byte [ebp - 0x308]
push eax
push str._n_rDriver_non_44_hookup_now__x__signal___x__RC_x_240_x__x_
call fcn.00452380
add esp, 0x18
cmp dword [ebp - 0x418], 0
je 0x41d9e2
cmp dword [0x45e03c], 0
je 0x41d9d9
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax]
push eax
push str._n_r0x72_back___x___x___x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x72
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x41da21
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
push eax
push 0x471ab8
call fcn.00452380
add esp, 0xc
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x41da77
push 0
call fcn.00452990
add esp, 4
push eax
push str._n_rDriver_non_44_hookup_returned_1__x_
call fcn.00452380
add esp, 8
push 0
call fcn.00452990
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0x2d
cmp eax, ecx
jbe 0x41dabb
cmp dword [0x462150], 0
je 0x41dabb
cmp dword [0x45e03c], 0
je 0x41dab6
push str._n_rQThread_QExit_QNow
call fcn.00452380
add esp, 4
jmp 0x41e470
jmp 0x41dada
cmp dword [0x45e03c], 0
je 0x41dada
push str._n_rDriver_44_skip
call fcn.00452380
add esp, 4
mov dword [ebp - 0x43c], 1
jmp 0x41db03
cmp dword [0x45e03c], 0
je 0x41db03
push str.___NO_PATH___
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x43c], 0
jne 0x41dc2b
cmp dword [0x45e03c], 0
je 0x41db3c
mov eax, dword [ebp - 0x404]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str._n__x_Sending_Reply_back_to_Kernel_Driver__no_server_resp___d_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x418], 0
je 0x41db57
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x72
jmp 0x41db60
mov eax, dword [ebp - 0x30c]
mov byte [eax], 2
cmp dword [ebp - 0x404], 0
je 0x41db7c
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 2
jmp 0x41db86
mov eax, dword [ebp - 0x30c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [eax + 0xf0]
mov dword [ecx + 0xf0], eax
mov eax, dword [ebp - 0x30c]
add eax, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [0x462254], 0
je 0x41dbea
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0xe8], ecx
jmp 0x41dbfa
mov eax, dword [ebp - 0x30c]
mov dword [eax + 0xe8], 0
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov edi, dword [ebp - 0x3c]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x30c]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0xa
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x41dcf1
cmp dword [0x4621f8], 0
je 0x41dcf1
mov edi, dword [ebp - 0x3c]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x30c]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x70
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x4622c8], 0
je 0x41dd04
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41e122
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xc2]
mov dword [ebp - 0x10], eax
cmp dword [0x45e03c], 0
je 0x41dd51
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xbe]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
push str._nUNLOCK_LSID___x____dpid
call fcn.00452380
add esp, 0xc
cmp dword [0x46224c], 0
je 0x41ddde
mov dword [ebp - 0x468], 0x200
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0x17
mov eax, dword [ebp - 0x3c]
mov byte [eax + 1], 0
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x3c]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
cmp dword [0x45e03c], 0
je 0x41ddd9
mov eax, dword [ebp - 0x400]
push eax
push 0x471b84
call fcn.00452380
add esp, 8
jmp 0x41e0b1
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
push 0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xbe]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
cmp dword [0x462254], 0
je 0x41de3a
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0x47
mov eax, dword [ebp - 0x3c]
mov byte [eax + 1], 0
mov esi, 0x9854e0
mov edi, dword [ebp - 0x3c]
add edi, 0x64
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
cmp dword [0x462254], 0
je 0x41e047
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x438]
mov dword [eax + 0x78], ecx
mov eax, dword [ebp - 0x428]
mov byte [eax + 0x32], 0
mov edi, dword [ebp - 0x428]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x3c]
add edi, 0x80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0xaa], 0xe4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0xab], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax + 0x100]
mov dword [ecx + 0xdc], eax
cmp dword [0x45e03c], 0
je 0x41def3
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
push str.__TSE_ID___d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0xd9], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
push eax
call fcn.0040f8b4
add esp, 8
lea eax, [ebp - 0x48c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp - 0x3c]
add eax, 0xc3
push eax
lea eax, [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
call fcn.0044af6c
add esp, 0xc
lea eax, [ebp - 0x48c]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xbc
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
cmp dword [0x45e03c], 0
je 0x41dfcc
xor eax, eax
mov al, byte [ebp - 0x487]
push eax
xor eax, eax
mov al, byte [ebp - 0x488]
push eax
xor eax, eax
mov al, byte [ebp - 0x489]
push eax
xor eax, eax
mov al, byte [ebp - 0x48a]
push eax
xor eax, eax
mov al, byte [ebp - 0x48b]
push eax
xor eax, eax
mov al, byte [ebp - 0x48c]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0xdc]
push eax
push str._n_rout.User_Login_Time_sid__d_
call fcn.00452380
add esp, 0x20
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffff9c
add eax, 0xe4
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
mov edi, dword [ebp - 0x3c]
xor eax, eax
mov ecx, 0x39
rep stosd dword es:[edi], eax
jmp 0x41e0b1
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x462304]
mov dword [eax + 0x74], ecx
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
push eax
cmp dword [0x462254], 1
sbb eax, eax
and eax, 0xffffff9c
add eax, 0xe4
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0xb
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
cmp dword [0x45e03c], 0
je 0x41e0ea
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 4]
push eax
push str._n_3_PA_to_remove_clear___x__n_n
call fcn.00452380
add esp, 8
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov dword [ebp - 0x10], 0
cmp dword [0x4622ac], 0
je 0x41e174
cmp dword [ebp - 0x4c], 0
je 0x41e14a
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x10ac], eax
jmp 0x41e154
mov dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x10ac]
push eax
call fcn.004366d5
add esp, 4
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x30c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov edi, dword [ebp - 0x494]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30c]
mov byte [eax], 9
push 0
lea eax, [ebp - 0x45c]
push eax
push 0x91a
mov eax, dword [ebp - 0x494]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0
cmp dword [0x4622c8], 0
je 0x41e206
mov eax, dword [ebp - 0x494]
mov byte [eax], 0
mov eax, dword [ebp - 0x494]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x41e3e1
cmp dword [0x45e03c], 0
je 0x41e23c
mov eax, dword [ebp - 0x494]
mov eax, dword [eax + 4]
push eax
push str._nTIMEKEEPER_RECORD_on_LSID___x_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x494]
mov ecx, dword [0x5dfaa0]
mov dword [eax + 0x32], ecx
mov eax, dword [ebp - 0x494]
add eax, 0xc
push eax
call fcn.00417c72
add esp, 4
cmp dword [0x46224c], 0
je 0x41e364
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x428]
mov byte [eax], 0
lea eax, [ebp - 0x420]
push eax
push 0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x494]
mov eax, dword [eax + 0xc6]
push eax
call fcn.0042fd1c
add esp, 0x18
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0x494]
mov eax, dword [eax + 0xc6]
mov dword [ecx + 0xbe], eax
mov dword [ebp - 0x468], 0x200
mov dword [ebp - 0x464], 0x190
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x460], eax
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x494]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4a
mov eax, dword [0x46224c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x400], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45e03c], 0
je 0x41e35f
mov eax, dword [ebp - 0x400]
push eax
push 0x471c44
call fcn.00452380
add esp, 8
jmp 0x41e3e1
mov eax, dword [ebp - 0x494]
cmp dword [eax + 4], 0x30000000
jae 0x41e37c
jmp 0x41e3e1
mov byte [0x9854ef], 0
mov esi, 0x9854e0
mov edi, dword [ebp - 0x494]
add edi, 0x88
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x494]
mov ecx, dword [0x462304]
mov dword [eax + 0x80], ecx
push 1
lea eax, [ebp - 0x45c]
push eax
push 0x80
mov eax, dword [ebp - 0x30c]
push eax
push 0x190
mov eax, dword [ebp - 0x494]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
mov dword [ebp - 0x3fc], eax
jmp 0x418338
cmp dword [0x4622c8], 0
je 0x41e456
mov eax, dword [ebp - 0x30c]
mov byte [eax], 0x96
push 0
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [0x4621d4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [0x4621d0]
push eax
mov eax, dword [ebp - 0x30c]
push eax
push 0xab350200
mov eax, dword [ebp + 8]
push eax
call fcn.004372d3
add esp, 0x20
cmp dword [0x45e03c], 0
je 0x41e447
push str._nIIIIIIIIIIIII_out_1gg
call fcn.00452380
add esp, 4
mov dword [0x4621c8], 1
jmp 0x41e470
cmp dword [0x45e03c], 0
je 0x41e470
push str._n_rEXIT_DM
call fcn.00452380
add esp, 4
pop edi
pop esi
pop ebx
leave
ret